Charting the SSH Multiverse
summary
SSH landscape has dozens of implementations with vendor forks, custom stacks and embedded libraries that leak precise OS and package versions from one packet and expose device make/models pre-auth. A custom tool, Shamble scanner, probes protocol states and finds misbehaving servers — last year it discovers 110,000 shells found and 27M SSH hosts, now ~15M active — and integrates bad-keys.info to flag leaked or weak keys while actively yielding exploitable behaviors.
AI-written summary · about
chapters (18)
- 0:00Introduction and welcome
- 1:03Why SSH matters today
- 3:09SSH protocol fingerprinting
- 4:52Public key exposure risks
- 6:16SSH protocol complexity
- 8:42SSH as a TLS alternative
- 9:46SSH ecosystem diversity
- 11:53Vendor SSH implementation quirks
- 13:17Windows OpenSSH vulnerabilities
- 14:00Major SSH vulnerabilities in 2023
- 17:31Introducing Shamble tool
- 19:14Shamble scan results
- 20:58Recent SSH research findings
- 23:21Erlang SSH RCE vulnerability
- 26:05Shamble updates and features
- 28:08Top SSH vulnerabilities today
- 28:50Shamble for blue team use
- 30:13XCrypto library overview
related talks
12mCatch-22: Uncovering Compromised Hosts using SSH Public Keys
01h 06mStrengthen open source software supply chain security: Log4Shell to xz
30mPublic-private partnership unveils the full scale of a sophisticated Linux threat
21mCAUDIT: Continuous Auditing of SSH Servers To Mitigate Brute-Force Attacks
32mA Case Study of MacOS Supply Chain Compromise
13mKeynote: Hacking the OSS Supply Chain
32mHacking the OSS Supply Chain
24mHow to Find if Your Developers are Leaking Secrets?