Understanding SSH: Large-scale measurements and notary-based - - PowerPoint PPT Presentation

understanding ssh large scale measurements and notary
SMART_READER_LITE
LIVE PREVIEW

Understanding SSH: Large-scale measurements and notary-based - - PowerPoint PPT Presentation

Understanding SSH: Large-scale measurements and notary-based authentication Final Presentation Oliver Gasser Master Thesis Advisor: Ralph Holz Chair for Network Architectures and Services Faculty of Computer Science Technische Universit


slide-1
SLIDE 1

Understanding SSH: Large-scale measurements and notary-based authentication

Final Presentation Oliver Gasser

Master Thesis Advisor: Ralph Holz Chair for Network Architectures and Services Faculty of Computer Science Technische Universit¨ at M¨ unchen

March 19, 2013

Oliver Gasser (TU M¨ unchen) Understanding SSH 1

slide-2
SLIDE 2

Outline

1

SSH Basics

2

Goals

3

Related Work

4

SSH Scanning

5

Evaluation

6

Notary-based Authentication

7

Summary

Oliver Gasser (TU M¨ unchen) Understanding SSH 2

slide-3
SLIDE 3

Outline

1

SSH Basics

2

Goals

3

Related Work

4

SSH Scanning

5

Evaluation

6

Notary-based Authentication

7

Summary

Oliver Gasser (TU M¨ unchen) Understanding SSH 3

slide-4
SLIDE 4

SSH Basics

SSH Protocol Client–server protocol Secure replacement for rsh, rlogin, telnet Two major protocol versions SSH-1.x SSH-2.0 Use: Server administration, tunneling Not utilized by everyday Internet user

Oliver Gasser (TU M¨ unchen) Understanding SSH 4

slide-5
SLIDE 5

SSH Connection Establishment

SSH Client SSH Server Establish TCP connection (client connects to server on port 22) Exchange SSH identification string: "SSH-2.0-OpenSSH 5.9p1 Debian-5ubuntu1" Exchange supported algorithms: kex algorithms server host key algorithms enc algorithms client server enc algorithms server client mac algorithms client server mac algorithms server client compression algorithms client server compression algorithms server client languages client server languages server client Diffie Hellman key exchange with server authentication Protected Client authentication (e.g. by password or public key) Service communication (e.g. terminal login session)

Trust-On-First-Use principle

Oliver Gasser (TU M¨ unchen) Understanding SSH 5

slide-6
SLIDE 6

SSH Connection Establishment

SSH Client SSH Server Establish TCP connection (client connects to server on port 22) Exchange SSH identification string: "SSH-2.0-OpenSSH 5.9p1 Debian-5ubuntu1" Exchange supported algorithms: kex algorithms server host key algorithms enc algorithms client server enc algorithms server client mac algorithms client server mac algorithms server client compression algorithms client server compression algorithms server client languages client server languages server client Diffie Hellman key exchange with server authentication Protected Client authentication (e.g. by password or public key) Service communication (e.g. terminal login session)

Trust-On-First-Use principle

Oliver Gasser (TU M¨ unchen) Understanding SSH 5

slide-7
SLIDE 7

Outline

1

SSH Basics

2

Goals

3

Related Work

4

SSH Scanning

5

Evaluation

6

Notary-based Authentication

7

Summary

Oliver Gasser (TU M¨ unchen) Understanding SSH 6

slide-8
SLIDE 8

Problem statement

Insufficient data about the SSH landscape available Perform IPv4-wide scans for SSH servers Trust-On-First-Use is strong assumption Provide notary-based authentication for SSH servers

Oliver Gasser (TU M¨ unchen) Understanding SSH 7

slide-9
SLIDE 9

Problem statement

Insufficient data about the SSH landscape available Perform IPv4-wide scans for SSH servers Trust-On-First-Use is strong assumption Provide notary-based authentication for SSH servers

Oliver Gasser (TU M¨ unchen) Understanding SSH 7

slide-10
SLIDE 10

Problem statement

Insufficient data about the SSH landscape available Perform IPv4-wide scans for SSH servers Trust-On-First-Use is strong assumption Provide notary-based authentication for SSH servers

