1

There was one person I met in blackhat mentioned that SSH login failure can be seen at packet level because the SSH protocol will indicate whether login is a success or failure.

I think the login process is considered as normal data by ssh protocol and hence it's transparent to ssh protocol itself. There is no indication in the packets whether ssh login is successful or not.

Can anyone confirm this?

Thanks.

packetie
  • 249
  • 1
  • 8

1 Answers1

1

Before the password is sent, an encryption layer is added to the connection.

Also the encryption fingerprint is compared to the last time you signed in successfully. If there is an MITM inserting its own encryption layer then you will be alerted of the changed fingerprint. (assuming you have not already accepted the incorrect fingerprint by accident)

While the password, and the response from the server cannot be seen directly, it is likely that you can tell by the packet size and timing, and how long until the connection was closed, whether the login attempt was successful.

For example, this would be a single chunk of data with a predictable size.

Invalid username/password, please try again.

On the other hand, a successful login is several lines

Welcome! It's a great day at XYZ server!
Your last login was yesterday at

And depending on your server, there may be a delay between lines, which is sent in separate TCP packets as it comes in.

You have new mail.
you@xyz:~$

So yes, you can tell by monitoring packet size/count/timing whether the sign-in was successful. You cannot tell what password was attempted or exactly wad data was transferred.

700 Software
  • 13,897
  • 3
  • 53
  • 82
  • Very good point about detecting login failure by packet size or timing. I guess you are implying the login failure is not shown in the ssh protocol itself which is what I think. On the detection by packet size, it's possible but a little hard since it's hard to predict the string from server on login failure or success (different servers have different configurations). Do you happen to have a link to an blog or article on this? – packetie Aug 06 '16 at 16:01
  • I do not have a link. I heard of a group in passing, where they tried to implement advanced packet timing analytics. – 700 Software Aug 06 '16 at 16:16
  • It's easier to predict the string from the server on failure. (just try it and see what happens) It's harder to predict the string on success unless you have some live credentials to play with. – 700 Software Aug 06 '16 at 16:17
  • Sounds good. Thx. – packetie Aug 06 '16 at 17:31