3 ms·
Keylogger, perhaps. The multiplexing just makes it trivial to connect to everything with no logging and no authentication. I don't even have to modify the PAT
by LinuxBender 11y ago
Keylogger, perhaps. The multiplexing just makes it trivial to connect to everything with no logging and no authentication. I don't even have to modify the PATH or install a keylogger. I am already several steps beyond that in one move. In other words, no audit trail for the FBI to look into, no need to upload some new application, no need to exploit a vulnerable application (beyond the vulnerability of OpenSSH itself by design).
Perhaps some of the confusion here is that it is assumed ssh keys are in use? In an environment that requires 2FA, keys would not be allowed. People would be using RSA Tokens, Duo, Yubikeys, etc. This method bypassing those things.
It also means, anyone using the defaults in OpenSSH is not PCI compliant.
I am not even sure this method of access to development or production environments is even illegal, as the user is providing access and I am not hacking anything, nor am I using authentication into anything. The door is wide open. If this were a game of chess, I would get check-mate in 1 move.
- AnthonyMouse 11y agoIf this were a game of chess, checkmate is getting arbitrary code to run in the context of the user. If you have an existing ssh process running as the same user then you can attach it with a debugger and inject code into it.
- deleted 11y ago[deleted]
- AnthonyMouse 11y agoA debugger injecting code into a process under the same context isn't a vulnerability. It's supposed to be able to do that. And OpenSSH is supposed to allow you to multiplex sessions. It's a feature. The vulnerability is the attacker being able to run arbitrary code as the user.
- deleted 11y ago[deleted]
- LinuxBender 11y agoOpenSSH allowing this behavior by default is in itself the vulnerability.
- AnthonyMouse 11y agoThen how do you exploit it without assuming the ability to execute arbitrary code as the user?
- LinuxBender 11y agoSome time soon I will put something up on github so you can test this methodology. It probably won't be tonight though.
- Piskvorrr 11y agoThat's a feature, not a bug. SSH is a power tool; if your users can not be trusted with power tools, it is your responsibility to provide them with something brightly coloured, drool-proof and locked down.
- Piskvorrr 11y ago"More and companies are opening up their firewalls outbound because it makes developers feel warm and fuzzy." - this is the actual issue, and should fail you in the audit: precisely because it is a major vulnerability which can be abused in 10^128 different ways. Running around screaming "OMG OMG, the tool designed to tunnel over the network can be used to tunnel over the network, TEH SKY IS FALLING!!1!!!" is even somewhat funny in this context.
- LinuxBender 11y agoI don't recall even remotely suggesting the sky is falling. If nobody fixes this, it doesn't affect me. I have Multiplexing disabled everywhere that I care about. The constant news of companies getting popped is actually quite entertaining. The only thing folks may be concerned about is that if too many companies get popped, there may be some heavy handed legislation that starts to affect people. Even that I am perfectly fine with.
- Piskvorrr 11y agoahem "It also means, anyone using the defaults in OpenSSH is not PCI compliant."
- LinuxBender 11y agoI wouldn't worry. Not every auditor will catch this.
- Piskvorrr 11y agoWell, that's security through obscurity: planning to fail an audit if the auditors dig too deep, but betting on a surface-level inspection.