Re: [Imap-protocol] SSL compression attack and IMAP
Joshua Cranmer <[email protected]>
| Newsgroups | gmane.mail.imap.general |
|---|---|
| Message-ID | <[email protected]> |
On 9/30/2012 7:57 AM, Timo Sirainen wrote: > I don't think IMAP protocol is very vulnerable. The vulnerable part of IMAP is the password string, but clients always use the same commands before logging in. After login the only way for attacker to affect the output is by sending emails that the client downloads. So, I guess if: > > 1) Attacker finds out which IMAP client is being used. > > 2) Attacker finds out how to send emails there, and what exactly they look like (the Received headers etc.) > > 3) Keeps tracking when IMAP client is connecting to server, possibly even forces streams to disconnect to make this faster. > > 4) Whenever client logs in, send a special mail that tries to crack the password. > > That's pretty difficult to do reliably and assumes that clients immediately download new mails. You also need to depend heavily on the authentication method used. A regular LOGIN or an AUTHENTICATE PLAIN is more vulnerable to this than NTLM, CRAM-MD5, or GSSAPI, particularly since the latter contain nonce strings that make the utility of the discovered result much less useful. -- Beware of bugs in the above code; I have only proved it correct, not tried it. -- Donald E. Knuth _______________________________________________ Imap-protocol mailing list [email protected] http://mailman2.u.washington.edu/mailman/listinfo/imap-protocol