PuTTY, a SSH client for Windows, requests the passphrase to the ssh key
in the console window used for the connection. This could allow a
malicious server to gain access to a user's passphrase by spoofing that
prompt.
We assume that the user is using key-bases ssh auth with ssh and
connects using PuTTY. PuTTY now asks for the passphrase to the key. The
user enters the passphrase. If the passphrase is wrong, PuTTY will now
request the passphrase again after stating that it was wrong. If the
passphrase is correct, the connection to the server is established.
A malicious/manipulated server could then display "Wrong passphrase" and
ask for the passphrase again. If the user enters it again, it is sent to
the malicious server.
As far as I can see, there are only two ways how the user might detect it:
1. The real "Wrong passphrase" message is displayed without delay. After
entering the correct passphrase, a small delay occurs.
2. The prompt contains the name of the key as stored on the client.
Often the same name is used in the authorized_keys file on the server,
giving it to the attacker. Maybe it is also possible for the server to
remotely read the screen contents or duplicate it using some xterm
control sequences, so users should not rely on it.
(See also the attached screenshot, where you can see that there is no
visible difference.)
I assume that there are more similar issues like this one using
different authentication modes etc.
This can be exploited using a modified .bashrc file. This means that
once an attacker has gained access to a user account on the server, he
can try this to gain the passphrase to the key.
Impact:
Low.
As a malicious server is required, the attack probability is not very
high. Without the keyfile, the passphrase is worthless to the attacker
unless it is used in multiple places. However, key-based auth is
supposed to be secure even with untrusted/malicious servers.
Developer notification:
The possibility of such spoofing attacks is known:
http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/gui-auth.html
Workaround:
Load the key into the Pageant agent before esablishing the connection
Other software affected:
Probably many console-based SSH tools have similar issues.
?PNG
in the console window used for the connection. This could allow a
malicious server to gain access to a user's passphrase by spoofing that
prompt.
We assume that the user is using key-bases ssh auth with ssh and
connects using PuTTY. PuTTY now asks for the passphrase to the key. The
user enters the passphrase. If the passphrase is wrong, PuTTY will now
request the passphrase again after stating that it was wrong. If the
passphrase is correct, the connection to the server is established.
A malicious/manipulated server could then display "Wrong passphrase" and
ask for the passphrase again. If the user enters it again, it is sent to
the malicious server.
As far as I can see, there are only two ways how the user might detect it:
1. The real "Wrong passphrase" message is displayed without delay. After
entering the correct passphrase, a small delay occurs.
2. The prompt contains the name of the key as stored on the client.
Often the same name is used in the authorized_keys file on the server,
giving it to the attacker. Maybe it is also possible for the server to
remotely read the screen contents or duplicate it using some xterm
control sequences, so users should not rely on it.
(See also the attached screenshot, where you can see that there is no
visible difference.)
I assume that there are more similar issues like this one using
different authentication modes etc.
This can be exploited using a modified .bashrc file. This means that
once an attacker has gained access to a user account on the server, he
can try this to gain the passphrase to the key.
Impact:
Low.
As a malicious server is required, the attack probability is not very
high. Without the keyfile, the passphrase is worthless to the attacker
unless it is used in multiple places. However, key-based auth is
supposed to be secure even with untrusted/malicious servers.
Developer notification:
The possibility of such spoofing attacks is known:
http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/gui-auth.html
Workaround:
Load the key into the Pageant agent before esablishing the connection
Other software affected:
Probably many console-based SSH tools have similar issues.
?PNG
IHDR¤2?N£PLTEt»?UU?r5¿ßÿUtØ@@@»¤¤ßrr¤5rrr?UUÔÄ¥»??Hr¤??»¤HtØ??ÿÿH?
HÄ?Uÿ¿¯t¿ÿ5r¤¿t??¤rÇÄÈÿÔÐȤ?U¯ttØU?¤¿»»»?»?¤»¤ÿßØ»»?¬?tHÄr5U????¥U??rr
r5U?»ÿÿßĪ¼¤¤rt?ÿÿÿǪ»»¤¤¤??¿ÿ???±ÀÀÀ?·È»¤rßßì??¤r5r¤»H?ìrUr???¬ÄÈÇ
бÿÿؤ»»??±ß??r¤¤?H???»H??UUÔ·??»»???º???¤ÿÿìÔļt?ìºÐ¼¤??¤»?±??ßÿÿ?