Oliver Gasser (TU M¨ unchen) Understanding SSH 7

slide-11
SLIDE 11

Problem statement

Insufficient data about the SSH landscape available Perform IPv4-wide scans for SSH servers Trust-On-First-Use is strong assumption Provide notary-based authentication for SSH servers

Oliver Gasser (TU M¨ unchen) Understanding SSH 7

slide-12
SLIDE 12

Outline

1

SSH Basics

2

Goals

3

Related Work

4

SSH Scanning

5

Evaluation

6

Notary-based Authentication

7

Summary

Oliver Gasser (TU M¨ unchen) Understanding SSH 8

slide-13
SLIDE 13

Related Work: Protocol Scanning

Provos and Honeyman (2001) Scanned 2 million IP addresses for SSH servers Analyzed only SSH version and server’s identification string Yilek et al. (2009) Debian OpenSSL vulnerability Analyzed X.509 certificate churn No SSH scans Holz et al. (2011) Active scans for Alexa Top 1 Million Hosts Passive monitoring of MWN traffic No SSH scans

Oliver Gasser (TU M¨ unchen) Understanding SSH 9

slide-14
SLIDE 14

Related Work: Protocol Scanning

Provos and Honeyman (2001) Scanned 2 million IP addresses for SSH servers Analyzed only SSH version and server’s identification string Yilek et al. (2009) Debian OpenSSL vulnerability Analyzed X.509 certificate churn No SSH scans Holz et al. (2011) Active scans for Alexa Top 1 Million Hosts Passive monitoring of MWN traffic No SSH scans

Oliver Gasser (TU M¨ unchen) Understanding SSH 9

slide-15
SLIDE 15

Related Work: Protocol Scanning

Provos and Honeyman (2001) Scanned 2 million IP addresses for SSH servers Analyzed only SSH version and server’s identification string Yilek et al. (2009) Debian OpenSSL vulnerability Analyzed X.509 certificate churn No SSH scans Holz et al. (2011) Active scans for Alexa Top 1 Million Hosts Passive monitoring of MWN traffic No SSH scans

Oliver Gasser (TU M¨ unchen) Understanding SSH 9

slide-16
SLIDE 16

Related Work: Key Security

Lenstra et al. (2012) No active scanning, EFF SSL observatory and other sources 6.2 million X.509 certs and 5.5 million PGP keys 4 % of RSA keys shared modulus, 0.18 % shared one prime Conclusion: RSA keys less secure than DSA keys Heninger et al. (2012) Active scanning for TLS and SSH servers 5.8 million unique X.509 certs and 6.2 million unique SSH host keys Recovered private keys for RSA (0.03 %) and DSA keys (1 %) Conclusion:

Embedded devices do not have enough entropy DSA mode more vulnerable than RSA

Oliver Gasser (TU M¨ unchen) Understanding SSH 10

slide-17
SLIDE 17

Related Work: Notary-based Authentication

Wendlandt et al. (2008) Perspectives Improve SSH authentication mechanism Crypto flaws Implementation not available Holz et al. (2012) Crossbear Detect Man-in-the-Middle attacks on SSL Localize the MitM using traceroutes No support for SSH

Oliver Gasser (TU M¨ unchen) Understanding SSH 11

slide-18
SLIDE 18

Related Work: Notary-based Authentication

Wendlandt et al. (2008) Perspectives Improve SSH authentication mechanism Crypto flaws Implementation not available Holz et al. (2012) Crossbear Detect Man-in-the-Middle attacks on SSL Localize the MitM using traceroutes No support for SSH

Oliver Gasser (TU M¨ unchen) Understanding SSH 11

slide-19
SLIDE 19

Outline

1

SSH Basics

2

Goals

3

Related Work

4

SSH Scanning

5

Evaluation

6

Notary-based Authentication

7

Summary

Oliver Gasser (TU M¨ unchen) Understanding SSH 12

slide-20
SLIDE 20

SSH Scanning

Internet-wide scanning for SSH protocol Parallel scanning to improve performance Collect information and fetch SSH host key Full SSH handshake with OpenSSH Different scanning scenarios Modularity in software design Minimize intrusiveness Pseudorandom IP address generation Blacklist

