5 ms·

OpenSSH update from Damien Miller

62 points by bcl 17y ago

brown9-2 17y ago
So basically this story boils down to (at least as of now): ...I'm not pursuaded that an 0day exists at all. The only evidence so far are some anonymous rumours and unverifiable intrusion transcripts. Maybe this should be a lesson to wait for more solid info before people begin panicking...
- weaksauce 17y ago
  Or if you have a server that is very important you can take steps to mitigate the problem until the issue is resolved. In that case I would make it so that the ssh is only accessible behind a firewall on the local network. If it is a front facing server with no backend network I would change the open port(though this should be done already) and/or enable port knocking. You could also set iptables to only allow access from your remote network.
  - JeremyChase 17y ago
    Or you could be running a version of OpenSSH that is less than four years old. 4.3 came out in 2005
    - weaksauce 17y ago
      The thing is without full disclosure from the dev team (after they find out if it is in fact a true exploit) upgrading in the dark just to upgrade you could be upgrading to a version of the software that has the exploit.
      - JeremyChase 17y ago
        Every report I have found says that, if an exploit does exist, it is in an old version of OpenSSH. I have no idea why you would update to anything but a recent version. If you suggest that your distribution doesn't have an update to a recent enough version; then rumored OpenSSH exploits are the least of your security concerns. Your post also suggests that Damien Miller and the OpenSSH development team would not disclose the exploit. Are you aware that one of the goals of the OpenBSD and OpenSSH projects is Full Disclosure? What evidence do you have to suggest that they would go against their own goals? http://www.openbsd.org/security.html http://www.openbsd.org/security.html
        weaksauce 17y ago
        I think I might not have been clear enough in my point. The people at OpenSSH are good, that was not in question. The point I was making is that the "anti-sec movement" are miles away from trustworthy. Without a confirmation from the actual devs that the current (5.x) versions are OK from the "exploit" I will not be upgrading from the most recent version that is on my distro. Taking a random "hacker" without proof at face value on the internet is not my cup of tea. As randallsquared pointed out here http://news.ycombinator.com/item?id=692344 http://news.ycombinator.com/item?id=692344 it is entirely possible that the latest version has the problem and this is all a social engineering hack to get everyone to upgrade to a compromised version without any data whatsoever.
    - thras 17y ago
      To be fair, most people running 4.3 are running 4.3 with RHEL back-patches or something similar. That's what distribution maintainers are for -- there's nothing less secure than trying to remember to patch all your individual programs yourself.
    - deleted 17y ago
      [deleted]
  - tedunangst 17y ago
    If these are the kinds of things you think will make you safer, why don't you always do this? Why wait for unsubstantiated rumors to come out before going into safe mode?
    - weaksauce 17y ago
      I was talking about the people who are in a panic right now. I do all the things that are "best practice" for a ssh server currently but that will not stop a 0-day exploit in the wild. My main point was to remove the servers that you are worried about from any connection to the outside world if you are able to do it without disrupting your operations until a full report from a trusted source is disclosed.
matthewking 17y ago
Excuse my ignorance, but who is Mark Dowd? Edit: link I just found: http://taossa.com/index.php/author/mark/ http://taossa.com/index.php/author/mark/
- weaksauce 17y ago
  I hadn't heard of him either but a google search looks like he is pretty good at exploits: http://blogs.zdnet.com/security/?p=1030 http://blogs.zdnet.com/security/?p=1030
  - brown9-2 17y ago
    related links/discussions about his exploits if you're interested: http://news.ycombinator.com/item?id=164725 http://news.ycombinator.com/item?id=164725 http://news.ycombinator.com/item?id=690592 http://news.ycombinator.com/item?id=690592 http://news.ycombinator.com/item?id=692881 http://news.ycombinator.com/item?id=692881
- melito 17y ago
  He was 'duke' from efnet and undernet 10+ years ago.

62 points by bcl 17y ago

So basically this story boils down to (at least as of now): ...I'm not pursuaded that an 0day exists at all. The only evidence so far are some anonymous rumours and unverifiable intrusion transcripts. Maybe this should be a lesson to wait for more solid info before people begin panicking...

weaksauce 17y ago
Or if you have a server that is very important you can take steps to mitigate the problem until the issue is resolved. In that case I would make it so that the ssh is only accessible behind a firewall on the local network. If it is a front facing server with no backend network I would change the open port(though this should be done already) and/or enable port knocking. You could also set iptables to only allow access from your remote network.
- JeremyChase 17y ago
  Or you could be running a version of OpenSSH that is less than four years old. 4.3 came out in 2005
  - weaksauce 17y ago
    The thing is without full disclosure from the dev team (after they find out if it is in fact a true exploit) upgrading in the dark just to upgrade you could be upgrading to a version of the software that has the exploit.
    - JeremyChase 17y ago
      Every report I have found says that, if an exploit does exist, it is in an old version of OpenSSH. I have no idea why you would update to anything but a recent version. If you suggest that your distribution doesn't have an update to a recent enough version; then rumored OpenSSH exploits are the least of your security concerns. Your post also suggests that Damien Miller and the OpenSSH development team would not disclose the exploit. Are you aware that one of the goals of the OpenBSD and OpenSSH projects is Full Disclosure? What evidence do you have to suggest that they would go against their own goals? http://www.openbsd.org/security.html http://www.openbsd.org/security.html
      - weaksauce 17y ago
        I think I might not have been clear enough in my point. The people at OpenSSH are good, that was not in question. The point I was making is that the "anti-sec movement" are miles away from trustworthy. Without a confirmation from the actual devs that the current (5.x) versions are OK from the "exploit" I will not be upgrading from the most recent version that is on my distro. Taking a random "hacker" without proof at face value on the internet is not my cup of tea. As randallsquared pointed out here http://news.ycombinator.com/item?id=692344 http://news.ycombinator.com/item?id=692344 it is entirely possible that the latest version has the problem and this is all a social engineering hack to get everyone to upgrade to a compromised version without any data whatsoever.
  - thras 17y ago
    To be fair, most people running 4.3 are running 4.3 with RHEL back-patches or something similar. That's what distribution maintainers are for -- there's nothing less secure than trying to remember to patch all your individual programs yourself.
  - deleted 17y ago
    [deleted]
- tedunangst 17y ago
  If these are the kinds of things you think will make you safer, why don't you always do this? Why wait for unsubstantiated rumors to come out before going into safe mode?
  - weaksauce 17y ago
    I was talking about the people who are in a panic right now. I do all the things that are "best practice" for a ssh server currently but that will not stop a 0-day exploit in the wild. My main point was to remove the servers that you are worried about from any connection to the outside world if you are able to do it without disrupting your operations until a full report from a trusted source is disclosed.

matthewking 17y ago

Excuse my ignorance, but who is Mark Dowd? Edit: link I just found: http://taossa.com/index.php/author/mark/ http://taossa.com/index.php/author/mark/

weaksauce 17y ago
I hadn't heard of him either but a google search looks like he is pretty good at exploits: http://blogs.zdnet.com/security/?p=1030 http://blogs.zdnet.com/security/?p=1030
- brown9-2 17y ago
  related links/discussions about his exploits if you're interested: http://news.ycombinator.com/item?id=164725 http://news.ycombinator.com/item?id=164725 http://news.ycombinator.com/item?id=690592 http://news.ycombinator.com/item?id=690592 http://news.ycombinator.com/item?id=692881 http://news.ycombinator.com/item?id=692881
melito 17y ago
He was 'duke' from efnet and undernet 10+ years ago.