Feeds

SSH sniffer attack poses minor risk

Shadow of a doubt

Security for virtualized datacentres

UK security researchers have discovered hard-to-exploit cryptographic weaknesses in the Secure Shell (SSH) remote administration protocol.

The shortcoming creates a potential means to recover the plain text of encrypted sessions, depending on remote access configurations. Potential attacks - which would take ninja-like hacking skills to pull off - would involve inducing and observing error conditions. It's much more likely that a potential attack would crash a conversation than yield useful results.

Switching the mode of SSH links from block-cipher (CBC) to stream cipher modes would thwart any potential attack, which is confirmed to affect OpenSSH. Commercial versions of SSH are also affected, to an even more modest extent. SSH Communications Security has released an advisory urging users to update its SSH Tectia clients and server software. In the case of SSH Communications, four bits of plain text might be recovered by eavesdropping on conversations on vulnerable systems compared to 32 bits or, more realistically, 14 bits from an arbitrary block of ciphertext on OpenSSH systems.

The cryptographic shortcoming was discovered by researchers at the Information Security Group at Royal Holloway, University of London. More details on the flaw can be found in an advisory from the Centre for the Protection of National Infrastructure (CPNI) here. ®

Secure remote control for conventional and virtual desktops

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Win a year’s supply of chocolate
There is no techie angle to this competition so we're not going to pretend there is, but everyone loves chocolate so who cares.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.