Arch Linux

skottish

Forum Fellow

From: Here

Registered: 2006-06-16

Posts: 7,942

[SOLVED] openssl: REMOTE HOST IDENTIFICATION HAS CHANGED! Hacked?

There's a bit of Windowsisms in here, but one of the main questions is about openssl. As well, this post could help others regardless of the OS involved.

I remote into a Windows 7 workstation at my work using xfreerdp going through Server 2008 R2. RDP is closed at the firewall to all but two IP addresses and neither of those uses port 3389. I'm connecting through NTLM for authentication then the connection is encrypted using TLS. FreeRDP uses openssl to handle SSL/TLS connections.

Last week I remoted in my workstation first thing in the morning as I always do with no problems. I went to work that day and everything was normal. Later that night I went to remote in again and I got the "WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!" message. I followed the advice in the message and contacted the system admin:

skottish, were there any major changes in the system that could cause the RSA fingerprint to change?

I don't think so skottish. There were no changes made to the system beyond a simple update to the server's spam filters.

There was nothing major that changed on the server and I wasn't anywhere in the system that could have forced a change. The only server-side work that I did was with some accounts in Active Directory and updated Exchange's spam filters.

The way that I see it, and I may be missing something, is that there are four possibilities:

1) A MITM attack. If this is the case then it was successful and I haven't tracked it down yet

2) Someone accidentally changed something in the server

3) Someone intentionally changed something in the server

4) The server made it's own changes (which sadly wouldn't be out of character for a MS server)

We do have an outside partner that has server access, but they told me that they weren't in there and I see no evidence to the contrary.

My first question is am I missing any other possibilities?

The second is how does openssl generate the RSA fingerprint of a computer? I've read many, many pages and so far I'm not finding any answers. If I could verify the fingerprint manually, that would help.

The third is that if it is a MITM attack, what are the appropriate steps to identify it? I went through all of the ARP tables on the server and the workstation looking to see if anything is out of line and everything looks fine. I could run a capture off of our firewall and see if there's anything there, but I don't know Wireshark all that well, so I'm not sure what I would be looking for exactly.

Thoughts?

Last edited by skottish (2012-09-22 03:10:22)

litemotiv

Forum Fellow

Registered: 2008-08-01

Posts: 5,026

Re: [SOLVED] openssl: REMOTE HOST IDENTIFICATION HAS CHANGED! Hacked?

Something like this happened to me before and it was caused by an unforeseen clock/time change, is that somehow possible in your case?

Last edited by litemotiv (2012-09-09 17:56:21)

---

ᶘ ᵒᴥᵒᶅ

skottish

Forum Fellow

From: Here

Registered: 2006-06-16

Posts: 7,942

Re: [SOLVED] openssl: REMOTE HOST IDENTIFICATION HAS CHANGED! Hacked?

Something like this happened to me before and it was caused by an unforeseen clock/time change, is that somehow possible in your case?

Well, there was a clock change on my end that same day. For some reason openntpd was running about two minutes behind and it had been since I migrated to systemd. I switched to ntpd in order to correct it. I can't imagine why a change on the client side would make a difference though. But, I'm open to the possibility.

--EDIT--

I tried some experiments with openntpd, ntp, and changing clocks and such, but I couldn't trigger the error. I'm still open to the possibility though.

-- RESOLUTION EDIT --

It's not worth bumping this thread over the resolution of this, but someone may be interested in what happened for their own reference later.

I realized that I was looking in the wrong direction and discovered that Windows automatically changed security keys for reasons that I don't understand yet. openssl did it's job perfectly. There was a force that wasn't the system administrator that made changes to the security of the system on a machine that hadn't changed physically. Is it possible that there has been an attack still? Yes, it's just much more unlikely now.

Last edited by skottish (2012-09-22 03:25:31)