Zero-day OpenSSH vulnerability?

#1

Post by miracle » Mon, Jul 20, 2009, 3:05 PM UTC

Zero-day OpenSSH vulnerability?
lists.grok.org.uk

Re: Zero-day OpenSSH vulnerability?

#2

Post by st3fan » Mon, Jul 20, 2009, 3:29 PM UTC

People seem to agree that it is 'too good to be true' so that is must be a hoax. I'm still a little worried and I think it is good to have some IP based access lists ready when things become more clear in the coming days.

Re: Zero-day OpenSSH vulnerability?

#3

Post by ErrantX » Mon, Jul 20, 2009, 3:51 PM UTC

st3fan wrote: post #2

People seem to agree that it is 'too good to be true' so that is must be a hoax. I'm still a little worried and I think it is good to have some IP based access lists ready when things become more clear in the coming days.

yeh smells like a hoax to me too.

Re: Zero-day OpenSSH vulnerability?

#4

Post by JeremyChase » Mon, Jul 20, 2009, 3:51 PM UTC

ErrantX wrote: post #3

st3fan wrote: post #2

People seem to agree that it is 'too good to be true' so that is must be a hoax. I'm still a little worried and I think it is good to have some IP based access lists ready when things become more clear in the coming days.

yeh smells like a hoax to me too.

Flag it.

Re: Zero-day OpenSSH vulnerability?

#5

Post by ErrantX » Mon, Jul 20, 2009, 3:58 PM UTC

JeremyChase wrote: post #4

ErrantX wrote: post #3

Earlier quoted context omitted.

yeh smells like a hoax to me too.

Flag it.

It's still interesting (right?)

Re: Zero-day OpenSSH vulnerability?

#6

Post by kvs » Mon, Jul 20, 2009, 4:02 PM UTC

I wonder how the IT/security staff react to such information? In the sense, what do you do? how to be "ready" for this?

Re: Zero-day OpenSSH vulnerability?

#7

Post by JeremyChase » Mon, Jul 20, 2009, 4:03 PM UTC

ErrantX wrote: post #5

JeremyChase wrote: post #4

Earlier quoted context omitted.

Flag it.

It's still interesting (right?)

If they had any evidence it would be one thing, but this is just fear mongering.

Re: Zero-day OpenSSH vulnerability?

#8

Post by khafra » Mon, Jul 20, 2009, 4:03 PM UTC

Interesting that this group's manifesto of 10 days ago railed against full disclosure, and now they're employing an extreme example of it. Smells like something with more bark than bite, to me, but I guess I'll leave single packet authentication enabled on my box.

Re: Zero-day OpenSSH vulnerability?

#9

Post by mahmud » Mon, Jul 20, 2009, 4:06 PM UTC

st3fan wrote: post #2

People seem to agree that it is 'too good to be true' so that is must be a hoax. I'm still a little worried and I think it is good to have some IP based access lists ready when things become more clear in the coming days.

Not just a hoax, they're out to discredit anti-sec. Anti-sec doesn't use gmail, they always sign their posts, and they certainly do not issue warnings.

Anti-sec with a ssh 0-day would've tripped over itself rm'ing boxes left and right. It's like Bin Laden warning people he is in California and would be causing great mayhem, Real Soon Now.

Re: Zero-day OpenSSH vulnerability?

#10

Post by miracle » Mon, Jul 20, 2009, 4:08 PM UTC

mahmud wrote: post #9

st3fan wrote: post #2

People seem to agree that it is 'too good to be true' so that is must be a hoax. I'm still a little worried and I think it is good to have some IP based access lists ready when things become more clear in the coming days.

Not just a hoax, they're out to discredit anti-sec. Anti-sec doesn't use gmail, they always sign their posts, and they certainly do not issue warnings. Anti-sec with a ssh 0-day would've tripped over itself rm'ing boxes left and right. It's like Bin Laden warning people he is in California and would be causing great mayhem, Real Soon Now.

Anti-sec (with their real email address) could make a counter statement then?