3 ms·
It is still a DoS attack. And of course SSH is usually TOFU so that isn't a strong defense. Imagine this at a company network. 1. The attacker compromises an
by kevincox 4y ago
It is still a DoS attack. And of course SSH is usually TOFU so that isn't a strong defense.
Imagine this at a company network.
1. The attacker compromises an application process on one machine and manages to get code execution.
2. They wait for SSH to restart (updates, trigger a crash, OOM?) then bind port 22.
3. Wait for some developer to connect to this machine for the first time. They (unexpectedly) see a new host key so accept it.
Now if that developer has forwarding enabled you can log into other machines (probably with root/sudo access). You have just escalated your privileges from a non-root user on one machine to the entire network.