Re: Anti-keylogger for SSH?

From: Kalin KOZHUHAROV (kalin_at_ThinRope.net)
Date: 05/14/03 

Date: Thu, 15 May 2003 01:31:11 +0900

Joe Harrison wrote:
> "Simon Tatham" <anakin@pobox.com> wrote in message
> news:FT*rRiSp@news.chiark.greenend.org.uk...
>
>>However, be warned that your threat model hasn't covered all cases.
>>A subtly compromised computer might not just be _reading_ what you
>>do; it could feed fake keystrokes to your SSH client and _send_
>>commands to your server, which might in principle establish a back
>>door that the attacker could later use to gain access.."
>
>
> Now *that's* devious, I hadn't even considered that. Maybe I should just
> give up on the whole idea as too dangerous. Thanks for advice anyway though.

Just an example hardware keylogger, $89:

http://www.keyghost.com/

Kalin. 

-- 
/|\^^^^^^^^^^^^^^^^^^^^^^/|\
|O| http://ThinRope.net/ |O|
\|/______________________\|/

Relevant Pages

  • Re: Anti-keylogger for SSH?
    ... > commands to your server, which might in principle establish a back ... > door that the attacker could later use to gain access.." ...
    (comp.security.ssh)
  • RE: RPc server is unavailable since SP1
    ... After these commands run successfully, ... RPc server is unavailable since SP1 ... >> when the member server update certificate you get the error message RPC ... >> interface security settings before the installation of SP1 will be lost. ...
    (microsoft.public.windows.server.sbs)
  • [NT] NetWin DMail Authentication Bypass (dlist.exe) and Format String (dsmtp.exe)
    ... either be used as a small personal mail server or as a 10 Million user ISP ... password hash) when sending the administrative commands. ... the DList server using a numeric hash of the administrative password. ...
    (Securiteam)
  • [NEWS] Netscape Publishing wp-force-auth Command
    ... Remote attackers can easily use the wp-force-auth command to perform brute ... connection with a directory server, which has valid users and passwords. ... Netscape Enterprise has a selection of ?wp-* (Web publishing) commands ...
    (Securiteam)
  • RE: copy permissions from one user to another?
    ... THIS STORED PROCEDURE GENERATES COMMANDS ... -- ADD USER TO SERVER ... -- CREATE TABLE TO HOLD LIST OF USERS IN CURRENT DATABASE ... -- SET COMMAND TO FIND USER PERMISSIONS HAS IN CURRENT DATABASE ...
    (microsoft.public.sqlserver.security)