Re: pam_captcha username harvest vulnerability

[Jordan Sissel <jls () semicomplete com>]

On Tue, Jul 6, 2010 at 11:04 AM, Ian Maguire <imaguire () superb net> wrote:
> pam_captcha is visual text-based CAPTCHA challenge module for PAM that uses
> figlet to generate the CAPTCHAs.
>
> Project site:
> http://www.semicomplete.com/projects/pam_captcha/
>
> A site with a screen shot:
> http://www.michaelboman.org/how-to/securing-ssh-access-with-pam-captcha
>
> I found a security problem with the pam_captcha. If you enter a username
> that is not a valid user followed by the correct CAPTCHA, you do not get
> prompted for a password. You simply get prompted for another CAPTCHA.
> However, if you enter a username that is a valid user followed by the
> correct CAPTCHA, you will get prompted for a password. This means an
> attacker, or a script/bot could easily harvest a list of valid usernames
> simply by whether or not it prompts for a password after a valid captcha
> entry. I have duplicated this behavior in FreeBSD 8.0 which uses BSD's
> OpenPAM. From what I have seen this module is not compatible with Linux-PAM.
>
> I don't know enough C Fu to propose a patch. Until it is patched the
> solution is to disable pam_captcha in your pam config file. The creator of
> this module seems to think that using this module isn't really even
> necessary.
>
> http://www.semicomplete.com/blog/geekery/pam_captcha_research.html
>
>
> - ian

I can't reproduce the behavior you describe on FreeBSD 8.0 nor on
Ubuntu 9.10. It seems more likely that what you experience is actually
misconfigured sshd/pam.

With pam_captcha 1.3 on a fresh FreeBSD 8.0-RELEASE and this
/etc/pam.d/sshd config:
auth    sufficient  pam_opie.so   no_warn no_fake_prompts
auth    requisite pam_opieaccess.so no_warn allow_local
auth requisite pam_captcha.so randomstring
#auth   sufficient  pam_krb5.so   no_warn try_first_pass
#auth   sufficient  pam_ssh.so    no_warn try_first_pass
auth    required  pam_unix.so   no_warn try_first_pass

My sshd_config has this:
ChallengeResponseAuthentication yes
PasswordAuthentication no
UsePAM yes

What I see: Successful pass of the captcha with an invalid username
results in being given another captcha or an abort (if this is
multiple failures) and PAM logs the fact that there was a failure due
to invalid user.

For example, if you don't disable "PasswordAuthentication" then pam
failures could (captcha or other failures) will give up after a few
tries and move on to Password auth (no captcha) auth instead.

Are you sure this isn't something misconfigured on your side? Can you
publish your sshd_config and pam configs?

-Jordan