3 ms·
I don’t know how prevalent it is as a network architecture, but it seems like a bastion host / jump box would be a juicy target for this exploit, since it’d let
by e28eta 3y ago
I don’t know how prevalent it is as a network architecture, but it seems like a bastion host / jump box would be a juicy target for this exploit, since it’d let the attacker jump upstream.
- jmalicki 3y agoSure, but first they have to root the bastion box. If you root the bastion box, you have user credentials for anything inside the network. Controlling the user's laptop seems unlikely to be your most profitable next step.
- yjftsjthsd-h 3y agoIt really depends on the setup; ex. I imagine it's easier to steal company code from a laptop than server, while data is the other way around.
- gunapologist99 3y ago> If you root the bastion box, you have user credentials for anything inside the network. But that's not how a (properly-configured!) bastion host works. You won't have user credentials for anything UNLESS users are using Forward Agent (which they shouldn't! simplest explanation here.. https://userify.com/docs/jumpbox https://userify.com/docs/jumpbox ). That's the point behind using ProxyJump. Your connection actually jumps THROUGH the bastion box and doesn't stop for interception along the way. (And, of course, an attacker can't do anything very useful with ssh public keys except for maybe traffic analysis or learning more target IP's.)
- akerl_ 3y agoIncreasingly, the role of a bastion host is served either by something like Teleport, which handles authn/z and proxying without needing forwarded agents, or newer options in OpenSSH like ProxyJump where you hop via a bastion host but without ever forwarding your agent.