Timing Analysis of Keystrokes and Timing Attacks on SSH

SSH is designed to provide a secure channel between two hosts. Despite the encryption and authentication mechanisms it uses, SSH has two weakness: First, the transmitted packets are padded only to an eight-byte boundary (if a block cipher is in use), which reveals the approximate size of the original data. Second, in inter-active mode, every individual keystroke that a user types is sent to the remote machine in a separate IP packet im-mediately after the key is pressed, which leaks the inter-keystroke timing information of users ’ typing. In this paper, we show how these seemingly minor weaknesses result in serious security risks. First we show that even very simple statistical tech-niques suffice to reveal sensitive information such as the length of users ’ passwords or even root passwords. More importantly, we further show that by using more ad-vanced statistical techniques on timing information col-lected from the network, the eavesdropper can learn sig-nificant information about what users type in SSH ses-sions. In particular, we perform a statistical study of users ’ typing patterns and show that these patterns re-veal information about the keys typed. By developing a Hidden Markov Model and our key sequence prediction algorithm, we can predict key sequences from the inter-keystroke timings. We further develop an attacker sys-tem, Herbivore, which tries to learn users ’ passwords by monitoring SSH sessions. By collecting timing informa-tion on the network, Herbivore can speed up exhaustive search for passwords by a factor of 50. We also propose some countermeasures. In general our results apply not only to SSH, but also to a general class of protocols for encrypting interactive traffic. We show that timing leaks open a new set of security risks, and hence caution must be taken when designing this type of protocol