Graphics Programs Reference
In-Depth Information
Escape character is '^]'.
SSH-1.5-OpenSSH_3.9p1
Connection closed by foreign host.
Usually, clients such as tetsuo connecting to loki at 192.168.42.72 would
have only communicated using SSH2. Therefore, there would only be a host
fingerprint for SSH protocol 2 stored on the client. When protocol 1 is forced
by the MitM attack, the attacker's fingerprint won't be compared to the stored
fingerprint, due to the differing protocols. Older implementations will simply
ask to add this fingerprint since, technically, no host fingerprint exists for
this protocol. This is shown in the output below.
iz@tetsuo:~ $ ssh jose@192.168.42.72
The authenticity of host '192.168.42.72 (192.168.42.72)' can't be established.
RSA1 key fingerprint is 45:f7:8d:ea:51:0f:25:db:5a:4b:9e:6a:d6:3c:d0:a6.
Are you sure you want to continue connecting (yes/no)?
Since this vulnerability was made public, newer implementations of
OpenSSH have a slightly more verbose warning:
iz@tetsuo:~ $ ssh jose@192.168.42.72
WARNING: RSA key found for host 192.168.42.72
in /home/iz/.ssh/known_hosts:1
RSA key fingerprint ba:06:7f:d2:b9:74:a8:0a:13:cb:a2:f7:e0:10:59:a0.
The authenticity of host '192.168.42.72 (192.168.42.72)' can't be established
but keys of different type are already known for this host.
RSA1 key fingerprint is 45:f7:8d:ea:51:0f:25:db:5a:4b:9e:6a:d6:3c:d0:a6.
A
re you sure you want to continue connecting (yes/no)?
This modified warning isn't as strong as the warning given when host
fingerprints of the same protocol don't match. Also, since not all clients will
be up to date, this technique can still prove to be useful for an MitM attack.
0x753
Fuzzy Fingerprints
Konrad Rieck had an interesting idea regarding SSH host fingerprints. Often,
a user will connect to a server from several different clients. The host finger-
print will be displayed and added each time a new client is used, and a security-
conscious user will tend to remember the general structure of the host
fingerprint. While no one actually memorizes the entire fingerprint, major
changes can be detected with little effort. Having a general idea of what the
host fingerprint looks like when connecting from a new client greatly increases
the security of that connection. If an MitM attack is attempted, the blatant
difference in host fingerprints can usually be detected by eye.
However, the eye and the brain can be tricked. Certain fingerprints will
look very similar to others. Digits 1 and 7 look very similar, depending on the
display font. Usually, the hex digits found at the beginning and end of the
fingerprint are remembered with the greatest clarity, while the middle tends
