Most SSH key extraction methods either use modified source code or tools like active Man-in-the-Middle proxies. Here, we present our method to extract SSH Encryption keys using features engineered from structures pointed to by pointers within the heap. The only additional information required in our method is a way to translate addresses contained by pointers present in the heap. We then create a machine-learning model to identify representative structures within the heap data allowing us direct access to the keys. Our proposed method retrieves the SSH Keys, lengths, and encryption algorithm while maintaining perfect precision and recall. Our method also has an execution time far less than comparable methods. We present our findings and studies including the minimum, maximum and average metrics on different sized subsets of the dataset.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

PointerKex: A Pointer-Based SSH Key Extraction Method

  • Christofer Fellicious,
  • Stewart Sentanoe,
  • Jelena Mitrović,
  • Hans P. Reiser,
  • Michael Granitzer

摘要

Most SSH key extraction methods either use modified source code or tools like active Man-in-the-Middle proxies. Here, we present our method to extract SSH Encryption keys using features engineered from structures pointed to by pointers within the heap. The only additional information required in our method is a way to translate addresses contained by pointers present in the heap. We then create a machine-learning model to identify representative structures within the heap data allowing us direct access to the keys. Our proposed method retrieves the SSH Keys, lengths, and encryption algorithm while maintaining perfect precision and recall. Our method also has an execution time far less than comparable methods. We present our findings and studies including the minimum, maximum and average metrics on different sized subsets of the dataset.