ßÿ¿ÿÿÔбH¯Çм???t?ÿßì?¿Ä¤¤¤Ôм?¤¤ÇÐÈ???ºÐÈôË. pHYs ?? IDATx?í?ã¶uç©Qow?ãh]m9òVãÜJñÏku?Ú]oÏNændo?ÉyÚK&Þö®iä?ë%õùÿÿ ?? AR5"ßü¾??"?Ô@?þ@ÈÎ?, û@Ë<ÈÎ?I<{??Å3é±/ MH¤Ç>Ð&©8 RiX?>B`?>B(?43 ñWö¢ R[£Gü?½(?4Ó7ª?~?v¨ÿàA¼^ÌQ©«ÑcþÎ?¥®F?9JEú£ =z?v?çÑI¼^ÌQ&R[£ÇûeG]
s??ôÑw?ô?¯ßø$µÚ¢¤J3f ??½µ âýço©ÿßÚázE]6é3U£?²"ýÉÙ?ñÏæß?ýé½F"ýÃ7¿ÿ
uuBI
i&Rúlþ-)×è#?â¯ÿÂløÁït{êß¾²
«ø»GßûJýc³}Ñä7grjI~ÿùÛ.qK?þàw?ÿ?G?? QoùÞWtö?©?¾mÎÿ?0]Ãs]Òssxó
ßÖgù¶KhôÅE3??5Z&Òï~÷Ù³ 'ôS?í_ ?Þ
eUjWB'¥ÚÔõZ*R®ÑG$?¿þ?P?VzAéf½¹ÂlÎVDÚ`iL?Qþ?ßþÃßý`ù?>Ý? ûûú?ØÝ??ÿ?Íè
v9u5js5??Ôü]?????}ùÁ×*çÇJ?ÿøõÙ?üá?/?<;ûýÿý¯I??9{ã?Ï~E~«s½ñɧfÍfV»«
¬&Iÿät¯?ÕYõÊÇ:e©Ê¥4é?¹E?¯Q#Rõ?ýsý3~;/Ò_üöçÿç·ÚØÓî?·?P » íüó¿¹Ï~ls:
??
^¤fý3m_÷ɳi£^ä
ÿ/ê??ÿG}?r>ÒΨ¬ñ3oôô?>3?¾2ètk§÷õ!)Ý??ÎÒû´¿? ??"
j4/Òìù3W¡Z¤V]ÿí§zïS-º/?}ãÕ¿¾÷ÁÏþß7J?Z ?²HßøäóHufm??"Õ |M?ÿøCLb>ªÅÙ?Ú¤£©Hmû(iT£üûýâ~?HÕoü¿?±Ýï}Ezù?öùÅÿu"ý·¯~þ?Í?ó¾i/¿í
ö°"ÍíJ+~?+ü??ì^>Ë#«2w¶¶Duºo¹S¶¶x?Oåý?E[·oåEêv9MEêk4é =R5ª«ÔÝ?*í??H
üÞøç7>ùàgÿòS%ˤ&n RõÑ?T/B?~J?XI¿úPtÐÜý ÿËOé~0{:i¾F YQ½õ¨\¤*ɶQÍû3¼·Â6¤Ò?½ç ïúÞb'µ?HÍ®Æb½ß
²æµ?ÏÉlª>3-FB:åï}Å7ØV¼Z?ßûê?ý?çl?*ïÛ¡Hý.Ça'¥n@;?AÿF?ºÈæ~?ôÕÏ~?ô½÷Á
×úKÝn&R]\è?ϨÕû«@¤ üë{???oÈ?÷¤¹¥?Èýç¶AX*Ò°ëF5 ÿ'K7'R+?GaÎ?w"åÖo??o)R½£òÃû
º?ȧß7×?0¿þRH?]?þ÷¤Ùó cW£Ôõ?³Ms×êîKºTÍY%ËW_»f°¹Cåvn^¤:IgX? |ý«?lA
çgÜùW%ÒdﮫQþ?8?ÚödZ¤Z+ú÷ÌmVÛJÕbè÷½?º=Ê?»ùEPx¡¹ûV¤Þ|s× ?MÑöz©?ø>GÛ¦
fýº?Èv i?=®rßmºFëzw³ S/`$Ò?|sö§¿t"5½»?¹ ýý¿ü?J3 G¿Rw¯z3S ?Í`v¢?_?®¨µ
Ôu
:???UéÏI]òOÄþÆM{1)ÒïûÖ$ßqª_¹½ë¤ì?Óu ?
©?£?ÃÂ)G®ãÈ©ò³\Ç?}¤B?·ìY<'ÃçG-?ò?9+Óûök?G0F¤Á3¨cPW£uÏI8ù?Ò\¡?$?Ç&·Å?
#?| ïW rì9âÈ?ñÔUjjöC2GpL?çW ÄëÅ ¡H?=öoXêj´?#/Ò ÛdÛíj(æÈ?ÔÕè±??©«Ñb?¨¹?(5 ?Í]D©IAßâ@з4ðúàõ)Ò°"Í@O?êó?ôØçv¥¬F!Ò^?}ç3?´÷?Õ(DÚkòM[?´ÿ?Õ(DÚk Ri@¤â?H¥?éz¹¼?-?Aæõåm?Òjy2[ê#þæ^åvPFR¤ ¨Ñs|uRÎã®Ö|??>9ϲáãÛ?¥Ó«ËÕrº
ûö»?ÒgE'íj*?6?Þ]ù²EºY._ûÈ]ïN¯^»Z>½G ?/^÷¶?úóõªÍ¿Z?«ö?®ßOï¹ý(ý2Þ¼
vóâó«ç. sz5]©d*Fgò?Ç5ÛA9¦Jõ(??HT£6 }E?¼?j?Ö ïÎÖ|YF"¥?àZÿÍÍõîôÝsú4|ó
?.m¾¨?ºÆ.]þáUõÍh¿?úK¯¦¼_6ü¶ú³OUÒ_|véóYTÁÜÎ¥â8¿ßßo%è*µcÊEz¤ué´ÏêÄ ?
