New SSH attack weakens passwords

New SSH attack weakens passwords
Ann Harrison, SecurityFocus 2001-08-17

Researchers say the elapsed time between keystrokes can reveal much about your password.

passwd keystroke timing 2001-08-20
Zoltan Maroti

I don't know the protocol used to send password

in SSH but would it be hard to send the whole

password in one packet? Ie. till you don't hit

the enter no packet is sent by every keystroke.

This would defeat the information gaining on

sensitive data....

[ more ] [ reply ]

SSH Keystroke Timing Attack 2001-08-20
Chris Leonardos <cleonardos (at) triumph (dot) com [email concealed]> (3 replies)

My question is this: If the SSH Client caches the user keystrokes when accepting the password, and sends them only after the OK button is clicked, how can this attack be at all usefull?...

[ more ] [ reply ]

SSH Keystroke Timing Attack 2001-08-20
impetus (1 replies)

Ahhh, you do not focus on the crux of the issue. The ssh password may never be revealed do to key authentication. think instead of the passwords that may be used whilst conducting an ssh session. For instance, it is common practice to have a reasonably secure [;-) server act as a ssh concentrator. U...

[ more ] [ reply ]

SSH Keystroke Timing Attack 2001-08-30
Anonymous SSH User

Now, if I remember correctly, the SSH2 protocol has a flag that can be sent with a packet which says 'ignore this packet'. I guess the idea is that both sides should periodically (apparently rapidly) send these packets to foil timing attacks. An eavesdropper won't be able to tell if the packet is ma...

[ more ] [ reply ]

SSH Keystroke Timing Attack 2001-08-30
Anonymous Coward

The keystroke timings on passwords aren't usefull, but I'm sure one can still determine the length of the password to a decent degree.

On the other hand, initial passwords aren't the only interesting things to see as someone mentions here later....

[ more ] [ reply ]

SSH Keystroke Timing Attack 2001-08-30
Chuck Geigner

Around these here parts, admins don't point-and-click. After all, were using terminal sessions, right? What kind of client are you using that you have to click "OK"?...

[ more ] [ reply ]

how hard would it be 2001-08-30
Gerard Saraber

... to write a patch that adds a random delay to the packets before they get sent out ?

...

[ more ] [ reply ]

Why use password? 2001-08-30
Wkdpanda

Why use password to begin with? I only allow strong authentication by key file. No passwords work on my machines!...

[ more ] [ reply ]

Which keystrokes to find timings for. 2001-08-30
Todd Knarr <tknarr (at) silverglass (dot) org [email concealed]>

Isn't there a big hurdle in this attack, namely figuring out which keystrokes in an SSH session are actually the password being typed? Unless you know that, you're going to have an awful lot of combinations of timing information to try, more than then actual number of possible passwords in fact. Hav...

[ more ] [ reply ]