9 ms·
OpenSSH sshd – memory leak
- ricksta 12y ago20 BTC seem quite cheap for these kind of bug no?
- MichaelGG 12y agoBut a good price to scam people; not too expensive, so it'll get a few bites.
- reedloden 12y agoFolks on oss-security are skeptical about this (and rightly so, since posts like this have been showing up regularly since heartbleed). http://seclists.org/oss-sec/2014/q2/246 http://seclists.org/oss-sec/2014/q2/246
- wfn 12y ago| 236kb of exploit source, must be written for enterprise.
- ShaneCurran 12y agoMaybe a crowdfund could be set up to gather together the 20 BTC and then open source it or distribute it to the backers
- icambron 12y agoCould you image being the person who spends 20 BTC for an exploit without any evidence that it's real? "But look, there's console output right there!"
- 140am 12y agoa 236 kbyte C exploit code example - you defiantly get 'something' for your 20 BTC..
- sp332 12y agoHey all that ANSI art takes a lot of space :p
- Zancarius 12y ago> defiantly I realize that was (probably?) a typo, but it's oddly amusing and strangely fitting.
- 140am 12y agodefinitely fitting :P
- phaer 12y agoProbably because of all the documentation and unit tests ;)
- mrbill 12y agoIt includes the pirated PDFs the "authors" used to learn C.
- roeme 12y agoIt seems that once again, running services on non-standard ports where possible might have payed off. Off to patching. Or rather, wait for eventual patches. But you know what interests me the most about the whole thing? Theo de Raadts reaction. You know, after bashing OpenSSL heavily. And hinting at a SSH hole in FreeBSD, known to him but deliberately undisclosed. Judging from the announcement's tested systems, it might be the exact hole he referred to. "...many more" sounds like they'd like to claim more successfully exploited platforms, but can't since they do something different, and the de facto reference implementation of OpenSSH on OpenBSD is suspiciously absent.
- akerl_ 12y agoI'm curious how running services on non-standard ports has an impact on anything like this. This specific threat appears to be a hoax, but even if it wasn't, an attacker just portscans you and then targets your SSH service. Moving the port doesn't even buy you a few minutes.
- marksamman 12y agoIt helps against a masscan on the standard port. If the attacker is specifically targeting you or has the resources to masscan every port, then I agree that it's useless.
- akerl_ 12y agohttps://zmap.io/ https://zmap.io/ / https://github.com/zmap/zmap https://github.com/zmap/zmap It's pretty crazy to think about, but a portscan of the IPv4 space isn't that hard to do in practice: "On a typical desktop computer with a gigabit Ethernet connection, ZMap is capable scanning the entire public IPv4 address space in under 45 minutes."
- marksamman 12y agoIt isn't clear whether that is on a specific port or every port. The documentation[1] makes it look like it's on a specific port since it requires a target port to run. If it's on a specific port, you might want to multiply 45 minutes with 65535, if not I'm impressed. Thanks for sharing, I had not heard about ZMap before. [1] https://zmap.io/documentation.html https://zmap.io/documentation.html EDIT: The research paper says that it's on a particular port, from page 3: "The architecture allows sending and receiving components to run asynchronously and enables a single source machine to comprehensively scan every host in the public IPv4 address space for a particular open TCP port in under 45 mins using a 1 Gbps Ethernet link."
- tlongren 12y agoSeems legit.
- pera 12y agohttps://blockchain.info/address/14PEL35LQf81oCvSPurhoyTSvosvtQT7u3 https://blockchain.info/address/14PEL35LQf81oCvSPurhoyTSvosv... > Total Received 0 BTC
- nullc 12y agoWell duh, ... of course if someone sent 20 BTC there you can bet they'd be flooded with emails of the form "my txid is {txid}, send it over to me". This is one of multiple reasons why the Bitcoin system wasn't designed for people to reuse addresses.