?uÇ»«5_V£?H?7K}½tUú?þSê¿ò¬¤Jm~º? W&?Ý®×KuÍTE«?Ù¥ÏWde.ô:¿Û TêL?ôH5êÒI}×çY?iêxw?²
Dzú?ɶ
¯»A?®JªÔæ7?Ê,?«?®×?×UéI?de?Ó?
?6C_wí?ï¢HX£>}6µ?ËE?:Þ]¥¬FHg'æ?ºæ?®u9 Þ?UziK?÷øQ?þPß\¸*õù?h?ÚüE?
oÊý÷??~sìuéÃÇÆHc?Ö ÏqÇj¾ê9é?oÛMåÆ4>TÛædEwüÔyüõ¸ÛÁæ7;<½gö?fn¿ÙrùâÕò
?7Ë?Ó+êR·ùÊÎneú(ÿÔíï¸cUÕ??ç¤G®Q?N?
w|^Ö /,èNÕü???uïÌ??É~?ð'ï û?t?ïhoº~ °x¹D¡ÀÛ?ô°5
v¤¬F1,°×įÛÀ°À¾SV£i¯y~?ÿ DÚwÊj"í5g?:?HûMYB¤½N*
8©8à¤Ò???N*´?¦ Ìê??ê¢?F1æòÕ wÍñ>¶¢ü8??@?¦Q?uåÐ
?< ?4ÒÕ<Ñ·éëüv ²sôdÒIQ£5ô©FÙIO?z?;é?f?Ç,õ§}X3
¤n{Í~ÉãZ®ÝÉÖ<¿®®?ÆQ?5å¬)zkjFÉ®?%
¦#ré?~}vbFÁí=YᤨѦ,¥K5Ê"MuÜòÓ¡t?Ù_ù( è·óu¡]?ûxÐüöTã?.>k mX8
.çS;-Õ¥ÏE!^~µ|ÄVÄçTÅ?®|öü?¿LU^o1>?ÕD1?ѹßJM9ú ¦vXû;~ÉUÊë??bSx?ªî=Y
qO?S£,Ò?÷t?°?Màëß }ÈÑ~ U诫æOº>1y9 4Þ??b4ßJ_ñíõ3\Ç?~G¿¹çÎ+&Ü0?l?Ï#
¬?§Atã*wîA¼ªbäèK÷=??Ùk?=á%7?x®·TQ1Uºkôd??¢FÅÔ¨)Å!h³?«Ô¬»h??¯2÷?
?-Ti"?ñá½Í?Ù9ªÒ ?Ð^?èªÔ®GUZ|_Èfi?9ZQ?_ e9ú?£&y8x¢ ¿ÝïªT}¬Ó{? «tWÒN??S£V¤k:µ?t
?r´_M?ºxЪ*
¿Ä?÷ ?ùü ?/U¥º½T)¯×WéKݶóÑ?'å7WÁÁԵѦåØ?=ßµ?w/tRéõýª4í¤¨Q95j{wõ?B#Gù
Ñßlõô^þ:?Uj·»FÉ%]³¦. 4Þ??b\½¼\ýQ?m«&:®û?^äÏÖKGæ<ü?×çú4|CçúõÒ¿áÊ ?jË
?å¬íÍÌé?Ùê²Ë
Ý?øuw® ÈIQ£?jÔ??îÙ?Ñ¿8wÝ+íùÊʧ+óâ©|4¢Ý 6 ¸[âAãíé(ÆwÏéçË??ëþ?¯\ÿßZ
?º
Q?| ?ºÓYçO²èDÅÈÑî{4+ÇuPúÚ ,/?õÕ2¿]ûÝ Á(I'E
ªÑ#fØ%?±¦¿| Úz;G7ÞòQÑ»{? FÛ£ªw÷¶Øìt?Ùm¯ÖùËòÑËÙ??ÞÝÛ5Ú* qRÐ ÝpRÐ ]pRÐ* pRÐ
*pRqÀI¥'?TpRqÀI¥'?ô¨æ?-÷/?[LYNJ|D¿5?F?©îÚ? xhÒN?Ý¥FI
?²½HGu"pR Ðàùr]T` ??Bxtà¡I;)jtû]ÌGáê`¾?Ï?Lé?ù?ddvç E>Û@-&¶ú¤s?²ýc·éìgµ×¢ÖI
MÄÎÔGÝÙ(<»äè?ÈÑzqþx¶J7Hj³ÌíTE¿¢;6éAÚIQ£ÛÖh$Q-RòÊÉj0VZZ?2»àMf?Ñ?Q¶µ
Fû?s*'åm´?Û:È?£î8
?.ú£yÉ|þÂl?|ÝÝØkïVE¯¢;&Òz'E6Ñ?2£*2Ç?vH»°?¬72Í0ù©±Rû?sªâx?uP
ú<?7¹'ÕÃ?/}ô Gáñ2?þssmåóg«4
xh*?5ºu?L?lFÝpe%Næc# %§Ì.JD?˦Vl?öSN¤f?ÝÉdj|O?å£îV~GÿùËQ.q¶ÊÚ*? xhj?5Z²^U£¹?#j¢*é,Hsº ; ê?Ý?4ÊF[ ý??·ÑNÁÖ?÷¤Áü <k¤?=?£ÿ¢*óf«´7Ú®['ñ_¨oÑ kîÖÜ?¢FMÞÝjÔv
