Terrapin Attack: Breaking SSH Channel Integrity By Sequence Number Manipulation

• URL: http://arxiv.org/abs/2312.12422v2
• Date: Tue, 7 May 2024 17:09:31 GMT
• Title: Terrapin Attack: Breaking SSH Channel Integrity By Sequence Number Manipulation
• Authors: Fabian Bäumer, Marcus Brinkmann, Jörg Schwenk,
• Abstract summary: We show that the SSH Binary Packet Protocol is no longer a secure channel. This allows prefix truncation attacks where encrypted packets at the beginning of the SSH channel can be deleted without the client or server noticing it. We propose effective and backward-compatible changes to SSH to mitigate our attacks.
• Score: 11.499428847222099
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: The SSH protocol provides secure access to network services, particularly remote terminal login and file transfer within organizational networks and to over 15 million servers on the open internet. SSH uses an authenticated key exchange to establish a secure channel between a client and a server, which protects the confidentiality and integrity of messages sent in either direction. The secure channel prevents message manipulation, replay, insertion, deletion, and reordering. At the network level, SSH uses the Binary Packet Protocol over TCP. In this paper, we show that the SSH Binary Packet Protocol is no longer a secure channel: SSH channel integrity (INT-PST, aINT-PTXT, and INT-sfCTF) is broken for three widely used encryption modes. This allows prefix truncation attacks where encrypted packets at the beginning of the SSH channel can be deleted without the client or server noticing it. We demonstrate several real-world applications of this attack. We show that we can fully break SSH extension negotiation (RFC 8308), such that an attacker can downgrade the public key algorithms for user authentication or turn off a new countermeasure against keystroke timing attacks introduced in OpenSSH 9.5. Further, we identify an implementation flaw in AsyncSSH that, together with prefix truncation, allows an attacker to redirect the victim's login into a shell controlled by the attacker. We also performed an internet-wide scan and found that 71.6% of SSH servers support a vulnerable encryption mode, while 63.2% even list it as their preferred choice. We identify two root causes that enable these attacks: First, the SSH handshake supports optional messages that are not authenticated. Second, SSH does not reset message sequence numbers when activating encryption keys. Based on this analysis, we propose effective and backward-compatible changes to SSH that mitigate our attacks.

