Re:Report of an NSA Employee about a Backdoor in the OpenSSH...
by e12e on Saturday January 17, 2015 @06:21PM
(#8905945)
It's a backdoor, but the title is misleading: this isn't about a persistent backdoor in the upstream openssh code, it's just a in-house patch/backdoor. Frabkly I thought equivalent code was available and open source? Either way, quoting [1] in full lenght to save others from thinking there's something alarming in the pdf:
Stefan Sperling Sat, 17 Jan 2015 14:44:15 -0800
On Sat, Jan 17, 2015 at 10:59:19PM +0100, Daniel Cegiełka wrote:
> "PANT SPARTY is a backdoor in the SSH daemon for *NIX, based on
> OpenSSH portable"
They are not talking about the official OpenSSH code.
To save everyone a bit of time (and hassle with a PDF), from the same document:
"It allows a public key to be embedded in the sshd binary and will then
always grant a root login shell if presented with the proper key pair
for that key. [...] authorized_keys as a quick-and-easy method of
persistence [...] obviously isn't very stealthy [...] The goal for this
project was to provide the same level of persistence but embedded in
the sshd binary itself (obviously, assuming root access, as before)"
In other works, no backdoor in sshd unless the system has already been
rooted by other means and sshd replaced with a bugged binary. Boohoo.
Stefan Sperling Sat, 17 Jan 2015 14:44:15 -0800
On Sat, Jan 17, 2015 at 10:59:19PM +0100, Daniel Cegiełka wrote:
> http://www.spiegel.de/media/media-35663.pdf
>
> "PANT SPARTY is a backdoor in the SSH daemon for *NIX, based on
> OpenSSH portable"
They are not talking about the official OpenSSH code.
To save everyone a bit of time (and hassle with a PDF), from the same document:
"It allows a public key to be embedded in the sshd binary and will then always grant a root login shell if presented with the proper key pair for that key. [...] authorized_keys as a quick-and-easy method of persistence [...] obviously isn't very stealthy [...] The goal for this project was to provide the same level of persistence but embedded in the sshd binary itself (obviously, assuming root access, as before)"
In other works, no backdoor in sshd unless the system has already been rooted by other means and sshd replaced with a bugged binary. Boohoo.
[1] http://www.mail-archive.com/[email protected]/msg135510.html