©Sg¢[¦¶:ñ G^¤ùlÓ?ñ'ι° Gã¤üÙw U8éÆô"¸¨»ÍÒóÑÒFÿqT ?Ö?ódzUê'Qc¦ÏÑ
iÚIQ£{×hÅ?í?½4¥ÂIëh/ú¯YÑ?&í¤u Fk9?H+?´?M[ÑuH?<4i'5ÚQöpRÐMvwRÐMvw
RÐQvvRÐQà¤â??JN*8ióCÑ,ó vN*8iµ(Ò^;i1Ϥ:Ãi0¤?92c#Ý?¶G#4{
?ôÐ?0 @+aô?ÞJ¡-J?£e8??Ò[?Wö¡o?lXÍWÄ%D:Ñ¡
®L ;96?°&{þ»EÒI;R£½Ç?4?ýLàJ>zE4Njï?çû 0í¤æ9ñ?ooG!äÆS?«U8kÄ£ ÍÕ
L_Æh7ªÇðr"¥Á?óíÂz;NÒI;Q£?4nÌ*ý¢??XhÍMtlaFòÑ+f+7wç??úîÙPK;éé;4æñá
½\? Å2¥f¡ähÄö¢ Böê?LvA|.%ËlâÄÅ X'-)2?!é¤ ¨Ñ¬¥¦Qé ´DR¤c¿?EºX?&É???vÒÓ?ÿþØ?6Q~ -???ÒE#¶X©ýÃäD??
ê?þ~ú2??{R?ô9éá?s ?¤?v FÛjÙw øw ?(¾<ì Ø?«¸æ.?ÔE¯è`+RõýÆìÝ >^]^¿ïc\ RjJ?Fl3Z1?æÛF¤ê£»??ûÑ;"Ò¤? ¿FÛj¹w!èÛ?ý*6p» óRî8b?r?ٺРG?Ü^Ç«èÝ}
ø÷ÓÙ?Q=VTiÉì?-G+æZG¶NÇ:üÇÕé8?¢ÿZúµæ2?ñß0ãLÂE?îÝ=z¶Ö4Y9è6æKóáEº
óý[»UÏI¯ÿö?iüQ~ÔXJÍBi£ÛVð«? Ä ^eS2×:òVì_Êf.Ò¤?v¡F[j???î?tÒJG??®Ot¸¬?ò³?ä,?<»dÛÑ??T+¬ËXïH;i'j´¦?{
?¾ýs"]º?D??6a7?*8H´b?HÛ¹?õ?´?6á?ktǦ?}×¹ýó"µ{J?BT8i-ùøúhÄ[?V¼ë¤´?
ÔèîM#i·-?=tý?ôØìÞ4?+Ò}?t?=?t8©8úí¤ ?T pRiÀIÅ'??T pRiT8©~åqý{M1
?eÇH;)jTNb~R
æ'mjô T8)f³Äü¤¨Ñ.ÐÀI1?%æ'E ?*'Ål???T??=.uN?Ù,KÖ»]¥5N?-Yï_b~RÌO?MüuA??
n0?%æ'Ev?
'³Yv?´?Öí&NZóYv?´?Ö?í({8)è&»;)è&»;)è(;;)è(ýuÒ¹åØçÑ9à¤Òè¯?Îs à??J
£ÇN?[?T»8éêXïý _7 ?¦??J£ÒIÍhã?ÞGãÈG÷ë?ýö&ßã?&??Jc'%?Ó?£gßÉGá¥Ã4·O§ik?´8©4*?tc£ùV :
ag±|r>¼Y?Rtß·?»éÈöëϯhÔÙÌ®s~ ¬Åé?Äå¢M¡ Ü
Î?B?!ÒpRiT;©6L?ê³³X*?®§ÖIgOM±ÎHÍ_ h×9?;£¶Í<týut G:'µ"¥ C=KæM®A
?&??J£ºwWk?£ íÜ[J¤×çz??îó"¢9$R ýgÒ]t GÆa¼o*Ã6òTg?æn-pRiÔ;©?êó"UbÑ/ËxiÞîdEG#&Dê±"
£W¡?FD?i8©4êÔEõ±èÜ?Ý7»4?¸S4¢nîÚu'R¥^ÊÈé?ÎÑ Èéñ=é: ?&??J£Á=©
ês³X?7S ݧ6¼x}y¹V?t³Ô®»üÔ µ/à tìU>:?£9½Õ?ë:?HÀI¥Qí¤¹Ñ~[é?6N*´
??ÁuyBQ?4?TÕNÚe ÒpRiTß?v?ª%??J£¿N
ÀI¥Ñ_' à¤Ò???N*
8©8à¤Ò???£ÂI7Ëåw ûüjÙa~ÔV÷ï pRq¤ÔÅíK*¸%¶? ? F?ï³×???#í¤<??#xí| 4¸S¿'Jw%º?e!ÌøyBÍv9 ?ãæ?mm~ÔüÀQw^¼©ì×Õ7¾¸>Ï?
