Home page logo

oss-sec logo oss-sec mailing list archives

Re: /dev/ptmx timing
From: adam swanda <adam () zeroharbor org>
Date: Mon, 7 Jan 2013 20:11:11 -0500

Don't you need to be running as root for this to be possible? For example,
I know you can use strace to capture keystroke "writes" for any given PID,
but unless you want to capture only processes you are running you need to
be root or use sudo strace <cmd>.

It looks like your PoCs fall into the same category. Following that same
logic, if a user has root access, what would they gain by sniffing password
character length? Since they can view hashes, change passwords, etc,
without this method.

I might be completely wrong here but I personally wouldn't classify this as
a security issue. Just putting in my own opinion, of course, as a casual
reader of this list.
On Jan 7, 2013 5:24 PM, "vladz" <vladz () devzero fr> wrote:

Hi list,

I noticed that it was possible to measure inter-keystrokes timing thanks
to the /dev/ptmx character device.  Any local user that is using
pseudo-terminal can be targeted.

As it may also be used to disclose sensible information such as password
length, I was wondering if it should be treat as a security issue?

Description + PoC: http://vladz.devzero.fr/013_ptmx-timing.php.

No sure right now but I think the only way to solve this is to modify
the pts handling at kernel level.  Any opinions on that?


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]