OpenSSH update from Damien Miller | Hacker News Reader

OpenSSH update from Damien Miller

lwn.net

62 pointsbcl13 comments

So basically this story boils down to (at least as of now):

...I'm not pursuaded that an 0day exists at all. The only evidence so far are some anonymous rumours and unverifiable intrusion transcripts.

Maybe this should be a lesson to wait for more solid info before people begin panicking...

Or if you have a server that is very important you can take steps to mitigate the problem until the issue is resolved. In that case I would make it so that the ssh is only accessible behind a firewall on the local network. If it is a front facing server with no backend network I would change the open port(though this should be done already) and/or enable port knocking. You could also set iptables to only allow access from your remote network.

Or you could be running a version of OpenSSH that is less than four years old. 4.3 came out in 2005

The thing is without full disclosure from the dev team (after they find out if it is in fact a true exploit) upgrading in the dark just to upgrade you could be upgrading to a version of the software that has the exploit.

Every report I have found says that, if an exploit does exist, it is in an old version of OpenSSH. I have no idea why you would update to anything but a recent version. If you suggest that your distribution doesn't have an update to a recent enough version; then rumored OpenSSH exploits are the least of your security concerns.

Your post also suggests that Damien Miller and the OpenSSH development team would not disclose the exploit. Are you aware that one of the goals of the OpenBSD and OpenSSH projects is Full Disclosure? What evidence do you have to suggest that they would go against their own goals?

http://www.openbsd.org/security.html

I think I might not have been clear enough in my point. The people at OpenSSH are good, that was not in question. The point I was making is that the "anti-sec movement" are miles away from trustworthy. Without a confirmation from the actual devs that the current (5.x) versions are OK from the "exploit" I will not be upgrading from the most recent version that is on my distro.

Taking a random "hacker" without proof at face value on the internet is not my cup of tea.

As randallsquared pointed out here http://news.ycombinator.com/item?id=692344 it is entirely possible that the latest version has the problem and this is all a social engineering hack to get everyone to upgrade to a compromised version without any data whatsoever.

To be fair, most people running 4.3 are running 4.3 with RHEL back-patches or something similar. That's what distribution maintainers are for -- there's nothing less secure than trying to remember to patch all your individual programs yourself.

If these are the kinds of things you think will make you safer, why don't you always do this? Why wait for unsubstantiated rumors to come out before going into safe mode?

I was talking about the people who are in a panic right now. I do all the things that are "best practice" for a ssh server currently but that will not stop a 0-day exploit in the wild. My main point was to remove the servers that you are worried about from any connection to the outside world if you are able to do it without disrupting your operations until a full report from a trusted source is disclosed.

Excuse my ignorance, but who is Mark Dowd?

Edit: link I just found: http://taossa.com/index.php/author/mark/

I hadn't heard of him either but a google search looks like he is pretty good at exploits: http://blogs.zdnet.com/security/?p=1030

related links/discussions about his exploits if you're interested:

http://news.ycombinator.com/item?id=164725 http://news.ycombinator.com/item?id=690592 http://news.ycombinator.com/item?id=692881

He was 'duke' from efnet and undernet 10+ years ago.

Reply on news.ycombinator.com