DOC PREVIEW
SJSU CS 265 - SSH

This preview shows page 1-2-3-4-5 out of 16 pages.

Save
View full document
View full document
Premium Document
Do you want full access? Go Premium and unlock all 16 pages.
Access to all documents
Download any document
Ad free experience
View full document
Premium Document
Do you want full access? Go Premium and unlock all 16 pages.
Access to all documents
Download any document
Ad free experience
View full document
Premium Document
Do you want full access? Go Premium and unlock all 16 pages.
Access to all documents
Download any document
Ad free experience
View full document
Premium Document
Do you want full access? Go Premium and unlock all 16 pages.
Access to all documents
Download any document
Ad free experience
View full document
Premium Document
Do you want full access? Go Premium and unlock all 16 pages.
Access to all documents
Download any document
Ad free experience
Premium Document
Do you want full access? Go Premium and unlock all 16 pages.
Access to all documents
Download any document
Ad free experience

Unformatted text preview:

Secure Shell – SSHOverviewHistory and BackgroundSSH-1 vs. SSH-2How SSH WorksSSH-2 ProtocolSSH2’s “Secure” ChannelIdentifying Password TransfersIs this Useful?Keystroke TimingSlide 11Keystroke Pair ProbabilitiesHidden Markov ModelDoes It WorkSlide 15Slide 16Secure Shell – SSHTam NgoSteve Lickingcs265OverviewIntroductionBrief History and Background of SSHDifferences between SSH-1 and SSH-2Brief Overview of how SSH worksAttack on SSHKey-Stroke Timing AttackConclusionHistory and BackgroundPassword-sniffing attackSSH-1 was developed, Finland, 1995SSH Communications Security Ltd. Replacement for telnet and r-commandsVersion 2, SSH-2 released in 1998SSH-1 vs. SSH-2All in one protocolCRC-32 integrity checkOne session per connectionNo password changeNo public-key certificate authenticationSeparate protocolsStrong integrity checkMultiple sessions per connectionPassword changeprovide public-key certificate authenticationHow SSH Works(1) Client contacts server(2) If SSH protocol versions do not agree, no connection(3) Server identifies itself. Server sends host key, server key, check bytes, list of methods. Client looks in its DB for hosts.(4) Client sends a secret key, encrypted using server’s public keyBoth begins encryption. Server authentication is completedClient authentication on the server side. Example, password and public-key authenticationSSH-2 ProtocolSSH2’s “Secure” ChannelWhat SSH does:Packets are padded up to the first 8 byte multipleInput is sent as each key-down is readNot all input is echoed by the serverWhat it means:Data size can be estimatedKeystroke timing is feasiblePassword sessions are identifiableIdentifying Password TransfersDoesn’t SSH transfer passwords all at once? Yes, but…Only when logging into the serverNot when running any applications (e.g. su)Not when chaining loginsIs this Useful?Everything is encrypted, more information is required than just a passwordWhat good is a password if you don’t know the host/user/application it is forAttackers can sniff traffic to determine the host it is destined forWith access to the ps command attackers can narrow it down to a user running a specific applicationKeystroke Timing Various key pairs have different delaysKeystroke TimingKeystroke Pair ProbabilitiesHidden Markov ModelState machineThe current state cannot be observed, only the outputTransition to next state depends only on current stateThe likely state path can be deduced from observed outputLet each state be a key pair and the output be the delay between the two key pressesDoes It WorkThe HMM can be solved using known algorithms to find a likely solutionThe large amount of guesswork involved means the most likely solution isn’t always the correct oneInstead look at the n most likely solutionsDoes It WorkGiven a subset of all possible 8 character random passwordsThis method can reduce work by a factor of 50Translates to roughly 1 bit per character enteredDoes It WorkCan timing information be collected?YesAre the timing metrics useful if the user creating them isn’t pre-tested?YesIs it feasible to use a HMM to crack passwords?Depends on who you


View Full Document

SJSU CS 265 - SSH

Documents in this Course
Stem

Stem

9 pages

WinZip

WinZip

6 pages

Rsync

Rsync

7 pages

Hunter

Hunter

11 pages

RSA

RSA

7 pages

Akenti

Akenti

17 pages

Blunders

Blunders

51 pages

Captcha

Captcha

6 pages

Radius

Radius

8 pages

Firewall

Firewall

10 pages

SAP

SAP

6 pages

SECURITY

SECURITY

19 pages

Rsync

Rsync

18 pages

MDSD

MDSD

9 pages

honeypots

honeypots

15 pages

VPN

VPN

6 pages

Wang

Wang

18 pages

TKIP

TKIP

6 pages

ESP

ESP

6 pages

Dai

Dai

5 pages

Load more
Download SSH
Our administrator received your request to download this document. We will send you the file to your email shortly.
Loading Unlocking...
Login

Join to view SSH and access 3M+ class-specific study document.

or
We will never post anything without your permission.
Don't have an account?
Sign Up

Join to view SSH 2 2 and access 3M+ class-specific study document.

or

By creating an account you agree to our Privacy Policy and Terms Of Use

Already a member?