vulnerability with ssh-agent

[Gert Doering]

Hi,

On Sat, Jul 17, 2004 at 10:54:57PM +0200, Keld J?rn Simonsen wrote:
> I would like to avoid typing passwords and keys, not just because it is
> cumbersome, but because it is unsafe. That is, if my system is
> compromised, most rootkits have a keylogger, and then I am sold.

If your laptop is compromised, *anything* you do to log into your server
can be compromised as well.  A root user on your laptop could give you
a trojaned ssh client, which will execute additional commands on the
server after you login, for example...

...or just takeover your client tty after you have logged in, not requiring
any ssh client modification...

There are myriads of ways to compromise whichever machine you go to if you
start from a compromised host.

gert
-- 
USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             gert at greenie.muc.de
fax: +49-89-35655025                        gert at net.informatik.tu-muenchen.de