Full Disclosure mailing list archives
Re: PuTTY private key passphrase stealing attack
From: halfdog <me () halfdog net>
Date: Tue, 01 Jun 2010 06:26:11 +0000
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Jan Schejbal wrote:
PuTTY, a SSH client for Windows, requests the passphrase to the ssh key in the console window used for the connection. This could allow a malicious server to gain access to a user's passphrase by spoofing that prompt....
That seems to be the default for many ssh clients, you might want to look at http://lists.mindrot.org/pipermail/openssh-unix-dev/2008-May/026416.html for older discussion on that topic. Regards, a dog - -- http://www.halfdog.net/ PGP: 156A AE98 B91F 0114 FE88 2BD8 C459 9386 feed a bee -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iEYEARECAAYFAkwEpzUACgkQxFmThv7tq+6r6gCfT5K7SDuOTtm5793QSQHhi3+2 CukAoIoihFMyqDSDMjB13GFGBkmT0548 =67Qu -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Re: PuTTY private key passphrase stealing attack halfdog (Jun 01)
- <Possible follow-ups>
- Re: PuTTY private key passphrase stealing attack Benji (Jun 01)
- Re: PuTTY private key passphrase stealing attack Joachim Schipper (Jun 01)
- Re: PuTTY private key passphrase stealing attack Borja Marcos (Jun 01)
- Re: PuTTY private key passphrase stealing attack rapper crazy (Jun 02)
- Re: PuTTY private key passphrase stealing attack Joachim Schipper (Jun 02)
- Re: PuTTY private key passphrase stealing attack paul . szabo (Jun 02)
- Re: PuTTY private key passphrase stealing attack Marsh Ray (Jun 02)
- Re: PuTTY private key passphrase stealing attack Jan Schejbal (Jun 03)
- Re: PuTTY private key passphrase stealing attack Joachim Schipper (Jun 02)