?¾Wg???£â?Ô¼£ÞÏ/Ìj'HÊ¥[(Ê?P\?Ç)q¬o÷>åç)åùO[? 5 ÝÍNjö#?ÝúúÄNÀfÊ÷åÁ
IÁíPÝ»;»æ÷äù@Õ¯?Bât?M¢&7µaüc6ó?ºíñü¦G ·>?jp Yæ.q¤2¯Ým¹)?7ßi??£ºwW 2?ßÓ?h6¥´bº];1Ii??yBkEj#?Û? ??DE*ózA¤'Ñþ]N*?¤?ê ;)ÉÍïÉ">Öú(¤Û?$3ºæ å?_??'?·»ÈáØIM?²½ùQãæ.G.?ï
É?û)LúÆ¿?À?Wø^ÝN*?¤?êÀ]º³¼Á<¢3m&Åtµ_^úf§?øõ9ôª{Ñ?éh*?cç?mo~ÔX¤+Ûqeö
/D*»ý6ùyT]zá{u8©8ªïIw¥<´?i6OhÝü§·7?j¿???£ú?t'jf.m8OhÝü§·6?jß???ã0N
??T pRpTà¤â??JN*8©4à¤â??JN*8©4à¤â??JN*8©4à¤â??JN*8©4à¤â??JN*
8©4à¤â??JN*8©4à¤â??JN*8©4à¤â??JN*8©4à¤â??JN*8©4à¤â??JN*8©4à¤â?
?JN*8©4à¤â??JN*8©4à¤â??JN*8©4à¤â??JN*8©4à¤â??JN*8©4à¤â??JN*8
©4à¤â??JN*8©4à¤â??JN*?:éj¹¼h¡?í?] å° N*?m?tü³å²?Nß=ÏÖÓ,Û¼8Ï?_=ë
år9Ý~¯ÄyÍv(ë¨ÀIű??6s*ʵ¢?×ù_ÿuJ¤ïµ?¾:ÉôÅ!Ib¿ÔyÍz&R8©8ÒNªZ«Ô\U¾t©®ÞAµH
ÉaÖ:e³\¾ö?˯V/g˧÷²'çÃ?¥©Úõé·8ÿõçWKåZ¼ÿéÕkW?ýôj© Ð?kàtW¾=?KÏ?7OCÙD¥¾Á?
R í?cÏ?ó¹ï5û+}~î{qy]N*?¤?¨~³ ë?'?w?T???ÖÖ>¿ú?_d«©ézjtF¿mÎOÍßÓß
ÜsëÔ,Ö%Z?ãt?IÏÏúÂçg?Òa©ÜáMÔ¾Vç>SIÃo«cO³¤?òyq>>í«ÏÏ~/.¯«ÀIÅ?tR2?%9©ÃG
¹H?_R6??öäüú|e?ö"̯?¢V?Hß±»äEJÅ?òLº? s¼XlÃ7?aí(³ôN9|l?h ©=/ÎÇÇq
ó½\y]N*?¤?ó$fSû¹\¤Äê"ÈïDª~îºýûRk?ókÁ×?ÔcEz$B'xr?Û?E¥Dl?ÂU÷¤³©ÏgÓ7?
ÂIÅ?¾'Ý°
Û;°H¤t?iEG
rùB\÷?2TíH6ÿFýðus×®;?Ò}ãS?î°é\> Óã{Òµ5`·®Ý~J
?Ó«i° c÷·çåòñq"?ry;ÿÅ
?T éÞ]ÝÞ4 H?àæ§k?*?|ñúò?úW?F+Áö©âÆ<?¡Î'ο~ñj©?¥v]-NVº«feÊár «\ùîx? ?´Ðu
´1ç3S?}e{ r;?ýÝyq>{ µ:¥ósß?Ëë*pRq¤toÔÏû¤>×èÛC?v??c?ç¤ ËÀIÅq@'GN*8©
4à¤â??JN*8©4à¤â??JN*?
'=}'7ðô8©8*?ôô???ñ¥?ÏôÇ[·z
Ù´3hþèñ§pRqT8éê¤á¨?òøÒ½ã3Sq¤»¾yËK?ÛRøÙ±?RÀIÅ?vR¾ÿ¤&¾´ÀÎñ?Q¼(Ç?ºrxì°Y
åxÔx8áFäãVMy¼ ÞèàÕà ?¸×{öxñv.¯ð}ìÒm¿_????m 8©8ª?ôòI ÚøÒ?]ã3£xQw\ ×Æ£RôJn`þ?Æq«±?æÒ÷ê?oçò
ßÇ.Ýñ¢ïå/ÆŶ?T ÷¤³?HkãKcvÏ?âEÝq]<h,RE£¯á?Äq«?æ®ZæzÆ6ΰ] 몤¼øûð²p<»s?¿Û2pRq$Ô
D}ø im|iÌ>ñ?A¼( 7('-ÒPTqÜjA¤jÜí©?{
âbO"£-ÿ>¼, Ï~¿(1.¶eà¤â¨rÒiþ7\_êØ3>3?µÇõñ å"¥íÃ?Ðù¬Ð]|*Ç?ºxÒë×s'nã^Ý÷?
