Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 03 Jan 2012 14:10:03 -0700
From: Kurt Seifried <>
Subject: Re: speaking of DoS, openssh and dropbear (CVE-2006-1206)

On 01/02/2012 04:33 PM, Nico Golde wrote:
> Hi,
> * Kurt Seifried <> [2012-01-02 04:56]:
> [...] 
>> The rest of the solutions do not lend themselves to this problem or would 
>> require significant changes to the OpenSSH protocol/client/server which is a 
>> bad bad idea.
>> Anything we do to address this issue should be extremely simple and 
>> conservative, the OpenSSH server and client are very stable and robust 
>> pieces of code, any modifications to them make me nervous. 
>> I suspect the simplest and more effective solution might be some form of 
>> progressive timeout for IP's that fail to authenticate (drop the connection 
>> entry silently and ignore them in favor of real clients). 
>> Long term I'd like to see more work on hash cash type solutions, being able 
>> to arbitrarily set or have a reactive system that requires increased work on 
>> the client end to prove they are a legitimate client would help with this 
>> whole DoS/DDoS class of problem to some degree.
> See above, it would be really nice to see if there is a project which already 
> does that. has implementations in multiple languages (including a bash
script), it uses partial SHA-1 collisions, so easy to do for server, not
sure if you can increase/decrease workload on the fly incrementally
(i.e. require 16, 17, 18 bit partial matches if the server starts
getting loaded).

> Kind regards
> Nico

-- Kurt Seifried / Red Hat Security Response Team

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.