Terrapin attack
The Terrapin attack is a cryptographic attack on the commonly used SSH protocol that is used for secure command-and-control throughout the Internet. The Terrapin attack can reduce the security of SSH by using a downgrade attack via man-in-the-middle interception.[1][2][3] The attack works by prefix truncation; the injection and deletion of messages during feature negotiation, manipulating sequence numbers in a way that causes other messages to be ignored without an error being detected by either client or server.[4]
According to the attack's discoverers, the majority of SSH implementations were vulnerable at the time of the discovery of the attack (2023).[4] As of January 3rd, 2024, an estimated 11 million publicly accessible SSH servers are still vulnerable.[5] However, the risk is mitigated by the requirement to intercept a genuine SSH session, and that the attack can only delete messages at the start of a negotiation, fortuitously resulting mostly in failed connections.[4][6] Additionally the attack requires the use of either ChaCha20-Poly1305 or a CBC cipher in combination with Encrypt-then-MAC modes of encryption.[7] The SSH developers have stated that the major impact of the attack is the capability to degrade the keystroke timing obfuscation features of SSH.[6]
The designers of SSH have implemented a fix for the Terrapin attack, but the fix is only fully effective when both client and server implementations have been upgraded to support it.[1] The researchers who discovered the attack have also created a vulnerability scanner to determine whether an SSH server or client is vulnerable.[8]
The attack has been given the CVE ID CVE-2023-48795[9].[3] In addition to the main attack, two other vulnerabilities were found in AsyncSSH, and assigned the CVE IDs CVE-2023-46445 and CVE-2023-46446.[3]
References
- ↑ 1.0 1.1 Goodin, Dan (2023-12-19). "SSH protects the world’s most sensitive networks. It just got a lot weaker" (in en-us). https://arstechnica.com/security/2023/12/hackers-can-break-ssh-channel-integrity-using-novel-data-corruption-attack/.
- ↑ Bäumer, Fabian; Brinkmann, Marcus; Schwenk, Jörg (2023-12-19), Terrapin Attack: Breaking SSH Channel Integrity By Sequence Number Manipulation, http://arxiv.org/abs/2312.12422, retrieved 2023-12-20
- ↑ 3.0 3.1 3.2 "Terrapin attacks can downgrade security of OpenSSH connections" (in en-us). https://www.bleepingcomputer.com/news/security/terrapin-attacks-can-downgrade-security-of-openssh-connections/.
- ↑ 4.0 4.1 4.2 Jones, Connor. "SSH shaken, not stirred by Terrapin downgrade vulnerability" (in en). https://www.theregister.com/2023/12/20/terrapin_attack_ssh/.
- ↑ "Nearly 11 million SSH servers vulnerable to new Terrapin attacks" (in en-us). https://www.bleepingcomputer.com/news/security/nearly-11-million-ssh-servers-vulnerable-to-new-terrapin-attacks/.
- ↑ 6.0 6.1 "OpenSSH 9.6 release notes". 2023-12-18. https://www.openssh.com/txt/release-9.6.
- ↑ "Terrapin Attack". https://terrapin-attack.com/.
- ↑ "Release v1.1.0 · RUB-NDS/Terrapin-Scanner" (in en). https://github.com/RUB-NDS/Terrapin-Scanner/releases/tag/v1.1.0.
- ↑ "CVE-2023-48795" (in en). https://www.cve.org/CVERecord?id=CVE-2023-48795.
External links
 |  |
