Report of an NSA Employee about a Backdoor in the OpenSSH Daemon (2012) [pdf]

Re:Report of an NSA Employee about a Backdoor in the OpenSSH... by toyg on Saturday January 17, 2015 @05:23PM (#8905756)

This is more of a rootkit than a backdoor, since you have to replace the OpenSSH binary with a trojaned version. A backdoor usually implies that it was there from the start, which is exactly the opposite of what the guy says (he reports having to fight OpenSSH hard to let him have the backdoor).

Title should be "NSA Employee Reports Developing OpenSSH Rootkit".

[ Parent | on HN ]

Re:Report of an NSA Employee about a Backdoor in the OpenSSH... by huhtenberg on Saturday January 17, 2015 @05:30PM (#8905782)

No, it's not a rootkit. Rootkit it not something that grants root access, it something that runs with root privileges and uses them to conceal its own existence.

This one is just a custom OpenSSH version with a backdoor.

[ Parent | on HN ]

Re:Report of an NSA Employee about a Backdoor in the OpenSSH... by smtddr on Saturday January 17, 2015 @05:59PM (#8905883)

http://en.wikipedia.org/wiki/Rootkit

"A rootkit is a stealthy type of software, typically malicious, designed to hide the existence of certain processes or programs from normal methods of detection and enable continued privileged access to a computer"

...continued privileged access. In the *nix world, this is understood to mean root.

[ Parent | on HN ]

Re:Report of an NSA Employee about a Backdoor in the OpenSSH... by AnIrishDuck on Saturday January 17, 2015 @06:14PM (#8905933)

> A rootkit is a stealthy type of software, typically malicious, designed to hide the existence of certain processes or programs from normal methods of detection

These are the primary characteristic of a rootkit. To wit, from that same article:

> Rootkit detection is difficult because a rootkit may be able to subvert the software that is intended to find it. Detection methods include using an alternative and trusted operating system, behavioral-based methods, signature scanning, difference scanning, and memory dump analysis. Removal can be complicated or practically impossible, especially in cases where the rootkit resides in the kernel; reinstallation of the operating system may be the only available solution to the problem.[2] When dealing with firmware rootkits, removal may require hardware replacement, or specialized equipment.

These problems are what rootkits are associated with. The backdoored SSH described in the paper does not qualify. Detecting it is fairly straightforward, and on its own it makes no attempt to hide any programs that it spawns. EDIT: further, as described it makes no efforts to avoid removal.

> enable continued privileged access to a computer

If you strip away the rest of the definition and only look at this part, then by your definition the vanilla SSH server is a rootkit.

[ Parent | on HN ]

Re:Report of an NSA Employee about a Backdoor in the OpenSSH... by tedunangst on Saturday January 17, 2015 @05:56PM (#8905873)

WTF is the purpose of a rootkit that runs as root, conceals its own existence, but doesn't grant root access?

[ Parent | on HN ]

Re:Report of an NSA Employee about a Backdoor in the OpenSSH... by e12e on Saturday January 17, 2015 @06:21PM (#8905945)

It's a backdoor, but the title is misleading: this isn't about a persistent backdoor in the upstream openssh code, it's just a in-house patch/backdoor. Frabkly I thought equivalent code was available and open source? Either way, quoting [1] in full lenght to save others from thinking there's something alarming in the pdf:

Stefan Sperling Sat, 17 Jan 2015 14:44:15 -0800

On Sat, Jan 17, 2015 at 10:59:19PM +0100, Daniel Cegiełka wrote:

> http://www.spiegel.de/media/media-35663.pdf

> "PANT SPARTY is a backdoor in the SSH daemon for *NIX, based on

> OpenSSH portable"

They are not talking about the official OpenSSH code.

To save everyone a bit of time (and hassle with a PDF), from the same document:

"It allows a public key to be embedded in the sshd binary and will then always grant a root login shell if presented with the proper key pair for that key. [...] authorized_keys as a quick-and-easy method of persistence [...] obviously isn't very stealthy [...] The goal for this project was to provide the same level of persistence but embedded in the sshd binary itself (obviously, assuming root access, as before)"

In other works, no backdoor in sshd unless the system has already been rooted by other means and sshd replaced with a bugged binary. Boohoo.

[1] http://www.mail-archive.com/[email protected]/msg135510.html

[ Parent | on HN ]