As you can see, we raised the INFOCon level
to yellow. The main idea behind INFOCon is to protect the Internet
infrastructure at large, and the development on automated scripts exploiting key
based SSH authentication looks like a real threat to SSH servers around the
world (any SSH server using public keys that were generated on a vulnerable
Debian machine – meaning – the keys had to be generated on a Debian machine
between September 2006 and 13th of May 2008).
Note: 'Debian' in the above
paragraph refers to any Debian-based Linux distribution including
Ubuntu.
Scripts that allow brute forcing of
vulnerable keys (see this as rainbow tables for SSH keys) are in the wild so we
would like to remind all of you to regenerate SSH keys
ASAP.
Please keep in mind that SSL certificates
should be regenerated as well. This can be even more problematic if you had your
certificates signed since you'll have to go through this process again (and
possibly pay money again).
Update 2310
UTC: The new Debian package for SSH (ssh_4.3p2-9etch1) also applies a
package called "openssh-blacklist". After this update, your SSH server will
refuse keys from the compromised set. The package also installs a new tool
called "ssh-vulnkey" that can help in hunting down key files that contain weak
keys. Note that in combination with the existing ssh-keyscan, ssh-vulnkey can
be used to easily identify servers that use weak host keys, so while these
Debian patches help those who patch, they also make attacks easier against those
who did not yet patch.
More
information is available in our previous diaries:
http://isc.sans.org/diary.html?storyid=4420
http://isc.sans.org/diary.html?storyid=4414
RSS Feed