\n
![\"sshconnection\"](\"\/blog\/wp-ttn-blog\/uploads\/2015\/07\/sshconnection.png\")
\nLet’s learn Preventing Brute Force attacks due to OpenSSH Vulnerability (MaxAuthTries bypass).<\/strong><\/p>\n
Vulnerability<\/p>\n
We have servers that use OpenSSH for authentication. Such servers can be exploited to carry out a brute force attack on OpenSSH protocol, making repetitive attempts to login with random passwords.
\nAnyone can exploit the vulnerability as the keyboard-interactive authentication is by default enabled on most of the systems.<\/p>\n
Exploit code:<\/p>\n
[js]ssh -lusername -oKbdInteractiveDevices=`perl -e ‘print "pam," x 10000’` targethost[\/js]
\n![\"ssh10000\"](\"\/blog\/wp-ttn-blog\/uploads\/2015\/07\/ssh10000.png\")
<\/p>\n
Note:The exploit code only works with an automated script running in combination for password attempts.<\/p>\n
This command will allow up to 10,000 password attempts provided that they are done within the login grace time (2 minutes by default) .<\/p>\n
Attack Scenario<\/p>\n
If an attacker requests 10,000 keyboard-interactive requests, OpenSSH will gracefully execute it inside a loop to accept passwords. In such scenario, the attacker will be able to do thousands of login attempts and they will be enough to achieve successful login by using a word-list of most commonly used passwords.<\/p>\n
Version affected:<\/p>\n
We can check the version of ssh on an ubuntu machine by the following command:
\n[js]ssh -V [\/js]
\n![\"ssh\"](\"\/blog\/wp-ttn-blog\/uploads\/2015\/07\/ssh.png\")
\nThis vulnerability is present in the latest version of OpenSSH i.e. 6.9.<\/p>\n
Mitigating the attack:<\/p>\n
- \n
- Using a pem based (private key) authentication i.e. using a cryptographic key pair of at least 2,048 bits instead of password based authentication.<\/li>\n
- Reducing the login grace period of OpenSSh to 20-30 seconds.<\/li>\n
- Using Fail2Ban to limit the number of login attempts.
\nFor detailed instructions about setting up Fail2Ban, you can go through this blog<\/a>.<\/li>\n- Upgrade to OpenSSH 7.0 as it is expected to be released in few weeks.<\/li>\n
- Preventing brute force attacks via intrusion detection systems (IDS).<\/li>\n
- Limiting ssh access only in the firewall.<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"
About OpenSSH OpenSSH is an open-source suite of programs that helps us to secure network communications by encrypting the network traffic over many authentication methods and it provides secure tunneling. It eliminates eavesdropping, connection hijacking, and other such attacks. Let’s learn Preventing Brute Force attacks due to OpenSSH Vulnerability (MaxAuthTries bypass). Vulnerability We have servers […]<\/p>\n","protected":false},"author":166,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"iawp_total_views":24,"footnotes":""},"categories":[2026,1],"tags":[2030,2029,2032,2028,2031,2021],"class_list":["post-23598","post","type-post","status-publish","format-standard","hentry","category-appsec","category-technology","tag-brute-force-attacks","tag-cve-2015-5600","tag-kbdinteractivedevices","tag-openssh","tag-patch","tag-vulnerability"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t