A claim of a software vulnerability in a program used to connect securely to servers across the Internet is likely a hoax, according to an analyst with the SANS Internet Storm Center.
The program, called OpenSSH (Secure Shell), is installed on tens of millions of servers made by vendors such as Red Hat, Hewlett-Packard, Apple and IBM. It is used by administrators to make encrypted connections with other computers and do tasks such as remotely updating files. OpenSSH is the open-source version, and there are commercial versions of the program.
Earlier this week, SANS received an anonymous e-mail claiming of a zero-day vulnerability in OpenSSH, which means a flaw in the software is already being exploited as it becomes public. It’s the most dangerous type of software vulnerability since it means there’s no fix for it yet and the bad guys know about it.
A true zero-day vulnerability in OpenSSH could be devastating for the Internet, allowing hackers to have carte blanche access to servers and PCs until a workaround or a patch is readied.
“That’s why I think people are actually creating quite a bit of a panic,” said Bojan Zdrnja, a SANS analyst and senior information security consultant at Infigo, a security and penetration testing company in Zagreb, Croatia. “People should not panic right now. Nothing at this time points that there is an exploit being used in the wild.”
The evidence of a true zero-day vulnerability in OpenSSH is weak, Zdrnja said. So far, analysts haven’t seen a working exploit, despite worries that a group called Anti-Sec may have found a zero-day that allowed them to control a Web server. Details on the hack were posted on Full Disclosure, which is an unmoderated forum for security information.
When pressed for more details, a person claiming to be part of Anti-Sec wrote an e-mail to IDG News Service saying “I’m not allowed to actually discuss the exploit (or whether or not it exists),” which was signed “Anonymous.”
Zdrnja said the same group compromised another server recently, but it appeared to be a brute-force attack against OpenSSH. A brute-force attack is where a hacker tries many combinations of authentication credentials in order to get access to a server. If an administrator is using is using simple log-ins and passwords, it makes a server more vulnerable to a brute-force attack, Zdrnja said.
Both of the compromised servers were run by the same person. “I suppose what we are dealing with here are two hackers in a war between themselves,” Zdrnja said.
But there are other factors that indicate a zero-day for OpenSSH doesn’t exist. If the zero-day existed, hackers would probably be more likely to use it against a more high-profile server than the most recent one that was compromised, Zdrnja said.
One of OpenSSH’s developers, Damien Miller, also threw cold water on the possibility of a zero-day. Miller wrote on an OpenSSH forum on Wednesday that he exchanged e-mails with an alleged victim of the zero-day, but the attacks appeared to be “simple brute-force.”
“So, I’m not persuaded that a zero-day exists at all,” Miller wrote. “The only evidence so far are some anonymous rumors and unverifiable intrusion transcripts.”
There also seems to be some confusion between the alleged zero-day and a different vulnerability in OpenSSH, Zdrnja said. That vulnerability, which is as of yet unpatched, could allow an attacker to recover up to 32 bits of plain text from an arbitrary block of ciphertext from a connection secured using the SSH protocol in the standard configuration, according to an advisory from the U.K.’s Center for the Protection of National Infrastructure (CPNI).
The severity of the vulnerability is considered high, but the chance of successful exploitation is low, according to CPNI. Zdrnja said administrators can implement stronger authentication mechanisms in OpenSSH using public and private keys to guard against a successful attack. In an advisory, OpenSSH also stated that the possibility of a successful attack was low.