Messages in this thread | | | From | David Wagner <> | Subject | Security: information leaks in /proc enable keystroke recovery | Date | Sat, 15 Aug 2009 15:21:27 -0700 (PDT) |
| |
At Usenix Security 2009, two researchers announced last week a new security vulnerability in multi-user Linux systems. They demonstrated that one user can, in many cases, recover partial information about the keystrokes that another user types into applications running on that system. For instance, they demonstrate how a malicious user can recover partial information about SSH passwords typed by other users, reducing the password search space by a factor of 250-2000x in their experiments. Thus, this could facilitate password recovery.
Question: Are there any plans to modify the Linux kernel to defend against this kind of attack?
The paper is here:
http://www.usenix.org/events/sec09/tech/full_papers/zhang.pdf
In a nutshell, they exploit the fact that many files in /proc are world-readable yet contain sensitive information that can leak information about inter-keystroke timings. For instance, /proc/$PID/stat reveals the ESP and EIP registers of the associated process, and is world-readable. /proc/pid/status is also mentioned as revealing information that could be exploited in these attacks.
Based on my understanding of their work, it sounds like some of the information on those files should perhaps not be world-readable. It's not clear to me that it's reasonable for the kernel to reveal ESP, EIP, and other sensitive information about process behavior to everyone on the same system.
Are folks already aware of these vulnerabilities? Is there any work underway to try to address the issues identified in the Usenix Security paper?
| |