Oliver Gasser (TU M¨ unchen) Understanding SSH 13

slide-21
SLIDE 21

SSH Scanning

Internet-wide scanning for SSH protocol Parallel scanning to improve performance Collect information and fetch SSH host key Full SSH handshake with OpenSSH Different scanning scenarios Modularity in software design Minimize intrusiveness Pseudorandom IP address generation Blacklist

Oliver Gasser (TU M¨ unchen) Understanding SSH 13

slide-22
SLIDE 22

SSH Scanning

Internet-wide scanning for SSH protocol Parallel scanning to improve performance Collect information and fetch SSH host key Full SSH handshake with OpenSSH Different scanning scenarios Modularity in software design Minimize intrusiveness Pseudorandom IP address generation Blacklist

Oliver Gasser (TU M¨ unchen) Understanding SSH 13

slide-23
SLIDE 23

SSH Scanning

Internet-wide scanning for SSH protocol Parallel scanning to improve performance Collect information and fetch SSH host key Full SSH handshake with OpenSSH Different scanning scenarios Modularity in software design Minimize intrusiveness Pseudorandom IP address generation Blacklist

Oliver Gasser (TU M¨ unchen) Understanding SSH 13

slide-24
SLIDE 24

SSH Scanning

Internet-wide scanning for SSH protocol Parallel scanning to improve performance Collect information and fetch SSH host key Full SSH handshake with OpenSSH Different scanning scenarios Modularity in software design Minimize intrusiveness Pseudorandom IP address generation Blacklist

Oliver Gasser (TU M¨ unchen) Understanding SSH 13

slide-25
SLIDE 25

SSH Scanning

Internet-wide scanning for SSH protocol Parallel scanning to improve performance Collect information and fetch SSH host key Full SSH handshake with OpenSSH Different scanning scenarios Modularity in software design Minimize intrusiveness Pseudorandom IP address generation Blacklist

Oliver Gasser (TU M¨ unchen) Understanding SSH 13

slide-26
SLIDE 26

SSH Scanning

Internet-wide scanning for SSH protocol Parallel scanning to improve performance Collect information and fetch SSH host key Full SSH handshake with OpenSSH Different scanning scenarios Modularity in software design Minimize intrusiveness Pseudorandom IP address generation Blacklist

Oliver Gasser (TU M¨ unchen) Understanding SSH 13

slide-27
SLIDE 27

SSH Scanning

Internet-wide scanning for SSH protocol Parallel scanning to improve performance Collect information and fetch SSH host key Full SSH handshake with OpenSSH Different scanning scenarios Modularity in software design Minimize intrusiveness Pseudorandom IP address generation Blacklist

Oliver Gasser (TU M¨ unchen) Understanding SSH 13

slide-28
SLIDE 28

sshscan Overview

Coordinator

Logging

[IpGenerator] 100 IPs generated [NmapScanner-02] 133.713.37.42 port 22 open . . . . . .

SIGUSR1 IP Blacklist

194.77.40.240/29 188.138.95.7 . . . . . .

IP Provider nmap Thread nmap Thread nmap Thread ssh Thread ssh Thread ssh Thread

File Queue

Modularity Scanner can be easily adapted to other protocols

Oliver Gasser (TU M¨ unchen) Understanding SSH 14

slide-29
SLIDE 29

sshscan: The Coordinator

Coordinator

Logging

[IpGenerator] 100 IPs generated [NmapScanner-02] 133.713.37.42 port 22 open . . . . . .

SIGUSR1 IP Blacklist

194.77.40.240/29 188.138.95.7 . . . . . .

IP Provider nmap Thread nmap Thread nmap Thread ssh Thread ssh Thread ssh Thread

File Queue

Coordinator Main component that coordinates all others

Oliver Gasser (TU M¨ unchen) Understanding SSH 15

slide-30
SLIDE 30

sshscan: The IP Provider

Coordinator

Logging

[IpGenerator] 100 IPs generated [NmapScanner-02] 133.713.37.42 port 22 open . . . . . .

SIGUSR1 IP Blacklist

194.77.40.240/29 188.138.95.7 . . . . . .