- pera 12y agouh? you can sign the message to prove your identity
- nullc 12y agoMaybe you can, not always. Did you issue the payment from your account a service? Did you issue it from a hardware wallet? Did you, by chance, happen to decide that you want to use an anonymization tool when buying your exploit? Perhaps, you have a strict retention policy and destroy keys which are no longer used and can't sign for it anymore…
- pera 12y agoIf you are paying 20btc for a zero day exploit I suppose you know what you are doing. Either way everything you had mentioned are not deficiencies of Bitcoin per se.
- victormx 12y agoNow two transactions of 0.0003 BTC
- deleted 12y ago[deleted]
- jwcrux 12y agoThis is garbage. Probably the same guys behind this other one recently (http://pastebin.com/qPxR9BRv http://pastebin.com/qPxR9BRv). One of the members of the full disclosure mailing list outed these guys here: http://seclists.org/fulldisclosure/2014/Apr/292 http://seclists.org/fulldisclosure/2014/Apr/292 Only this time - they got smart: > Please note that we are busy and we will NOT answer to questions, social engineering tentatives or dumb comments. AKA > Please note that we will not in any way prove this is legit (not falling for that again!)
- deleted 12y ago[deleted]
- jacquesm 12y agoAnybody that pays for this deserves exactly what they get. I also still have a bunch of lightly used one-time pads for sale...
- __david__ 12y ago> This vulnerability exploits a bad check on the network layer of the sshd server that we trigger to retrieve all children processes memory sections… That's not making sense to me. I really thought that, and correct me if I'm wrong here, parents never had access to child process memory and that you had to go out of your way to do even limited memory sharing between processes.
- stormbrew 12y agoIf the parent process were deliberately sharing memory pages with the child it might be possible to get those pages (or, if the child process executes code from them, to do pretty much anything with it). These seem like pretty novice mistakes for the openssh team to make, though. A more important issue is that the window in which your connection is actually being managed by the parent process of all sshd instances must be vanishingly small. More likely you'd be looking to access memory while the ssh process was still privileged. I'm still not sure what that'd get you, though.
- djmdjm 12y agoSo, there are usually four sshd processes involved in handling a connection: 1 - master sshd, listens for incoming connections. When it accepts one it forks and executes a new sshd to handle it. It executes a new sshd to ensure that each one gets different runtime randomisations (ASLR mappings, PRNG state, etc.) 2 - privileged sshd. This is the result of the fork+exec of (1) above. It does absolutely no packet processing and exists only to perform options that require privilege or access to sensitive data (e.g. the host keys). As soon as it starts, it forks an unprivileged process. 3 - pre-auth sshd. This is the first unprivileged process forked by #2. It is responsible for packet processing and most crypto (except that which touches sensitive data). This process runs in chroot, In recent OpenSSH versions, this process is sandboxed using systrace, seccomp-bpf, OS X seatbelt or (if none of these are supported) restrictive rlimits. It exits as soon as the user is authenticated. 4 - post-auth sshd. This is forked from the #2 process after authentication completes. It runs with the privileges of the user and handles network packets and crypto much like #3. Most of this (except the re-exec and sandboxing) is described in Niels Provos' original privsep paper: http://www.citi.umich.edu/u/provos/ssh/privsep.html http://www.citi.umich.edu/u/provos/ssh/privsep.html
- djmdjm 12y agoSo: 1) this is probably bullshit. cf. http://seclists.org/oss-sec/2014/q2/247 http://seclists.org/oss-sec/2014/q2/247 2) from the memory dump, it looks like it is post-authentication so the impact would be quite limited (stealing the password hash of an account one already has access to) 3) we're (OpenSSH) going to check it out anyway
- jacquesm 12y agoKudos for playing it safe, this does open you up to the possibility of being DOS'd with fake vulnerabilities whilst exploiting a real one.
- namuol 12y ago236k for some exploit code. Okay.
- djmdjm 12y agoIMO this isn't implausible - if I were making a single-file exploit then I'd probably just include most of OpenSSH in that single file.