- Source: Terrapin attack
The Terrapin attack is a cryptographic attack on the commonly used SSH protocol that is used for secure command-and-control throughout the Internet. The Terrapin attack can reduce the security of SSH by using a downgrade attack via man-in-the-middle interception. The attack works by prefix truncation; the injection and deletion of messages during feature negotiation, manipulating sequence numbers in a way that causes other messages to be ignored without an error being detected by either client or server.
According to the attack's discoverers, the majority of SSH implementations were vulnerable at the time of the discovery of the attack (2023). As of January 3, 2024, an estimated 11 million publicly accessible SSH servers are still vulnerable. However, the risk is mitigated by the requirement to intercept a genuine SSH session, and that the attack can only delete messages at the start of a negotiation, fortuitously resulting mostly in failed connections. Additionally the attack requires the use of either ChaCha20-Poly1305 or a CBC cipher in combination with Encrypt-then-MAC modes of encryption. The SSH developers have stated that the major impact of the attack is the capability to degrade the keystroke timing obfuscation features of SSH.
The designers of SSH have implemented a fix for the Terrapin attack, but the fix is only fully effective when both client and server implementations have been upgraded to support it. The researchers who discovered the attack have also created a vulnerability scanner to determine whether an SSH server or client is vulnerable.
The attack has been given the CVE ID CVE-2023-48795. In addition to the main attack, two other vulnerabilities were found in AsyncSSH, and assigned the CVE IDs CVE-2023-46445 and CVE-2023-46446.
References
External links
Official website
Classic mitm on ssh vs. Terrapin-Attack: packet handling comparison
Kata Kunci Pencarian:
- Terrapin attack
- Terrapin (disambiguation)
- Secure Shell
- Man-in-the-middle attack
- ChaCha20-Poly1305
- Terrapin (amphibious vehicle)
- Gordon Prange
- List of security hacking incidents
- List of Maryland Terrapins starting quarterbacks
- HMS Terrapin
