Bugtraq mailing list archives
Re: [Full-disclosure] PuTTY private key passphrase stealing attack
From: halfdog <me () halfdog net>
Date: Tue, 01 Jun 2010 06:26:11 +0000
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Jan Schejbal wrote:
PuTTY, a SSH client for Windows, requests the passphrase to the ssh key in the console window used for the connection. This could allow a malicious server to gain access to a user's passphrase by spoofing that prompt....
That seems to be the default for many ssh clients, you might want to look at http://lists.mindrot.org/pipermail/openssh-unix-dev/2008-May/026416.html for older discussion on that topic. Regards, a dog - -- http://www.halfdog.net/ PGP: 156A AE98 B91F 0114 FE88 2BD8 C459 9386 feed a bee -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iEYEARECAAYFAkwEpzUACgkQxFmThv7tq+6r6gCfT5K7SDuOTtm5793QSQHhi3+2 CukAoIoihFMyqDSDMjB13GFGBkmT0548 =67Qu -----END PGP SIGNATURE-----
Current thread:
- PuTTY private key passphrase stealing attack Jan Schejbal (Jun 01)
- Re: [Full-disclosure] PuTTY private key passphrase stealing attack Borja Marcos (Jun 01)
- Re: [Full-disclosure] PuTTY private key passphrase stealing attack halfdog (Jun 01)
- Re: [Full-disclosure] PuTTY private key passphrase stealing attack Rob Fuller (Jun 01)