4 ms·
What about the traditional SSH client as a zone of trust? It's unfair to ignore the client in the traditional case but count the browser and extension as two ad
by jkn 14y ago
What about the traditional SSH client as a zone of trust? It's unfair to ignore the client in the traditional case but count the browser and extension as two additional zones of trust in the Chrome case.
Client-side exploits in SSH clients have happened before[1]. The scope of such exploits is arguably reduced when running a sand-boxed application in a browser compared to a regular application on the local machine.
That being said, I agree with your general point that using a browser as an SSH terminal dramatically increases the attack surface, compared to a small dedicated client.
[1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0467 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0467
Multiple integer overflows in the (1) sftp_pkt_getstring and (2) fxp_readdir_recv functions in the PSFTP and PSCP clients for PuTTY 0.56, and possibly earlier versions, allow remote malicious web sites to execute arbitrary code via SFTP responses that corrupt the heap after insufficient memory has been allocated.
- patio11 14y agoThey call out to your existing SSH client, so if it's vulnerable, wrapping it in NativeClient means it is still vulnerable. By comparison, my SSH client doesn't go to Chrome and say "Hey guys, apropos of nothing, please hang onto these SSH keys so we have something to give anyone who successfully is able to read memory from any one of fivish subsystems in your under-constant-attack product." [Edit: On re-reading, I think I misunderstood this, and the comment beneath this one is substantially correct regarding them bundling OpenSSH. I still think this is substantially more attack surface than however you're consuming OpenSSH code currently.]
- jkn 14y agoAs I read it the whole SSH client is an OpenSSH port running in the NativeClient sandbox, which does make it safer in terms of SSH client exploits, in the sense that the exploit doesn't give you immediate control of the local machine. Secure Shell is a Chrome Application that combines the "ssh" command (see http://openssh.org/ http://openssh.org/ for details) ported to NativeClient with the "hterm" terminal emulator to provide a secure shell client for the Chrome browser. http://git.chromium.org/gitweb/?p=chromiumos/platform/assets.git;a=blob;f=chromeapps/hterm/doc/faq.txt http://git.chromium.org/gitweb/?p=chromiumos/platform/assets... I'm not familiar enough with the multiple sandboxing levels of Chrome to judge the risks of one malicious website accessing the memory of the Secure Shell extension. I guess you have a point, although I would expect the "each tab in a separate process" model to mitigate this concern?