OpenSSH known_hosts Address Harvesting Research and Hash Mitigation

Key Information Summary 1. Known Issue: Address Collection Description: When using SSH, the client stores a list in the user’s home directory that maps the name and IP address of each remote host along with its public key. This database is known as the file. Attackers have exploited this file to compromise user accounts, steal passwords and identity keys, and then use the host list to identify other accounts that might be vulnerable to the same passwords or keys. Worms may leverage data to discover new attack targets. 2. Evidence of Issues in Data Collection Statistics: As of September 12, 2005, data was collected from 179 hosts. Of these, 69 hosts ran scripts with root privileges and submitted data from all user accounts. In total, 37,771 anonymous entries were received. These entries mapped to 12,041 valid IP addresses across 107 valid IP networks (representing 67% of all valid networks). Unexpected Finding: The data collection script also parsed SSH2 identity key files and discovered that only 38.3% of these key files had their identifiers marked as encrypted. 3. How to Contribute Data to the Research Using Scripts to Collect Data: On UNIX and its derivatives (such as BSD, Linux, and Sun), download . In environments with , use the command line to retrieve the data via . After unpacking, execute four commands: unpack, enter the directory, build, and run the Perl script to collect data. Data Submission Recommendation: If users are behind a firewall, it is recommended to submit data via email. Submitted data will be encrypted before transmission, regardless of the method used. Caveats: Running the script as root will collect data that would otherwise be inaccessible. If running the script as root and using NIS or LDAP, refer to the additional steps in Section II of the README. 4. How to Protect Your Upgrade Solution: OpenSSH 4.0 introduced a hashing scheme for . Upgrading to this version enables host hashing functionality, but requires manual configuration and format conversion. Patch Option: For users unwilling to upgrade to a new OpenSSH version, patches are available for OpenSSH 3.9 and 3.9p1 to hash hostnames and IP addresses in the file. Note that this hashing scheme is incompatible with the one introduced in OpenSSH 4.0. Therefore, if users choose to use this patch now and later upgrade to OpenSSH 4.0, they will not be able to use entries added to after the upgrade. 5. Additional Information Research Papers and Presentations: The related paper is titled “SSH Defense Against Address Collection.” Additionally, the research team presented partial results at the CCGrid 2005 conference on May 9, 2005. Other Exposures: Their research was also covered in Techworld, eWeek, Bruce Schneier’s blog, and The New York Times, including reports on Cisco intrusions that exploited SSH.

Goal Reached Thanks to every supporter — we hit 100%!

OpenSSH known_hosts Address Harvesting Research and Hash Mitigation