> -----Original Message----- > From: Michal Zalewski [mailto:lcamtufat_private] > Sent: Thursday, August 14, 2003 6:04 PM > To: vulnwatchat_private; bugtraqat_private > Cc: full-disclosureat_private > Subject: [Full-Disclosure] unix entropy source can be used > for keystroke timing attacks > > Another bizarre vulnerability, for your amusement... > Indeed. Where do you come up with this stuff? > Several unix systems systems provide a secure entropy source > maintained by collecting certain information that is supposed > to be practically unpredictable (such as interrupt timings, > keyboard scancodes or device request times), then running it > thru one-way hashing function (SHA1 or MD5). > > A device called /dev/random estimates the amount of entropy > available in the entropy pool, and blocks on read when the > pool gets empty. This continues until the buffer is seeded > with some new data due to one of the events mentioned. When I read this, I immediately thought of some work that I did back in the 60's. Without giving too much away, it is possible to monitor sound patterns in such a way that you can *uniquely* identify moving objects. (Think of looking for unique "noise" frequencies in the full spectrum of random noise, such as the sound of a motor.) The corollary is that you could uniquely monitor /dev/random access to do the same thing. All you need is something that records all the "traffic" and then analyzes it for patterns. Controlled research would identify what each pattern signified, and within a reasonable amount of time you might even be able to identify machine operators simply by the pattern of their keystrokes. From there, capturing *what* their typing is a matter of relative ease. Very interesting indeed. Paul Schmehl (paulsat_private) Adjunct Information Security Officer The University of Texas at Dallas AVIEN Founding Member http://www.utdallas.edu/~pauls/ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
This archive was generated by hypermail 2b30 : Thu Aug 14 2003 - 23:50:53 PDT