¶Ûò
ßÇÅÓòñ"?Æù q±-'GÅ=é?ó?HëâK??{ÅgÆñ¢|\[N|\JíÈ?¡?¾ro 3 J«(5 úíâ^ý÷Ìoçò
¢ïã?v{áûÅù q±-'G??>y¿ëo
)0??»?ÔÕXEF[»+/???£ÂIûÆ&÷ÄhS÷þüºwh¯ _Y^íñn 8©8*?ô8©89)ÐÀIÅ'??T
pRiÀIÅ'??T pRiÀIÅÑØI?q?«åÉL?»q¾:À?vÇg?óhûðýN*?æN???<½º\)!?'ÿx¢ß4>Ó
?ÇN*?´?º¸GïÉq?ôØ> Îvz5]QTÚ;Ùæ?Æ®º8Ñ
^©?÷l->Ó?ÇN*?¤?º¸G?÷ä8ÉÍe>zcøæ9?Q?~4ü÷Ç:¤ÅÆQr¾ºx϶â3íyÜyà¤âH:)Ç=ºP2ÝA
A'f~Á<ÃÇ«Ëk=Úwå?St¾ºx϶â3N*?¤?º8Î?"Í þýtöO´±B¤%ñ?Æg8©@Ò÷¤ ÷Èñ?á$Àe?Ú
×{Ï4g9_M¼gkñ?À'Gºw×ÅU?xO??^c??î]76 SÏOzÅ/þª?÷l+>à¤âH;é!Ø&Þ³+ñ?}N*?æÏI÷f»xÏÎÄgö
8©8n×IÁá??ãÜ
pRqÀI¥'?TpRqÀI¥'?TpRq4vÒíçÝ Þðäaå3?î[~ÍK9ëæmZ;oéÆ~½?¦µKÌaÞ%
nÓ×ùíz®·ªó°¿m??£¹?n?ï¦ ØgÂT?LغüÓ?yk?Ù8þ´¦?õ¥?%?Ư?¥¼ ¥_úõÙ? ä?<Í
N"???#í¤MãI-.nÔ³Ñ?abɦíÍëiqó§n?¹ý ÕóºøÓ0þ?½º¾² ?.0s@Âä%??×)eæu?Àq
°vøï·-pRq$´q<)cãFÖnD<¹Q[q£þ?ÆIÝùØý 5óºøS» ??µY9?7ÐâûÈ/¹¹ËëzF9?Àë
AX9?H×;½N*?¤?6'u6Ùh?:Ãe!tÿ¸QóK÷ç ¼f¾Q?Mäó±ÇõQ??LTe&{?Eª?> Ö? _<,??éÎ7íIDAT´mà¤âH:éÖñ¤I?þÐÌØÝzÜhH«çuû©ãä?Û¨ ;M9ß??÷£ôÇK¯ F¤pRq¤
ïI·'iëq£Ö®Üùį?oÔÄ¿ªãó 6+gm/8§fh?Ô§I"y]ç?ëÑ ?»»'GºwwËxR7³1ýBÇêG;'Qó4?f¾Q?ÛÃÇmX?><ϳz?å?Áúj?ßî:¾ü?´"R8©8Ò
Nz[Ü^Üh[ÍËÃ4SÛN*?æÏIÄÅÖÍGzÛå
8©8?ï¤ ]à¤â8º???iî¤ã¹bD?æóA+Çn« N*ÆNº?ÆiÇ?J£©?´¢ÆÚK!®N'?FS' Í'´?
P{W?t¢\U'-l+x1_¨ Þ\W¯¸?.??±[{?÷»'?FC' !H\¦õ;áfðµ?'&Ï(¿}¤¸TÎØì5
?÷;s0'Ý!>´AC'UZò+JSz]ÿCÿMÈJ¤ã?µÂ±I^d.c>?>h??ì®Ñþ`w8)T- ø?fûøSÐÍÔ¯
(q
|7?6C´??Éc?®>c¡µkÅ>Ö?ÆÑþ`g*?ÔÄWò°7^?ÆS[Æ??ÑÜIsÍÝÉ??©¦ñZéĶ?}FNñ Ø?¹
?¶BÚI9¾2vÒ?xJbëøSp?öîÚ?£iJ?tdÒF?Z »?.Å?? ?´?r|e¡¹?Ëä¸Êmç3¢iïî$
ÿfL«JkF?£?HöêØet)îCxOZ"r°#Õ÷¤«'MÄen
CS'3p§½ç,?,hç:uGÁ«_×» ?¶BÚI9??>èà,^&â2·??¡©??.ìã? %?4WG??3úþPxN
?¶AÚI7.|2Z?Çen=?)8ô??ÞÝ$Ý?§¼ë4wRÐ<'èz<å]N*?]?t8©8¶wRÐmà¤â??JN*8©4à¤â??J£±?NÌ0?ù
¢,ä{±[øbק¢úxͺã©eãÞÍÁI¥ÑØIyôФD¤£ _Õ°«Hõñ? t×S£=wÜñØìä¤;Î?y°r@@S'?î
rw)ÒÔ?í<»9i[Ãü0\°}?:é?£Òô?ym¨.DT§ë\Á+P~aGê3ùO¶ÀâNîå+A?úxö v;ÕÜ??ÏÃ?
