SSH Brute Force – The 10 Year Old Attack That Still Persists

Re:SSH Brute Force – The 10 Year Old Attack That Still Persists by Osmium on Monday July 15, 2013 @02:01PM (#6047342)

Huh. I hadn't actually thought that the protocol itself could protect you (I only left my comment based on what I'd read elsewhere; I don't know anything about it otherwise).

So hypothetically speaking, if the protocol did protect your password from being stolen, what would be the actual threat of a piece of malware specifically pretending to be SSH?

[ Parent | on HN ]

Re:SSH Brute Force – The 10 Year Old Attack That Still Persists by sp332 on Monday July 15, 2013 @02:34PM (#6047622)

If you use "sudo foo" in the remote shell, and then type your password, it could steal that. Or even if you somehow obfuscated your sudo password, it could change the command presented to sudo, so after you type your password, the new substituted command would be executed. Exaple: you type "sudo less /var/log/messages" but the fake-ssh tells the remote shell that you really typed "sudo email-me-all-your-data". Then the real sudo authenticates you, and executes the command you didn't type.

[ Parent | on HN ]