2 ms·
>Agent forwarding forwards the keys insecurely. If you can launch an agent-forwarded connection, then the HSM is already irrelevant. No? ssh-agent works fine w
by Arnavion 3y ago
>Agent forwarding forwards the keys insecurely. If you can launch an agent-forwarded connection, then the HSM is already irrelevant.
No? ssh-agent works fine with keys that are not exportable from the HSM. By the very definition it's not possible for anything to export the key, ssh-agent or otherwise.
>yes, but messing up your terminal is not an RCE
It has been, and can be again.
https://www.cyberark.com/resources/threat-research-blog/dont-trust-this-title-abusing-terminal-emulators-with-ansi-escape-characters https://www.cyberark.com/resources/threat-research-blog/dont...
- iudqnolq 3y agoThat's not an RCE, it's a DoS. As the article describes most Windows terminal emulators just call SetWindowText when they get the set window title escape code. For some reason Windows implements that function very inefficiently so if it ends up being called in a tight loop your computer can freeze.
- Arnavion 3y agoRead carefully. >I was searching for a bug in ANSI characters that respond to a change of the window’s title. One of the things I did was check how the previous bugs were exploited. One of them, CVE-2015-8971 (found by Nicolas Braud-Santoni), was a bug in Terminology 0.7.0 that didn’t filter new line (\n) escape character when changing the window title. It allowed you to modify the window title and then re-insert it into the terminal’s input buffer, resulting in arbitrary terminal input, which then caused code execution.
- gunapologist99 3y agoThat's a vulnerability in your terminal app, not in SSH, like a browser vuln when connecting to a remote website, but you're right, the point is well taken: there is always that possibility and you should be quite careful about choosing your terminal application.