Ý©Üðà Æ8±£ ¯nQ&Î×KÒNÎÊÓ?ÑP#æ÷K/.7¿hjþQ?SaM%Dó?Få??hê¤æµ ^¤¤~J(R?uoU)¾5%ÎdÞ¤BwrÃó}é?P¤¼Ý¾?%*xáO;
bn Ò ®ìÕ-WF.νOT8©?·ÓÅ?Úy;iÖ±\3?çMÌ?ê¢`¢yD å?vhè¤ckPöÍDþW<1?²mJý
?IøV??·¦øLþ)ì§e;9µ¸7µ¸ænør??ò>u~¾`ý?OmlEIÇÛÃ?½ºe ?Í8ë#÷¤f?®??Ó?ש<ÿ&
Áó?¦æ }xos¡?µñ??r@;4tÒ}! )ǯè&b Rÿë¶oU)´v?L>ðeî´?Ûi`Í?Õ2æö®©Û®?Çõ?#:>?;µE²(?_JZpnÒ&ÁËûG??1q?¨·³ .;¿hrþÑ'ï?~òù;émÑÐIKEêÞ???Z¦¹·ªß?â3Å"-ìä_¾???HÝö?HýyØS?Ðë$²ùdÀß :w"
&mb¶?"uR?åy;uów 6wM`xrþÑÕËËÕ §?yD å?vhì¤QswÌÉ9»r6poUq?Ü?r' ëíÑNáËW?Í
Hívi?tR%Î?º -(A îÎ9©?·?ãDyÞNjÿ~'¸?´ó?&ç =}÷\»l<h\h?]ïI¦Æ¬ßµcîÝ[U
\&?;¼'Í?´¸?{ù
áßÔ22 Qº¿Èl/?Ôß?rßð|¤ïXGæ-M$ϲW·ÌR?Þ?6äöæMئw7vÒÜ+RôÚõ?Ú?ÅQ®ä?Û¾ÛØ
IËóùÍúxî Û»?Ô ?µ¶°?öú¸¶´?Ý? IíÝmÆÍ/
?±ÍsÒBs?ß?2ö"¥ç¹·ªß?â3E"-Ûɽ|%ܬ7?ó?ÕIYs× Â?±ç1wy?4n?¯n?ü?ô?¦N:i4þ
¦Ñ¢Gì6gÏCXÍÞ©G »4uÒq#_é¿HG® |·Æî?ÓÔIÕï¾A7JÿE?±Fǽ}o!?TMô8©4;)è pRiÀIÅѺ?b^Ò#'G'Ýr~RÌKz\à¤â¨
pÒ?ó?b^Òn'GÚIÎO?yI;?T i'm8?)æ%ípRqTß?6??ó?v8©8ÒNÚt~RÌKÚ-à¤âH;iÓùI1/i·???£¢w7 æ'í2pRq4xNùI»
?T »8)è2pRqlï¤ ÛÀIÅ'??T pRiÀIÅ'??T pRiÀIÅÑØI?q¢«åÉ?^?ÍKp\à¤âh8ÑÓ«
Ë ??à¸ÀIÅ?vÒ¦q¢§WÓÕ?s¿ÇN*?¤?6? ¾yNÓ?º%8.pRq$q¢=N*?¤?"N´§ÀIÅ?¾'E?h??
?#Ý»?8Ñ~'GÚIA???£ùsRÐà¤â??JN*8©4à¤â??JN*8©4à¤â??JN*8©4à¤âhì¤?'
í pRq4wRÄ?ö8©8ÒN?xÒ~'GÒIOÚSà¤âH:)âI{
?T I'E<iO??#}O?xÒ~'Gºwñ¤ýN*?´??~'Góç¤ ÀIÅ'??T pRiÀIÅ'??T pRi
ÀIÅ'??T pÒzf½
À???£±?&ãIi°Ãwº?)}þu¬÷ ¼1¼¹¨ÏÔpRq4wÒT<)ù̺ áÃÃ?ФοļÞs?Õm£???#í¤M
ãI¹1Èù7ËË?Ê öº\QJ?îö;½Z¾x^å`ÊÓ£
ÇÞè±?¼?pm²çÊÙ¨B?ÇJÇѧ¢ò¿ö?[ºí|þ¼?ß}ßáMøõXܵÇY??ýùºãÐûå-?N*?¤?6?'
¥ ¥ZuùÕ¯X)sªó**¤[?o?ÓË ?ò"'¥Áü?ÆÛy?TN¶!!üæ^6ü¶
`gç%oçóçý£üþ<#?oL({Íq\tû>æ8ô=oµ¹ 'GÒI·?']¸üVIFµÊ? é
7 Ë??»j=<?i¾ GGë¨<ð?èp¼äíñþQ~?TÎiýq ÞÛ\¨??ÿ>æ8úßÓWÈÞÀIÅ?tÒâI? 9¿ÑlJiÅt»v?EåÅ"U9TRH)tNm$Çr÷ìô´´Ûãýãüþ<#XouÇyòþã'?¿s|?ÂIÅ?¾'mOª´ôËä
üNDÃÇúw]H·[?ÑoÂòÈvsNvýúeæ·?ë^?9©i*Sy§WS??ÇK»½ Ò8¿;Ϩ¹»æ?½?ã¬^^®þ8
¾?N; k
??#Ý»Û0?Tg£»6?_/ÌöÙ?ËK7Pûòå¥ovRB¾µi$ËÛmGS¡?ëW¦'Gà?WjÃ&8mZÚí|þnÿ8¿û¾?H
Ù7ë?súî¹¹`?óuÇ¡ïù[¼)???#í¤·Aõ0UåVæºæM.uÛë±"íÉcà¤âhþ?´u6ö?G??cjJ©ÝÞ?¶
Ê98pRq ×IAûÀIÅqD'N*8©4à¤â??JN*8©4à¤â??JN*?ÆN?ùI{?T Íó?ö8©8ÒN?
