On Thu, 2004-11-04 at 23:49, Scot L. Harris wrote:
At what point does the system log the ssh attempt? If it is after
the
initial 3 way handshake then I think an ssh attempt could be spoofed
without having to receive packets back from the target system. From
what I can tell it appears that when you initiate an ssh attempt the
standard 3 way handshake is started. You send a SYN packet, the target
sends a SYN ACK packet. Normally since you would not get the SYN ACK
packet the connection would not be completed. However if you
manufacture a ACK packet and send that a few seconds after you send the
SYN packet I think you would have a good chance of completing the
handshake. If that gets logged as an SSH attempt then the active
response system in place may block the spoofed sender IP address.
I have tried that. You have to have your login and password transmitted
before the log entry appears through syslog (which makes sense, as the
credentials appear in the log as well). I believe it's pretty hard to
"pre-guess" (what a word) the authentication/encryption handshake to
spoof an IP ;-)
--
HaJo Schatz <hajo(a)hajo.net>
http://www.HaJo.Net
PGP-Key:
http://www.hajo.net/hajonet/keys/pgpkey_hajo.txt