3 ms·
Probing for vulnerable deployments over the network (without the attacker's private key) seems impossible, not non-trivial. The best one could do is more micro
by cjbprime 3y ago
Probing for vulnerable deployments over the network (without the attacker's private key) seems impossible, not non-trivial.
The best one could do is more micro-benchmarking, but for an arbitrary Internet host you aren't going to know whether it's slow because it's vulnerable, or because it's far away, or because the computer's slow in general -- you don't have access to how long connection attempts to that host took historically. (And of course, there are also routing fluctuations.)
- deleted 3y ago[deleted]
- anonymous-panda 3y agoShould be able to do it by having the scanner take multiple samples. As long as you don’t need a valid login and the performance issue is still observable, you should be about to scan for it with minimal cost
- cjbprime 3y agoLooks like the slowdown is actually at sshd process startup time, not authentication time. So it's back to being completely impossible to network-probe for.