ùIû ?T I'Åü¤=N*?¤?b~Ò?'GÒI1?iO??#}O?ùIû ?T éÞ]ÌOÚOà¤âH;)è'pRq4N
ú?T pRiÀIÅ'??T pRiÀIÅ'??T pRiÀIÅ'??T ônÇ?æ??<óù Ya:ã?þ?/J3Ð6óO
qSb?T Íô.Ç?Næóz?n%ÒÑ<-R½mT^Z½Há¤âH;)âI=£ù?´5i³ÄC?N*?¤?"?4@?Ôè?LU??¬u
~0NJkãLç^ÌYQ^??ù?2?´1çòP?¹Ú?ém&'?ööÈ?+=N*?¤?"?4`áÚº ÝîX)å>tƦ]<à?
Ö|'¤D«ºI(Ò ][?"å$sOL*]èU?'GÒIOÂÒ?Ðè ýablÍ?n5µ??Õª±É±J ÏMÊ8¼'
òd¦ QØÜuIö*0&?Nª[¼pRq¤ïIO21?g m®?µvI{cÓÔµj²â%?6óeÅ GæÆÜÞõ÷¤&É??é]
Lû7 ?T éÞ]Ä?FPûÓvó*M¸%ê>????H??ù`2Ïæ?·?KD:â&)']ÏòÂZz8©8ÒN
²³I`cî#°·¦T?s4ÊF£?iÄ??t`¤ ?Ô%?N:?T? ???£ùsÒ»?¾%??[Q úo¬Õè>?÷¤£BS
vN½=Joó?E:?òX}?l_²Ío?æ?Tßq'?´ ×
õî??V¿®w7'Ò?ÝÊÏj¨?q줮WoÓ?i?ìF÷¦â\á¤â??6bà ?,øÃhn aò?ÂsÒP¤ÚpÇ?Å<«Ç÷
úêØlÓÿ¸$}ü?´zD?T pRiÀIÅ'??T pRiÀIÅ'??T pRiÀIÅ'??T pRiÀIÅ'??T
pRiÀIÅ'??T pRiÀIÅ'??T pRiÀIÅ'??T pRiÀIÅ'??T âÔ¾9¬n"9ÀIÅ!ÞIï?H
á¤â??JN*?:éÊNøtëÌ ï?Há¤âØÆI×úÇ?[6??ôôÝól=ͲM~ªµõÁg^[ç^Þ}çD
'Ç.N:k$RÊEÓRèy)®S"}???mËt?Äf}?E
'GÚIíü¤Ê?.uÃÕ;¨)Íü½Ö)?åòµü|¦?åå?¦§xr>¼Y?ª]?~?ó_~µ¤YíúéÕkzÞS={??Î?Ë
5pº?/Õ Ï¥gÃ?pºÔx²ã;'R8©8?Nêæ'Õ?¨§X??"u8ÑÚúÂçWjºÈVS%ÒõÔ:é?TÄù©ùK?ò:5?u?
Ö9ÝaÒsç³¾ðùY¤tX*wx?kPß9?ÂIÅ?tR??T«Ã4QËEJ;©l.?+ìÉùõùÊ8íE?_ÏÖ6ó³´Ñ\?«¢Hõ
|Qº<?îÏçÆÎ4?oîßT?mä©Lö7wá¤âH:)ÏOJª±?ËEJ¬.?üN¤J,ºýûRk*?:±H=V¤'AÒ*tÒ?:
5ØÿÎ?N*?ô=)ÏO?
Û¾?H¤t?iEG
rùB\÷?2TÝܵù7J`º¹k×HUA??Ó 6Ëçãqz|Oº¶l¹s"???#Ý»ëæ'Íf$ n~ºf¨òɯ//õô¥F+Áö©âÆ<?YÛyM)ÿúÅ«¥n?Úuµ8Ñó?R??Êár «\ùîx? ?4ê:ºs"???#í¤{3
[.Oês ?»-R8©8vyNÚ+î?Há¤â8 ?v?;'R8©8à¤Ò???C¼?Þ9à¤â8Ëó"í;e5
?ö?³ç!Ï ÒÞSV£i¯Ñ7-?´ÿ?Õ(DÚk Ri@¤â?H¥??"?D*ÝEo?HEPV£i¯1O»?çÏ!R ?Õ(DÚkLãÈÖ(D*?²?H{½?15
?
¬F!Ò^ÃÝÏÑq$?²?H{
zw¥Þ]q@¤Ò?HÅ?J"?R³@¤½§¬F!Ò^ó "í;e5Ù+è;F¤@©8 RiH?Q<@
ãA¡
èÿ Ò'¨)
o3IEND®B`?
[ reply ]