IP Provider nmap Thread nmap Thread nmap Thread ssh Thread ssh Thread ssh Thread

File Queue

IP Provider Generates IP addresses according to certain rules Random IP Provider: LCG, Xn+1 ≡ (a · Xn + c) (mod m)

Oliver Gasser (TU M¨ unchen) Understanding SSH 16

slide-31
SLIDE 31

sshscan: The nmap Threads

Coordinator

Logging

[IpGenerator] 100 IPs generated [NmapScanner-02] 133.713.37.42 port 22 open . . . . . .

SIGUSR1 IP Blacklist

194.77.40.240/29 188.138.95.7 . . . . . .

IP Provider nmap Thread nmap Thread nmap Thread ssh Thread ssh Thread ssh Thread

File Queue

nmap Thread Get IP addresses from provider Check port TCP/22 Propagate results to File Queue

Oliver Gasser (TU M¨ unchen) Understanding SSH 17

slide-32
SLIDE 32

sshscan: The File Queue

Coordinator

Logging

[IpGenerator] 100 IPs generated [NmapScanner-02] 133.713.37.42 port 22 open . . . . . .

SIGUSR1 IP Blacklist

194.77.40.240/29 188.138.95.7 . . . . . .

IP Provider nmap Thread nmap Thread nmap Thread ssh Thread ssh Thread ssh Thread

File Queue

File Queue Provides mutually exclusive access to nmap results Files containing results retrieved by ssh Threads

Oliver Gasser (TU M¨ unchen) Understanding SSH 18

slide-33
SLIDE 33

sshscan: The ssh Threads

Coordinator

Logging

[IpGenerator] 100 IPs generated [NmapScanner-02] 133.713.37.42 port 22 open . . . . . .

SIGUSR1 IP Blacklist

194.77.40.240/29 188.138.95.7 . . . . . .

IP Provider nmap Thread nmap Thread nmap Thread ssh Thread ssh Thread ssh Thread

File Queue

ssh Thread Get potential SSH servers from File Queue Establish connection using OpenSSH

Oliver Gasser (TU M¨ unchen) Understanding SSH 19

slide-34
SLIDE 34

sshscan: The IP Blacklist

Coordinator

Logging

[IpGenerator] 100 IPs generated [NmapScanner-02] 133.713.37.42 port 22 open . . . . . .

SIGUSR1 IP Blacklist

194.77.40.240/29 188.138.95.7 . . . . . .

IP Provider nmap Thread nmap Thread nmap Thread ssh Thread ssh Thread ssh Thread

File Queue

IP Blacklist Allows to ignore certain hosts or IP ranges Refresh triggered by SIGUSR1 signal

Oliver Gasser (TU M¨ unchen) Understanding SSH 20

slide-35
SLIDE 35

Outline

1

SSH Basics

2

Goals

3

Related Work

4

SSH Scanning

5

Evaluation

6

Notary-based Authentication

7

Summary

Oliver Gasser (TU M¨ unchen) Understanding SSH 21

slide-36
SLIDE 36

Conducted SSH Scans

Four scans Executed between September 2012 and January 2013 Duration: 3 to 7 days per scan

# IPs probed SSH hosts found SSH-1.x host keys 1 SSH-2.0 host keys 1 1 2.3 billion 2.3 million 189 k (115 k) 4 million (2 million) 2 3.3 billion 4.3 million 327 k (185 k) 7.6 million (3.6 million) 3 1.3 billion 1.5 million 106 k (76 k) 2.5 million (1.4 million) 4 3.7 billion 12 million 984 k (538 k) 20.9 million (9.3 million)

1 (distinct host keys in brackets)

Challenge Routing problems

Oliver Gasser (TU M¨ unchen) Understanding SSH 22

slide-37
SLIDE 37

Conducted SSH Scans

Four scans Executed between September 2012 and January 2013 Duration: 3 to 7 days per scan

# IPs probed SSH hosts found SSH-1.x host keys 1 SSH-2.0 host keys 1 1 2.3 billion 2.3 million 189 k (115 k) 4 million (2 million) 2 3.3 billion 4.3 million 327 k (185 k) 7.6 million (3.6 million) 3 1.3 billion 1.5 million 106 k (76 k) 2.5 million (1.4 million) 4 3.7 billion 12 million 984 k (538 k) 20.9 million (9.3 million)

