A recent report from the security threat monitoring platform Shadowserver reveals that almost 11 million SSH servers on the public web, identified by unique IP addresses, are vulnerable to Terrapin attacks.
A staggering 11 million internet-exposed SSH servers are at risk of the Terrapin attack, posing a threat to the integrity of SSH connections, as revealed by academic researchers from Ruhr Universitβ¦
Make sure to keep your SSH servers secure due to recent attack on the SSH protocol
https://flashfeed.theplanethub.com/2024/01/new-terrapin-attack-threatens-ssh.html
#news #serversecurity #server #security #ssh #terrapinattack
On #OpenSSH ssh (-vvv) client side successful CVE-2023-48795 mitigation will appear as:
debug3: kex_choose_conf: will use strict KEX ordering
On sshd (-ddd) side:
debug3: kex_choose_conf: will use strict KEX ordering [preauth]
chuckling that Ars reports the AsyncSSH side of the #TerrapinAttack news w/ "it has 60,000 dlβs /a day/!β, implying this means it's popular.
Twisted, which includes an SSH implementation (Conch; tho I'm not at all sure how much this is truly used, I've never run into it in the wild myself) sees 150K downloads/day.
Paramiko, which is the "top of mind" SSH implementation for Python (I am slightly biased, butβ¦) sees 1.5MM downloads/day.
This, plus the sensationalist headline, make me a bit sad.
Refs: https://terrapin-attack.com/ https://seclists.org/oss-sec/2023/q4/292 https://osv.dev/list?ecosystem=&q=CVE-2023-48795 GHSA-45x7-px36-x8w8 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2...
We got our traditional end of December new attack with a logo. I think we can call the year over, right? (Please nothing else this year π )
We've just released #PuTTY version 0.80! This is a SECURITY UPDATE, fixing the newly discovered 'Terrapin' #vulnerability, aka CVE-2023-48795, in some widely used #SSH protocol extensions.
The release is available in the usual place, at https://www.chiark.greenend.org.uk/~sgtatham/putty/
Full information on the vulnerability is at https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-terrapin.html
We urge users to upgrade, and also upgrade #OpenSSH servers. A fix is needed at both ends of the connection to eliminate the vulnerability.
Freemind
Waseem
Harry Sintonen
Sam Stepanyan 
π
Jeff Forcier
Thomas Gerbet
Simon Tatham