<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; =
-webkit-line-break: after-white-space; "><div>So it gets a little =
scarrier:</div><div><br></div><div><div style="margin-top: 0px; =
margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal =
normal normal 12px/normal Helvetica; "><a =
href="http://metasploit.com/users/hdm/tools/debian-openssl/">http://meta=
sploit.com/users/hdm/tools/debian-openssl/</a></div><div =
style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; =
margin-left: 0px; font: normal normal normal 12px/normal Helvetica; =
"><br></div></div><div><br></div><div>"This will generate a new OpenSSH =
1024-bit DSA key with the value of getpid() always returning the number =
"1". We now have our first pre-generated SSH key. If we continue this =
process for all PIDs up to 32,767 and then repeat it for 2048-bit RSA =
keys, we have covered the valid key ranges for x86 systems running the =
buggy version of the OpenSSL library. With this key set, we can =
compromise any user account that has a vulnerable key listed in the =
authorized_keys file. This key set is also useful for decrypting a =
previously-captured SSH session, if the SSH server was using a =
vulnerable host key. </div><div><br></div><div><div =
style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; =
margin-left: 0px; font: normal normal normal 12px/normal Helvetica; =
"><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; =
margin-left: 0px; font: normal normal normal 12px/normal Helvetica; ">In =
the near future, this site will be updated to include a brute force tool =
that can be used quickly gain access to any SSH account that allows =
public key authentication using a vulnerable key.</div><div =
style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; =
margin-left: 0px; font: normal normal normal 12px/normal Helvetica; =
"><br></div><div style="margin-top: 0px; margin-right: 0px; =
margin-bottom: 0px; margin-left: 0px; font: normal normal normal =
12px/normal Helvetica; "><br></div><div style="margin-top: 0px; =
margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal =
normal normal 12px/normal Helvetica; ">Fun - now I will have more crap =
to look at in my /var/log/secure and an increase of ssh attacks =
:)</div></div></div><div><br></div><div><br></div><div><br></div><br><div>=
<div>On May 14, 2008, at 8:40 PM, Dave Bergert wrote:</div><br =
class="Apple-interchange-newline"><blockquote type="cite"><div =
style="word-wrap: break-word; -webkit-nbsp-mode: space; =
-webkit-line-break: after-white-space; "><div>Speaking of Linux Security =
...</div><div><br></div><div>Has anyone see this:</div><div><div =
style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; =
margin-left: 0px; font: normal normal normal 12px/normal Helvetica; "><a =
href="http://isc.sans.org/diary.html?storyid=4414">http://isc.sans.org=
/diary.html?storyid=4414</a></div><div style="margin-top: 0px; =
margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal =
normal normal 12px/normal Helvetica; ">'</div><div style="margin-top: =
0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: =
normal normal normal 12px/normal Helvetica; "><div style="margin-top: =
0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: =
normal normal normal 12px/normal Helvetica; ">OpenSSH: Predictable PRNG =
in debian and ubuntu Linux</div><div style="margin-top: 0px; =
margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal =
normal normal 12px/normal Helvetica; "><br></div><div style="margin-top:=
0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: =
normal normal normal 12px/normal Helvetica; ">Any comments or thoughts =
?</div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: =
0px; margin-left: 0px; font: normal normal normal 12px/normal Helvetica; =
"><br></div><div style="margin-top: 0px; margin-right: 0px; =
margin-bottom: 0px; margin-left: 0px; font: normal normal normal =
12px/normal Helvetica; =
"><br></div></div></div><div><br></div><br><div><div>On May 14, 2008, at =
5:43 PM, Arron Lorenz wrote:</div><br =
class="Apple-interchange-newline"><blockquote type="cite">I =
accedently clicked a link I shouldn't have now I may have a virus.... =
<br><br>I took a screen shot: <a =
href="http://www.davenportdrivein.com/images/Screenshot.png">http://www.=
davenportdrivein.com/images/Screenshot.png</a><br> <br>What do you guys =
think I should do?<a href="mailto:qclug@qclug.org"><span =
class="nfakPe"></span><span class="nfakPe"></span></a><br =
clear="all"><br>Regards,<br>Arron<br><br>-- <br>From:<br>Arron James =
Lorenz<br>Reel to Reel Drive In<br> <a =
href="http://www.DavenportDriveIn.com">http://www.DavenportDriveIn.com</=
a><br>563-579-7046</blockquote></div><br><div =
apple-content-edited="true"> <span class="Apple-style-span" =
style="border-collapse: separate; color: rgb(0, 0, 0); font-family: =
Helvetica; font-size: 12px; font-style: normal; font-variant: normal; =
font-weight: normal; letter-spacing: normal; line-height: normal; =
orphans: 2; text-align: auto; text-indent: 0px; text-transform: none; =
white-space: normal; widows: 2; word-spacing: 0px; =
-webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: =
0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: =
auto; -webkit-text-stroke-width: 0; "><div style="word-wrap: =
break-word; -webkit-nbsp-mode: space; -webkit-line-break: =
after-white-space; "><div>Dave Bergert</div><div><a =
href="mailto:dbergert@gmail.com">dbergert@gmail.com</a></div><div><br =
class="webkit-block-placeholder"></div></div></span><br =
class="Apple-interchange-newline"> =
</div><br></div></blockquote></div><br><div apple-content-edited="true">=
<span class="Apple-style-span" style="border-collapse: separate; =
color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; =
font-style: normal; font-variant: normal; font-weight: normal; =
letter-spacing: normal; line-height: normal; orphans: 2; text-align: =
auto; text-indent: 0px; text-transform: none; white-space: normal; =
widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; =
-webkit-border-vertical-spacing: 0px; =
-webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: =
auto; -webkit-text-stroke-width: 0; "><div style="word-wrap: =
break-word; -webkit-nbsp-mode: space; -webkit-line-break: =
after-white-space; "><div>Dave Bergert</div><div><a =
href="mailto:dbergert@gmail.com">dbergert@gmail.com</a></div><div><br =
class="webkit-block-placeholder"></div></div></span><br =
class="Apple-interchange-newline"> </div><br></body></html>=