1 (distinct host keys in brackets)

Challenge Routing problems

Oliver Gasser (TU M¨ unchen) Understanding SSH 22

slide-38
SLIDE 38

SSH Versions

0.001 % 0.01 % 0.1 % 1 % 10 % 100 % 2.0 1.99 1.5 Others Percentage SSH Versions

Invalid SSH versions SSH-2.99: Used by buggy Cisco devices SSH-2.37: Misconfigured OpenSSH

Oliver Gasser (TU M¨ unchen) Understanding SSH 23

slide-39
SLIDE 39

SSH Versions

0.001 % 0.01 % 0.1 % 1 % 10 % 100 % 2.0 1.99 1.5 Others Percentage SSH Versions

Good ✓ Invalid SSH versions SSH-2.99: Used by buggy Cisco devices SSH-2.37: Misconfigured OpenSSH

Oliver Gasser (TU M¨ unchen) Understanding SSH 23

slide-40
SLIDE 40

SSH Versions

0.001 % 0.01 % 0.1 % 1 % 10 % 100 % 2.0 1.99 1.5 Others Percentage SSH Versions

Good ✓ Invalid SSH versions SSH-2.99: Used by buggy Cisco devices SSH-2.37: Misconfigured OpenSSH

Oliver Gasser (TU M¨ unchen) Understanding SSH 23

slide-41
SLIDE 41

SSH Servers

OpenSSH_4.3 OpenSSH_5.3 OpenSSH_5.5 OpenSSH_5.1 Dropbear_0.51 Cisco-1.25 OpenSSH_5.9 OpenSSH_5.8 Dropbear_0.52 OpenSSH_3.9 0 % 5 % 10 % 15 % 20 % 25 % Percentage

Oliver Gasser (TU M¨ unchen) Understanding SSH 24

slide-42
SLIDE 42

SSH Servers

OpenSSH_4.3 OpenSSH_5.3 OpenSSH_5.5 OpenSSH_5.1 Dropbear_0.51 Cisco-1.25 OpenSSH_5.9 OpenSSH_5.8 Dropbear_0.52 OpenSSH_3.9 0 % 5 % 10 % 15 % 20 % 25 % Percentage

Old versions ✗

Oliver Gasser (TU M¨ unchen) Understanding SSH 24

slide-43
SLIDE 43

SSH Servers

OpenSSH_4.3 OpenSSH_5.3 OpenSSH_5.5 OpenSSH_5.1 Dropbear_0.51 Cisco-1.25 OpenSSH_5.9 OpenSSH_5.8 Dropbear_0.52 OpenSSH_3.9 0 % 5 % 10 % 15 % 20 % 25 % Percentage

Old versions ✗ Supported by major distros ✓

Oliver Gasser (TU M¨ unchen) Understanding SSH 24

slide-44
SLIDE 44

Algorithms (1)

Key Exchange Required: diffie-hellman-group1-sha1 (98 %) and diffie-hellman-group14-sha1 (77 %) Almost exclusively Diffie-Hellman and Elliptic Curve DH About 0.1 % offer RSA-style key exchange, no Perfect Forward Secrecy Encryption Required: 3des-cbc (97.5 % support it) Most prominent are 3DES, AES, RC4, Blowfish Since OpenSSH 5.2 CTR-mode is preferred 20 % just support discouraged CBC-mode

Oliver Gasser (TU M¨ unchen) Understanding SSH 25

slide-45
SLIDE 45

Algorithms (1)

Key Exchange Required: diffie-hellman-group1-sha1 (98 %) and diffie-hellman-group14-sha1 (77 %) Almost exclusively Diffie-Hellman and Elliptic Curve DH About 0.1 % offer RSA-style key exchange, no Perfect Forward Secrecy Encryption Required: 3des-cbc (97.5 % support it) Most prominent are 3DES, AES, RC4, Blowfish Since OpenSSH 5.2 CTR-mode is preferred 20 % just support discouraged CBC-mode

Oliver Gasser (TU M¨ unchen) Understanding SSH 25

slide-46
SLIDE 46

Algorithms (2)

Integrity Check Required: hmac-sha1 Almost all SSH servers offer HMAC, about half UMAC Discouraged md5-8 (0.0006 %) and sha1-8 (0.0001 %) are

