6 ms·

That’s a neat demo. Am I right to think it’s exceptionally difficult — without local exec access on a machine — to induce a machine to open an ssh connection to

That’s a neat demo. Am I right to think it’s exceptionally difficult — without local exec access on a machine — to induce a machine to open an ssh connection to an arbitrary host?

zamadatix 7y ago
I'm not sure I follow, induce what to open an ssh connection? If you mean the service in question (whoami.filippo.io) it is opening an ssh connection it just displays a message and closes instead of authenticating you and dropping you into a shell. If you mean launch an ssh session from a machine to something in general then yes you have to be able to execute programs on the machine as that's all an ssh client is - another program.
- tedunangst 7y ago
  I think the question is if it's possible to add <img src=ssh://> to a webpage and have something dumb happen.
  - peteretep 7y ago
    Exactly that, and I'm reasonably sure the answer is no.
    - jrockway 7y ago
      I am sure there is some setup where that will work. Set a URL handler to open Emacs, format the filename as a TRAMP path, something like that. There are plenty of things that try to transparently SSH places, and I'm sure someone has accidentally hooked that into their browser.
stygiansonic 7y ago
Probably cannot induce the local machine to connect, but if you enabled agent forwarding, and then connected to a machine, someone who compromised that machine may be able to use your credentials to connect to other SSH servers. Source: https://heipei.io/2015/02/26/SSH-Agent-Forwarding-considered-harmful/ https://heipei.io/2015/02/26/SSH-Agent-Forwarding-considered...
Thorrez 7y ago
If you try to SSH into some new machine that you own, someone can redirect your request to an attacker's machine (via DNS attacks or MITM), and since it's a new machine, it won't be in your known_hosts file, so it will prompt if you want to trust this machine and 99% of people will say yes.
- dependenttypes 7y ago
  openssh makes the situation worse because if the key is already in your host file and it's just the ip/domain that changed it will not tell you that it recognises the key.
  - rekoil 7y ago
    I mean, if a mitm has your SSH server key, chances are you are screwed anyway.
    - dependenttypes 7y ago
      In the case which I am describing nobody other than you has your key.
      - rekoil 7y ago
        But the key you are talking about the SSH client recognising is the server key right? Or did you mean after authorising your SSH client to connect to the unknown machine, and the key you were talking about was the identity public key? I ask because the thread you commented on was discussing users not looking carefully which servers they connect to when connecting to new servers, and that is based on the SSH servers key, not your identity key, which is why I said that if someone who is able to redirect your SSH connection to a different server also owns the correct servers SSH server key (as you said "just the ip/domain that changed"), then there isn't much the client can do to help keep you safe anyway.
        dependenttypes 7y ago

That’s a neat demo. Am I right to think it’s exceptionally difficult — without local exec access on a machine — to induce a machine to open an ssh connection to an arbitrary host?

zamadatix 7y ago

I'm not sure I follow, induce what to open an ssh connection? If you mean the service in question (whoami.filippo.io) it is opening an ssh connection it just displays a message and closes instead of authenticating you and dropping you into a shell. If you mean launch an ssh session from a machine to something in general then yes you have to be able to execute programs on the machine as that's all an ssh client is - another program.

tedunangst 7y ago
I think the question is if it's possible to add <img src=ssh://> to a webpage and have something dumb happen.
- peteretep 7y ago
  Exactly that, and I'm reasonably sure the answer is no.
  - jrockway 7y ago
    I am sure there is some setup where that will work. Set a URL handler to open Emacs, format the filename as a TRAMP path, something like that. There are plenty of things that try to transparently SSH places, and I'm sure someone has accidentally hooked that into their browser.

stygiansonic 7y ago

Probably cannot induce the local machine to connect, but if you enabled agent forwarding, and then connected to a machine, someone who compromised that machine may be able to use your credentials to connect to other SSH servers. Source: https://heipei.io/2015/02/26/SSH-Agent-Forwarding-considered-harmful/ https://heipei.io/2015/02/26/SSH-Agent-Forwarding-considered...

Thorrez 7y ago

If you try to SSH into some new machine that you own, someone can redirect your request to an attacker's machine (via DNS attacks or MITM), and since it's a new machine, it won't be in your known_hosts file, so it will prompt if you want to trust this machine and 99% of people will say yes.

dependenttypes 7y ago
openssh makes the situation worse because if the key is already in your host file and it's just the ip/domain that changed it will not tell you that it recognises the key.
- rekoil 7y ago
  I mean, if a mitm has your SSH server key, chances are you are screwed anyway.
  - dependenttypes 7y ago
    In the case which I am describing nobody other than you has your key.
    - rekoil 7y ago
      But the key you are talking about the SSH client recognising is the server key right? Or did you mean after authorising your SSH client to connect to the unknown machine, and the key you were talking about was the identity public key? I ask because the thread you commented on was discussing users not looking carefully which servers they connect to when connecting to new servers, and that is based on the SSH servers key, not your identity key, which is why I said that if someone who is able to redirect your SSH connection to a different server also owns the correct servers SSH server key (as you said "just the ip/domain that changed"), then there isn't much the client can do to help keep you safe anyway.
      - dependenttypes 7y ago