Trick user to send private key password to compromised host
dan at nf15.lightwave.net.ru
Wed May 14 02:06:13 EST 2008
On Tue, 13 May 2008, Roman Fiedler wrote:
> Sorry, seems that my first statement was not precise. If I connect from
> my uncompromised local host A to some malicious host B, it could trick
> me to reenter the private key password so that it is captured on B. This
> would not be possible by installing an kestroke logger on B, only
> openssh "acts" as the "keystroke logger" in this case.
What the attacker can gain from discovering private key encryption password?
The private key itself is located on the host the ssh is invoked on, not on the
remote and probably compromised one.
Sincerely Your, Dan.
More information about the openssh-unix-dev