Interpreting “a previously-unrecognized weakness in X was just found” as “X just got weaker” is dangerously bad tech writing.
Even the researcher who reported this doesn’t go as far as this headline.
“I am an admin, should I drop everything and fix this?”
Probably not.
The attack requires an active Man-in-the-Middle attacker that can intercept and modify the connection’s traffic at the TCP/IP layer. Additionally, we require the negotiation of either ChaCha20-Poly1305, or any CBC cipher in combination with Encrypt-then-MAC as the connection’s encryption mode.
[…]
“So how practical is the attack?”
The Terrapin attack requires an active Man-in-the-Middle attacker, that means some way for an attacker to intercept and modify the data sent from the client or server to the remote peer. This is difficult on the Internet, but can be a plausible attacker model on the local network.
If someone can gain physical access to your network, you’re already fucked.
Yeah, if the attacker is in a position to do a MitM attack you have much larger problems than a ssh vulnerability that so far can at most downgrade the encryption of your connection in nearly all cases
It definitely receives more clicks. I’ve posted this link here a day ago, but arstechnicas title is more engaging. My first thought was whether there’s been another vulnerability found.
That said, the headline isn’t as bad as it could’ve been.
ChaCha20-Poly1305 and CBC with Encrypt-then-MAC ciphers are vulnerable to a MITM attack.
Saved you a click.
Why use CBC too? Cha-Cha20-Poly1305 is an AEAD, so both an assymetric plus a symmetric stream cipher.
Just checked my own sshd configs and I don’t use CBC in them. I’ve based the kex/cipher/Mac configs off of cipherlist.eu and the mozilla docs current standards. Guess it pays to never use default configs for sshd if it’s ever exposed to the Internet.
Edit: I read it wrong. It’s chacha20 OR CBC. I rely heavily on the former with none of the latter.
Ah thanks! Didn’t catch that.
I thought most SSH servers default to some AES-based cypher like most other programs. Is that not the case?
So you need an MitM situation to even be able to perfom the attack, and the the attack on works on two ciphers? The article says those ciphers are commonly enabled, but are they default or used in relatively modern distributed versions of openssh?
A scan performed by the researchers found that 77 percent of SSH servers exposed to the Internet support at least one of the vulnerable encryption modes, while 57 percent of them list a vulnerable encryption mode as the preferred choice.
That means a client could negotiate one or the other on more than half of all internets exposed openssh daemons.
I haven’t got too whizzed up over this, yet, because I have no ssh daemons exposed without a VPN outer wrapper. However it does look nasty.
If you need a man in the middle to exploit this, it’s not that nasty.
So hardened ssh configs following best practice cipher whitelist are unaffected, cool
Ylönen, who at the time knew little about implementing strong cryptography in code, set out to develop the Secure Shell Protocol (SSH)
TIL SSH was invented by a Finn. I swear that country has the most awesome per capita of any country on earth.
Long dark winters when everyone is home without socializing with people. You have got to come up with something to survive until the two week summer.
Long dark winters when everyone is home without socializing with people. You have got to come up with something to survive until the two week summer.
Great photo illustration
I expect better of Ars. Absolute clickbait title and sensationalism. You need a two point MITM and even then it’s not a magic shell.
I might just go ahead and change the default port. Problem solved
If someone going through the effort to target you with a MitM over the Internet, that’s not going to stop them.
Just diable the affected ciphers and/or update opened.
This is the best summary I could come up with:
Once in place, this piece of dedicated hardware surreptitiously inhaled thousands of user names and passwords before it was finally discovered.
Ylönen, who at the time knew little about implementing strong cryptography in code, set out to develop the Secure Shell Protocol (SSH) in early 1995, about three months after the discovery of the password sniffer.
As one of the first network tools to route traffic through an impregnable tunnel fortified with a still-esoteric feature known as “public key encryption,” SSH quickly caught on around the world.
Today, it’s hard to overstate the importance of the protocol, which underpins the security of apps used inside millions of organizations, including cloud environments crucial to Google, Amazon, Facebook, and other large companies.
Now, nearly 30 years later, researchers have devised an attack with the potential to undermine, if not cripple, cryptographic SSH protections that the networking world takes for granted.
The attack targets the BPP, short for Binary Packet Protocol, which is designed to ensure that adversaries with an active position can’t add or drop messages exchanged during the handshake.
The original article contains 658 words, the summary contains 178 words. Saved 73%. I’m a bot and I’m open source!
you missed this part:
For Terrapin to be viable, the connection it interferes with also must be secured by either “ChaCha20-Poly1305” or “CBC with Encrypt-then-MAC,” both of which are cipher modes added to the SSH protocol (in 2013 and 2012, respectively). A scan performed by the researchers found that 77 percent of SSH servers exposed to the Internet support at least one of the vulnerable encryption modes, while 57 percent of them list a vulnerable encryption mode as the preferred choice.
Also that in order to exploit this it requires an active man in the middle. Which requires any of the following:
- Reverse proxy hijack/NAT hijack - from a compromised machine near the server
- BGP hijack - stealing traffic to the real IP
- DNS hijack - stealing traffic to send to a different IP
- Malicious/compromised network transit
- Local network gateway control
- WAP poisoning - wifi roaming is designed really well so this is actually easier than it sounds.
Almost all of those have decent mitigations like 801.x and BGP monitoring. The best mitigation is that you can just change your client config to disable those ciphersuites though.
