Misplaced Pages

Terrapin attack

Logo for the Terrapin attack
CVE identifier(s)	CVE-2023-48795
Date discovered	19 December 2023; 12 months ago (2023-12-19)
Discoverer	Fabian Bäumer, Marcus Brinkmann, Jörg Schwenk (Ruhr University Bochum)
Affected software	implementations of the Secure Shell (SSH) protocol including OpenSSH
Website	https://terrapin-attack.com/

The Terrapin attack is a cryptographic attack on the commonly used SSH protocol that is used for secure command-and-control throughout the Internet. The Terrapin attack can reduce the security of SSH by using a downgrade attack via man-in-the-middle interception. The attack works by prefix truncation; the injection and deletion of messages during feature negotiation, manipulating sequence numbers in a way that causes other messages to be ignored without an error being detected by either client or server.

According to the attack's discoverers, the majority of SSH implementations were vulnerable at the time of the discovery of the attack (2023). As of January 3, 2024, an estimated 11 million publicly accessible SSH servers are still vulnerable. However, the risk is mitigated by the requirement to intercept a genuine SSH session, and that the attack can only delete messages at the start of a negotiation, fortuitously resulting mostly in failed connections. Additionally the attack requires the use of either ChaCha20-Poly1305 or a CBC cipher in combination with Encrypt-then-MAC modes of encryption. The SSH developers have stated that the major impact of the attack is the capability to degrade the keystroke timing obfuscation features of SSH.

The designers of SSH have implemented a fix for the Terrapin attack, but the fix is only fully effective when both client and server implementations have been upgraded to support it. The researchers who discovered the attack have also created a vulnerability scanner to determine whether an SSH server or client is vulnerable.

The attack has been given the CVE ID CVE-2023-48795. In addition to the main attack, two other vulnerabilities were found in AsyncSSH, and assigned the CVE IDs CVE-2023-46445 and CVE-2023-46446.

References

1. ^ Goodin, Dan (2023-12-19). "SSH protects the world's most sensitive networks. It just got a lot weaker". Ars Technica. Retrieved 2023-12-20.
2. Bäumer, Fabian; Brinkmann, Marcus; Schwenk, Jörg (2023-12-19), Terrapin Attack: Breaking SSH Channel Integrity By Sequence Number Manipulation, arXiv:2312.12422
3. ^ "Terrapin attacks can downgrade security of OpenSSH connections". BleepingComputer. Retrieved 2023-12-20.
4. ^ Jones, Connor. "SSH shaken, not stirred by Terrapin downgrade vulnerability". www.theregister.com. Retrieved 2023-12-20.
5. "Nearly 11 million SSH servers vulnerable to new Terrapin attacks". BleepingComputer. Retrieved 2024-01-07.
6. ^ "OpenSSH 9.6 release notes". openssh.com. 2023-12-18.
7. "Terrapin Attack". terrapin-attack.com. Retrieved 2024-01-07.
8. "Release v1.1.0 · RUB-NDS/Terrapin-Scanner". GitHub. Retrieved 2024-01-07.
9. "CVE-2023-48795". cve.org. Retrieved 2024-01-16.

External links

• Official website
• Classic mitm on ssh vs. Terrapin-Attack: packet handling comparison

This Internet-related article is a stub. You can help Misplaced Pages by expanding it.

• v
• t
• e

This cryptography-related article is a stub. You can help Misplaced Pages by expanding it.

• v
• t
• e

• Computer network security
• Computer security exploits
• Internet stubs
• Cryptography stubs