The Terrapin attack, a newly identified security threat, jeopardizes nearly 11 million SSH servers that are accessible online.
Originating from academic research at Ruhr University Bochum in Germany, this attack specifically targets the SSH protocol, affecting both clients and servers.
It exploits vulnerabilities during the handshake process, especially when using certain encryption modes, compromising the integrity of SSH connections.
The attack requires the perpetrator to be in a unique position - an adversary-in-the-middle - to intercept and manipulate the handshake exchange.
This method enables attackers to downgrade public key algorithms for user authentication and neutralize protections against keystroke timing attacks, notably in OpenSSH 9.5.
The report by Shadowserver, a security monitoring platform, highlights the widespread vulnerability of these servers across the globe.
Shadowserver's findings show that the United States has the highest number of vulnerable servers, followed by China, Germany, Russia, Singapore, and Japan.
This distribution underlines the potential widespread impact of Terrapin attacks.
Although not every one of the 11 million servers is at immediate risk, it reveals a significant pool of targets for potential attackers.
For those concerned about the vulnerability of their SSH client or server, the team from Ruhr University Bochum offers a specialized vulnerability scanner.
If you're interested in reading more about vulnerability management, check out this article: What Is Vulnerability Management.
If you liked this piece, follow us on LinkedIn, Twitter, Facebook, and YouTube for more cybersecurity news and topics.
If you liked this post, you will enjoy our newsletter.
Get cybersecurity updates you'll actually want to read directly in your inbox.
This Cyber News was published on heimdalsecurity.com. Publication date: Fri, 05 Jan 2024 10:43:04 +0000