Thus spake NetExpress (netexpress@tiscali.it) [16/05/03 16:42]: > Product bsbsdftpd-6.0-ssl-0.6.1-1 http://bsdftpd-ssl.sc.ru/ > > During a pen-test we have notice how is easy to identify valid users on > vulnerable systems, through a simple timing attack. > > When I try to connect to ftp without ssl using a unreal user with bad > password I get > immediatly response of incorrect login, when I use real user with bad > password I get 2 second of wait before get message of incorrect login. > > It seems to be very nice to the recent CAN-2003-0190 about OpenSSH/PAM > timing attack allows remote users identification > > I have tested this on Linux RH 7.3 and RH 8.0 I just tried this out on a FreeBSD system (4.8-RC x2), and I get the same response time. Are you sure this is directly related to the ftp daemon, or is it a PAM issue?
Attachment:
pgp00357.pgp
Description: PGP signature