Related papers

• SSH-Passkeys: Leveraging Web Authentication for Passwordless SSH [11.865671333047658]
  Passwords remain the dominant mode of SSH authentication, despite their well known flaws such as phishing and reuse.<n>WebAuthn is a modern authentication standard designed to replace passwords, managing keys on behalf of the user.<n>We propose a framework to integrate WebAuthn with SSH servers, by using UNIX pluggable authentication modules (PAM)
  arXiv  Detail & Related papers  (2025-07-11T21:13:09Z)
• Prekey Pogo: Investigating Security and Privacy Issues in WhatsApp's Handshake Mechanism [1.8499314936771563]
  WhatsApp uses a version of the Signal protocol to provide end-to-end encryption (E2EE) with strong security guarantees. To ensure Perfect Forward Secrecy (PFS) right from the start, a stash of ephemeral (one-time) prekeys must be stored on a server. We are the first to demonstrate a targeted depletion attack against them on individual WhatsApp user devices.
  arXiv  Detail & Related papers  (2025-04-09T22:53:13Z)
• Secure Semantic Communication With Homomorphic Encryption [52.5344514499035]
  This paper explores the feasibility of applying homomorphic encryption to SemCom. We propose a task-oriented SemCom scheme secured through homomorphic encryption.
  arXiv  Detail & Related papers  (2025-01-17T13:26:14Z)
• Securing Network-Booting Linux Systems at the Example of bwLehrpool and bwForCluster NEMO [0.0]
  The universities of Baden-W"urttemberg are using stateless system remote boot for services such as computer labs and data centers. The aim of this work is to establish trust within this network, focusing on server-client identity, confidentiality and image authenticity.
  arXiv  Detail & Related papers  (2024-09-03T20:54:19Z)
• Distributed Symmetric Key Establishment: a Scalable Quantum-Safe Key Distribution Protocol [4.1010893028706255]
  Pre-shared keys (PSK) have been widely used in network security. Existing PSK solutions are not scalable. We propose a new protocol called Distributed Symmetric Key Establishment (DSKE)
  arXiv  Detail & Related papers  (2024-07-30T16:55:17Z)
• EmInspector: Combating Backdoor Attacks in Federated Self-Supervised Learning Through Embedding Inspection [53.25863925815954]
  Federated self-supervised learning (FSSL) has emerged as a promising paradigm that enables the exploitation of clients' vast amounts of unlabeled data. While FSSL offers advantages, its susceptibility to backdoor attacks has not been investigated. We propose the Embedding Inspector (EmInspector) that detects malicious clients by inspecting the embedding space of local models.
  arXiv  Detail & Related papers  (2024-05-21T06:14:49Z)
• Exploiting Sequence Number Leakage: TCP Hijacking in NAT-Enabled Wi-Fi Networks [22.72218888270886]
  We uncover a new side-channel vulnerability in the widely used NAT port preservation strategy and an insufficient reverse path validation strategy of Wi-Fi routers. Off-path attackers can infer if there is one victim client in the same network communicating with another host on the Internet using TCP. We test 67 widely used routers from 30 vendors and discover that 52 of them are affected by this attack.
  arXiv  Detail & Related papers  (2024-04-06T11:59:35Z)
• CodeChameleon: Personalized Encryption Framework for Jailbreaking Large Language Models [49.60006012946767]
  We propose CodeChameleon, a novel jailbreak framework based on personalized encryption tactics. We conduct extensive experiments on 7 Large Language Models, achieving state-of-the-art average Attack Success Rate (ASR) Remarkably, our method achieves an 86.6% ASR on GPT-4-1106.
  arXiv  Detail & Related papers  (2024-02-26T16:35:59Z)
• Off-Path TCP Hijacking in Wi-Fi Networks: A Packet-Size Side Channel Attack [33.68960337314623]
  We unveil a fundamental side channel in Wi-Fi networks, specifically the observable frame size, which can be exploited by attackers to conduct TCP hijacking attacks. We validate the effectiveness of this side channel attack through two case studies. We implement our attack in 80 real-world Wi-Fi networks and successfully hijack the victim's TCP connections in 75 (93.75%) evaluated Wi-Fi networks.
  arXiv  Detail & Related papers  (2024-02-20T04:56:48Z)
• Tamper-Evident Pairing [55.2480439325792]
  Tamper-Evident Pairing (TEP) is an improvement of the Push-Button configuration (PBC) standard. TEP relies on the Tamper-Evident Announcement (TEA), which guarantees that an adversary can neither tamper a transmitted message without being detected, nor hide the fact that the message has been sent. This paper provides a comprehensive overview of the TEP protocol, including all information needed to understand how it works.
  arXiv  Detail & Related papers  (2023-11-24T18:54:00Z)
• AutoDAN: Interpretable Gradient-Based Adversarial Attacks on Large Language Models [55.748851471119906]
  Safety alignment of Large Language Models (LLMs) can be compromised with manual jailbreak attacks and (automatic) adversarial attacks. Recent studies suggest that defending against these attacks is possible: adversarial attacks generate unlimited but unreadable gibberish prompts, detectable by perplexity-based filters. We introduce AutoDAN, an interpretable, gradient-based adversarial attack that merges the strengths of both attack types.
  arXiv  Detail & Related papers  (2023-10-23T17:46:07Z)
• SOCI^+: An Enhanced Toolkit for Secure OutsourcedComputation on Integers [50.608828039206365]
  We propose SOCI+ which significantly improves the performance of SOCI. SOCI+ employs a novel (2, 2)-threshold Paillier cryptosystem with fast encryption and decryption as its cryptographic primitive. Compared with SOCI, our experimental evaluation shows that SOCI+ is up to 5.4 times more efficient in computation and 40% less in communication overhead.
  arXiv  Detail & Related papers  (2023-09-27T05:19:32Z)
• Distributed Symmetric Key Establishment: A scalable, quantum-proof key distribution system [0.8192907805418583]
  We propose and implement a protocol for a scalable, cost-effective, information-theoretically secure key distribution and management system. The system, called Distributed Symmetric Key Establishment (DSKE), relies on pre-shared random numbers between DSKE clients and a group of Security Hubs.
  arXiv  Detail & Related papers  (2022-05-02T01:46:11Z)
• Recovering AES Keys with a Deep Cold Boot Attack [91.22679787578438]
  Cold boot attacks inspect the corrupted random access memory soon after the power has been shut down. In this work, we combine a novel cryptographic variant of a deep error correcting code technique with a modified SAT solver scheme to apply the attack on AES keys. Our results show that our methods outperform the state of the art attack methods by a very large margin.
  arXiv  Detail & Related papers  (2021-06-09T07:57:01Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.