> The problem is that this is all after authenticating the user, so > anyone could have anyones data, even if it needs one time passwords, > and so on. > > The only hope to avoid this is just hoping that's a too small chance to > get to the server before the attacker, since there is a time window, > and the port number is also a secret. (Un)fortunately, there are only > 65536 ports, and many servers schedule port numbers sequentially. Now, > one only needs to be so lucky to race someone with a passive > connection. There's another way, set forth in RFC-2228. Versions of the client and server for UNIX exist and are shipped with the Kerberos source tree. Additionally, I am working on putting the appropriate support (for GSSAPI) into wu-ftpd. Using these extensions, the data can be transfered encrypted; the attack is then reduced to a denial of service attack, as the receiver can't do anything with the data he obtained. -- Kevin L. Mitchell klmitchat_private ------------------------- -. .---- --.. ..- -..- ------------------------- MIT Kerberos Development Team Work: (617) 253-9483 http://web.mit.edu/klmitch/www/ PGP keys available upon request
This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 13:35:34 PDT