Terrapin Attack (terrapin-attack.com)
from tedu to cloudsec on 18 Dec 2023 21:50
https://azorius.net/g/cloudsec/p/2ztlNwt7p2PGc8ZX9M-Terrapin-Attack

Terrapin is a prefix truncation attack targeting the SSH protocol. More precisely, Terrapin breaks the integrity of SSH's secure channel. By carefully adjusting the sequence numbers during the handshake, an attacker can remove an arbitrary amount of messages sent by the client or server at the beginning of the secure channel without the client or server noticing it.

The attack can be performed in practice, allowing an attacker to downgrade the connection's security by truncating the extension negotiation message (RFC8308) from the transcript. The truncation can lead to using less secure client authentication algorithms and deactivating specific countermeasures against keystroke timing attacks in OpenSSH 9.5.

#cloudsec #networking