  • ffered

Compression Required: none Mostly used are none and zlib@openssh.com 13 % of servers also offer discouraged zlib

Oliver Gasser (TU M¨ unchen) Understanding SSH 26

slide-47
SLIDE 47

Algorithms (2)

Integrity Check Required: hmac-sha1 Almost all SSH servers offer HMAC, about half UMAC Discouraged md5-8 (0.0006 %) and sha1-8 (0.0001 %) are

  • ffered

Compression Required: none Mostly used are none and zlib@openssh.com 13 % of servers also offer discouraged zlib

Oliver Gasser (TU M¨ unchen) Understanding SSH 26

slide-48
SLIDE 48

User Authentication

publickey password gssapi-with-mic keyboard-interactive gssapi-keyex hostbased gssapi none external-keyex 0 % 20 % 40 % 60 % 80 % 100 % Percentage

Oliver Gasser (TU M¨ unchen) Understanding SSH 27

slide-49
SLIDE 49

User Authentication

publickey password gssapi-with-mic keyboard-interactive gssapi-keyex hostbased gssapi none external-keyex 0 % 20 % 40 % 60 % 80 % 100 % Percentage

Public Key: Good ✓

Oliver Gasser (TU M¨ unchen) Understanding SSH 27

slide-50
SLIDE 50

User Authentication

publickey password gssapi-with-mic keyboard-interactive gssapi-keyex hostbased gssapi none external-keyex 0 % 20 % 40 % 60 % 80 % 100 % Percentage

Public Key: Good ✓ Password: Bad ✗

Oliver Gasser (TU M¨ unchen) Understanding SSH 27

slide-51
SLIDE 51

SSH Host Keys

Used to identify server SSH-1.x Type: Only ssh-rsa1 189 k, 327 k, 106 k and 984 k fetched during four scans Between 30 % and 45 % of keys are duplicates SSH-2.0 Types: ssh-rsa, ssh-dss, ecdsa-sha2 4 million, 7.2 million, 2.5 million and 20.9 million fetched Between 45 % and 55 % of keys are duplicates

Oliver Gasser (TU M¨ unchen) Understanding SSH 28

slide-52
SLIDE 52

SSH Host Keys

Used to identify server SSH-1.x Type: Only ssh-rsa1 189 k, 327 k, 106 k and 984 k fetched during four scans Between 30 % and 45 % of keys are duplicates SSH-2.0 Types: ssh-rsa, ssh-dss, ecdsa-sha2 4 million, 7.2 million, 2.5 million and 20.9 million fetched Between 45 % and 55 % of keys are duplicates

Oliver Gasser (TU M¨ unchen) Understanding SSH 28

slide-53
SLIDE 53

SSH Host Keys

Used to identify server SSH-1.x Type: Only ssh-rsa1 189 k, 327 k, 106 k and 984 k fetched during four scans Between 30 % and 45 % of keys are duplicates SSH-2.0 Types: ssh-rsa, ssh-dss, ecdsa-sha2 4 million, 7.2 million, 2.5 million and 20.9 million fetched Between 45 % and 55 % of keys are duplicates

Oliver Gasser (TU M¨ unchen) Understanding SSH 28

slide-54
SLIDE 54

Duplicate Host Keys

Duplicate SSH-2.0 host keys Single most often duplicated key accounted for more than 1 %

  • f all fetched keys

Autonomous Systems Duplicate key occurrence is clustered Autonomous Systems with many duplicate host keys:

1&1 Hetzner Chunghwa Telecom (Taiwan)

Duplicate host keys + password authentication: Man-in-the-Middle attacks

Oliver Gasser (TU M¨ unchen) Understanding SSH 29

slide-55
SLIDE 55

Duplicate Host Keys

Duplicate SSH-2.0 host keys Single most often duplicated key accounted for more than 1 %

  • f all fetched keys

Autonomous Systems Duplicate key occurrence is clustered Autonomous Systems with many duplicate host keys:

1&1 Hetzner Chunghwa Telecom (Taiwan)

