Terrapin Attack: Breaking SSH Channel Integrity by Sequence Number Manipulation
summary
Examines a new cryptographic attack on SSH where sequence number handling in three common encryption modes permits prefix truncation of encrypted channel data. Demonstrates concrete impacts: downgrading authentication/negating a keystroke-timing countermeasure and exploiting a flaw in AsyncSSH to redirect a login into an attacker-controlled shell. Uses protocol analysis and real-world demonstrations against SSH implementations and extensions.
AI-written summary · about
related talks
14mPractical Attacks on a Decentralized Secure Messenger Session
50mHTTP Desync Attacks: Smashing into the Cell Next Door
49mBar-Mitzva Attack: Breaking SSL with 13-Year Old RC4 Weakness
11mIt wasn’t me, it was the cosmic rays! Blaming physics for evil actions!
31mCharting the SSH Multiverse
47mKey Reinstallation Attacks: Breaking the WPA2 Protocol
14mWhen Encryption Fails
21mOff-Path TCP Exploit: How Wireless Routers Can Jeopardize Your Secrets