Problems in Validation (cont.)


Example: unnamed certs and monkey-in-the-middle

Using sshmitm (from the dsniff suite) with arbitrary server certs, I have successfully captured the SSH logins of users who blissfully ignored the following message:

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ 
@ WARNING: HOST IDENTIFICATION HAS CHANGED! @ 
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ 
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY! 
Someone could be eavesdropping on you right now (man-in-the-middle attack)! 
It is also possible that the host key has just been changed. 
Please contact your system administrator. 
Add correct host key in ~/.ssh/known_hosts to get rid of this message. 
Agent forwarding is disabled to avoid attacks by corrupted servers. 
X11 forwarding is disabled to avoid attacks by corrupted servers. 
Are you sure you want to continue connecting (yes/no)? yes


and some from Windows users whose SSH clients didn't report anything quite so dramatic...