Duplicate host keys + password authentication: Man-in-the-Middle attacks

Oliver Gasser (TU M¨ unchen) Understanding SSH 29

slide-56
SLIDE 56

Duplicate Host Keys

Duplicate SSH-2.0 host keys Single most often duplicated key accounted for more than 1 %

  • f all fetched keys

Autonomous Systems Duplicate key occurrence is clustered Autonomous Systems with many duplicate host keys:

1&1 Hetzner Chunghwa Telecom (Taiwan)

Duplicate host keys + password authentication: Man-in-the-Middle attacks

Oliver Gasser (TU M¨ unchen) Understanding SSH 29

slide-57
SLIDE 57

Duplicate Keys: SSH Servers

OpenSSH_4.3 OpenSSH_5.3 OpenSSH_5.5 OpenSSH_5.1 Dropbear_0.52 OpenSSH_3.9 OpenSSH_5.9 Dropbear_0.46 OpenSSH_5.8 OpenSSH lancom 5 10 15 20 25 30 Percentage Duplicate Keys Unique Keys

Oliver Gasser (TU M¨ unchen) Understanding SSH 30

slide-58
SLIDE 58

Duplicate Keys: SSH Servers

OpenSSH_4.3 OpenSSH_5.3 OpenSSH_5.5 OpenSSH_5.1 Dropbear_0.52 OpenSSH_3.9 OpenSSH_5.9 Dropbear_0.46 OpenSSH_5.8 OpenSSH lancom 5 10 15 20 25 30 Percentage Duplicate Keys Unique Keys

New servers: Good ✓

Oliver Gasser (TU M¨ unchen) Understanding SSH 30

slide-59
SLIDE 59

Duplicate Keys: SSH Servers

OpenSSH_4.3 OpenSSH_5.3 OpenSSH_5.5 OpenSSH_5.1 Dropbear_0.52 OpenSSH_3.9 OpenSSH_5.9 Dropbear_0.46 OpenSSH_5.8 OpenSSH lancom 5 10 15 20 25 30 Percentage Duplicate Keys Unique Keys

New servers: Good ✓ E.g. lancom: Bad ✗

Oliver Gasser (TU M¨ unchen) Understanding SSH 30

slide-60
SLIDE 60

SSH-1.x Host Key Analysis

Key length 91 % of all keys have 1024 or fewer bits They are not considered to be secure anymore 8.6 % of keys are 2048 bit long, only 0.02 % are 4096 bit keys No good reason to still use SSH-1.x in the first place!

Oliver Gasser (TU M¨ unchen) Understanding SSH 31

slide-61
SLIDE 61

SSH-1.x Host Key Analysis

Key length 91 % of all keys have 1024 or fewer bits They are not considered to be secure anymore 8.6 % of keys are 2048 bit long, only 0.02 % are 4096 bit keys No good reason to still use SSH-1.x in the first place!

Oliver Gasser (TU M¨ unchen) Understanding SSH 31

slide-62
SLIDE 62

SSH-2.0 Host Key Analysis

Key types Majority RSA (52 %) and DSA (44.5 %) type keys Elliptic curve DSA usage increased from 2.3 % to 3.5 % within four months Key length RSA: 69 % of all keys are 2048 bit long, 30 % are 1024 bit long DSA: 98 % of keys are 1024 bit long, 1 % is 2048 bit long, 0.5 % still uses 512 bit keys ECDSA: More than 99 % use 520 bit keys, the rest is longer The NIST recommends at least 2048 bits for RSA/DSA keys

Oliver Gasser (TU M¨ unchen) Understanding SSH 32

slide-63
SLIDE 63

SSH-2.0 Host Key Analysis

Key types Majority RSA (52 %) and DSA (44.5 %) type keys Elliptic curve DSA usage increased from 2.3 % to 3.5 % within four months Key length RSA: 69 % of all keys are 2048 bit long, 30 % are 1024 bit long DSA: 98 % of keys are 1024 bit long, 1 % is 2048 bit long, 0.5 % still uses 512 bit keys ECDSA: More than 99 % use 520 bit keys, the rest is longer The NIST recommends at least 2048 bits for RSA/DSA keys

