4 ms·

Are they confident that the private key was not seen by anyone, or did it actually leak? If it leaked, this may be more of an issue than how it appears to be pr

by raggi 4y ago

Are they confident that the private key was not seen by anyone, or did it actually leak? If it leaked, this may be more of an issue than how it appears to be presented.

renewiltord 4y ago
If you ever push anything to a public Github repository it is immediately mirrored by a host of bots. If it was there for any amount of time, it's there. That said, if I'm honest I think almost no one checks the SSH host key. I would bet that for 9 out of 10 engineers / devops / security people, they will ignore the SSH Host Key and might even set StrictHostKeyChecking=no. I know I know. All you have to do is to just MITM someone's DNS or IP traffic or whatever and it's all over. Well, I will guarantee you that millions of bitcoin are sitting there waiting for you to take it. It's all yours. Go take it. You could be a millionaire tomorrow. And if you do it right, they'll let you keep some of it if you send most of it back.
- raggi 4y ago
  > If you ever push anything to a public Github repository it is immediately mirrored by a host of bots. I'd love to get a copy of the key, so I can setup a demo to encourage education. > That said, if I'm honest I think almost no one checks the SSH host key. I would bet that for 9 out of 10 engineers / devops / security people, they will ignore the SSH Host Key and might even set StrictHostKeyChecking=no. I believe you, and I agree this is common. I have been carrying the github host keys in my dot files for more than a decade. I do this somewhat ergonomically by having a Host config that adjusts the known_hosts path to permanent_known_hosts for things I care about. Setting StrictHostKeyChecking=no is negligence, despite being common there really isn't two ways about that, it's a trivial vector with only a very moderate need for additional information to turn this into an RCE in most cases. There are big problems with ssh's host keys, I understand and agree, but there are also big problems with passwords and we've made a dent in getting people to use password managers and 2FA. We should not wave this away just because it's a little harder, otherwise we're just relegating ssh to the same status as gpg.

by raggi 4y ago

Are they confident that the private key was not seen by anyone, or did it actually leak? If it leaked, this may be more of an issue than how it appears to be presented.

renewiltord 4y ago

If you ever push anything to a public Github repository it is immediately mirrored by a host of bots. If it was there for any amount of time, it's there. That said, if I'm honest I think almost no one checks the SSH host key. I would bet that for 9 out of 10 engineers / devops / security people, they will ignore the SSH Host Key and might even set StrictHostKeyChecking=no. I know I know. All you have to do is to just MITM someone's DNS or IP traffic or whatever and it's all over. Well, I will guarantee you that millions of bitcoin are sitting there waiting for you to take it. It's all yours. Go take it. You could be a millionaire tomorrow. And if you do it right, they'll let you keep some of it if you send most of it back.

raggi 4y ago
> If you ever push anything to a public Github repository it is immediately mirrored by a host of bots. I'd love to get a copy of the key, so I can setup a demo to encourage education. > That said, if I'm honest I think almost no one checks the SSH host key. I would bet that for 9 out of 10 engineers / devops / security people, they will ignore the SSH Host Key and might even set StrictHostKeyChecking=no. I believe you, and I agree this is common. I have been carrying the github host keys in my dot files for more than a decade. I do this somewhat ergonomically by having a Host config that adjusts the known_hosts path to permanent_known_hosts for things I care about. Setting StrictHostKeyChecking=no is negligence, despite being common there really isn't two ways about that, it's a trivial vector with only a very moderate need for additional information to turn this into an RCE in most cases. There are big problems with ssh's host keys, I understand and agree, but there are also big problems with passwords and we've made a dent in getting people to use password managers and 2FA. We should not wave this away just because it's a little harder, otherwise we're just relegating ssh to the same status as gpg.