Abstract:The SSH protocol provides secure access to network services, particularly remote terminal login and file transfer within organizational networks and to over 15 million servers on the open internet. SSH uses an authenticated key exchange to establish a secure channel between a client and a server, which protects the confidentiality and integrity of messages sent in either direction. The secure channel prevents message manipulation, replay, insertion, deletion, and reordering. At the network level, SSH uses the Binary Packet Protocol over TCP. In this paper, we show that the SSH Binary Packet Protocol is no longer a secure channel: SSH channel integrity (INT-PST, aINT-PTXT, and INT-sfCTF) is broken for three widely used encryption modes. This allows prefix truncation attacks where encrypted packets at the beginning of the SSH channel can be deleted without the client or server noticing it. We demonstrate several real-world applications of this attack. We show that we can fully break SSH extension negotiation (RFC 8308), such that an attacker can downgrade the public key algorithms for user authentication or turn off a new countermeasure against keystroke timing attacks introduced in OpenSSH 9.5. Further, we identify an implementation flaw in AsyncSSH that, together with prefix truncation, allows an attacker to redirect the victim's login into a shell controlled by the attacker. We also performed an internet-wide scan and found that 71.6% of SSH servers support a vulnerable encryption mode, while 63.2% even list it as their preferred choice. We identify two root causes that enable these attacks: First, the SSH handshake supports optional messages that are not authenticated. Second, SSH does not reset message sequence numbers when activating encryption keys. Based on this analysis, we propose effective and backward-compatible changes to SSH that mitigate our attacks.

Decrypting live SSH traffic in virtual environments

Discovering Encrypted Bot and Ransomware Payloads Through Memory Inspection Without A Priori Knowledge

Decrypting SSL/TLS traffic for hidden threats detection

SmartKex: Machine Learning Assisted SSH Keys Extraction From The Heap Dump

Extracting Secrets from Encrypted Virtual Machines

An Approach for Secure-Communication Between XEN Virtual Machines

Distributed Shielded Execution for Transmissible Cyber Threats Analysis

Secure (S)Hell: Introducing an SSH Deception Proxy Framework

A Lightweight Live Memory Forensic Approach Based on Hardware Virtualization.

Violence Cracking Technology of SSH Service Based on Kali-Linux

Detection and analysis of eavesdropping in anonymous communication networks

SEVered: Subverting AMD's Virtual Machine Encryption

Evaluation of Live Forensic Techniques in Ransomware Attack Mitigation

Terrapin Attack: Breaking SSH Channel Integrity By Sequence Number Manipulation

USBcat - Towards an Intrusion Surveillance Toolset

SSL-DP: A Rootkit of Network Based SSL and TLS Traffic Decryptor

Predicting SSH keys in Open SSH Memory dumps

Encrypted Malicious Traffic Detection Based on Word2Vec

Privacy Aware Memory Forensics

MeMoir: A Software-Driven Covert Channel based on Memory Usage

Robust Machine Learning for Encrypted Traffic Classification