Oliver Gasser (TU M¨ unchen) Understanding SSH 32

slide-64
SLIDE 64

SSH-2.0 Host Key Analysis

Key types Majority RSA (52 %) and DSA (44.5 %) type keys Elliptic curve DSA usage increased from 2.3 % to 3.5 % within four months Key length RSA: 69 % of all keys are 2048 bit long, 30 % are 1024 bit long DSA: 98 % of keys are 1024 bit long, 1 % is 2048 bit long, 0.5 % still uses 512 bit keys ECDSA: More than 99 % use 520 bit keys, the rest is longer The NIST recommends at least 2048 bits for RSA/DSA keys

Oliver Gasser (TU M¨ unchen) Understanding SSH 32

slide-65
SLIDE 65

Outline

1

SSH Basics

2

Goals

3

Related Work

4

SSH Scanning

5

Evaluation

6

Notary-based Authentication

7

Summary

Oliver Gasser (TU M¨ unchen) Understanding SSH 33

slide-66
SLIDE 66

Notary-Based Authentication

OpenSSH warning when connecting to host with unknown fingerprint

Oliver Gasser (TU M¨ unchen) Understanding SSH 34

slide-67
SLIDE 67

OpenSSH interacting with CrossbearSSH

SSH Server OpenSSH Client CrossbearSSH Server SSH Key Exchange Unknown or not matching SSH host key fingerprint VerifyHostKeyNotary Display warning no yes FpVerifyRequest

Database

check FpVerifyResult MATCH Display warning no Continue connecting yes Oliver Gasser (TU M¨ unchen) Understanding SSH 35

slide-68
SLIDE 68

CrossbearSSH and notary-enabled OpenSSH

CrossbearSSH Modified Crossbear server for SSH Verifies SSH fingerprint by comparing to database or doing a live lookup Sends result back to client Notary-enabled OpenSSH Patched version of OpenSSH 6.1 Proof-of-concept implementation Option to ask notary server when. . .

establishing the first connection to an SSH server, or fingerprint changed

Oliver Gasser (TU M¨ unchen) Understanding SSH 36

slide-69
SLIDE 69

CrossbearSSH and notary-enabled OpenSSH

CrossbearSSH Modified Crossbear server for SSH Verifies SSH fingerprint by comparing to database or doing a live lookup Sends result back to client Notary-enabled OpenSSH Patched version of OpenSSH 6.1 Proof-of-concept implementation Option to ask notary server when. . .

establishing the first connection to an SSH server, or fingerprint changed

Oliver Gasser (TU M¨ unchen) Understanding SSH 36

slide-70
SLIDE 70

Outline

1

SSH Basics

2

Goals

3

Related Work

4

SSH Scanning

5

Evaluation

6

Notary-based Authentication

7

Summary

Oliver Gasser (TU M¨ unchen) Understanding SSH 37

slide-71
SLIDE 71

Summary

SSH scanning Scan complete IPv4 address space in one week Useful for other protocols, too State of SSH Weaknesses: SSH-1.x, outdated algorithms, short keys, password authentication Duplicated keys in AS’s CrossbearSSH Uses vast SSH host key collection Proof-of-concept implementation with OpenSSH Thwarts Man-in-the-Middle attacks

Oliver Gasser (TU M¨ unchen) Understanding SSH 38

slide-72
SLIDE 72

Summary

SSH scanning Scan complete IPv4 address space in one week Useful for other protocols, too State of SSH Weaknesses: SSH-1.x, outdated algorithms, short keys, password authentication Duplicated keys in AS’s CrossbearSSH Uses vast SSH host key collection Proof-of-concept implementation with OpenSSH Thwarts Man-in-the-Middle attacks

Oliver Gasser (TU M¨ unchen) Understanding SSH 38

slide-73
SLIDE 73

Summary

SSH scanning Scan complete IPv4 address space in one week Useful for other protocols, too State of SSH Weaknesses: SSH-1.x, outdated algorithms, short keys, password authentication Duplicated keys in AS’s CrossbearSSH Uses vast SSH host key collection Proof-of-concept implementation with OpenSSH Thwarts Man-in-the-Middle attacks

Oliver Gasser (TU M¨ unchen) Understanding SSH 38

slide-74
SLIDE 74

The End. . .

Thank you for your attention

Oliver Gasser (TU M¨ unchen) Understanding SSH 39