Hacker News Reader

Comment by ipsin | Hacker News Reader

The technique of using gdb to attach to ssh is pretty old.

Here's an example from 2005, which was presented (iirc) at Defcon as well: http://www.blackhat.com/presentations/bh-usa-05/bh-us-05-boi...

In that case, SSH-Jack would just piggyback on existing (user-level) ssh connections, which is also pretty serious, though that's not as exciting as stealing keys.

View on HN

Yep. The general technique of scraping memory for private keys and certificates a pretty well-known and established. Particularly in forensics and malware circles.

I don't point it out to engage in the "who was first" thing. But to point out that this is very much an applied attack in the real world. Real attackers (includes "forensics analysts", incase you don't consider them "attackers" too) have been using this technique in malware as well as countermeasures/investigations for quite a while, now.

See: http://www.trapkit.de/research/sslkeyfinder/

https://github.com/emonti/yara-ruby/blob/master/samples/sslk...

http://volatility-labs.blogspot.com/2013/05/movp-ii-21-rsa-p...

EDIT: actually a much earlier discussion is from '98 by none other than Shamir

https://www.cs.jhu.edu/~astubble/600.412/s-c-papers/keys2.pd... [PDF]

personally i find it more exciting than steal the key because harder :)

then again this as been done since the beginning of times sadly, or excitingly, i dont know :)

any tool that promotes awareness of this inherent issue is good anyway IMO

Reply on news.ycombinator.com