Editing Secure Shell (section)

==Vulnerabilities==
===SSH-1===
In 1998, a vulnerability was described in SSH 1.5 which allowed the unauthorized insertion of content into an encrypted SSH stream due to insufficient data integrity protection from [[CRC-32]] used in this version of the protocol.<ref>{{cite web|url=http://www.coresecurity.com/content/ssh-insertion-attack|title=SSH Insertion Attack|website=[[Core Security Technologies]]|url-status=live|archive-url=https://web.archive.org/web/20110708192336/http://www.coresecurity.com/content/ssh-insertion-attack|archive-date=2011-07-08}}</ref><ref>{{cite web|url=http://www.kb.cert.org/vuls/id/13877|title=Vulnerability Note VU#13877 - Weak CRC allows packet injection into SSH sessions encrypted with block ciphers|website=[[US CERT]]|url-status=live|archive-url=https://web.archive.org/web/20100710040357/http://www.kb.cert.org/vuls/id/13877|archive-date=2010-07-10}}</ref> A fix known as SSH Compensation Attack Detector<ref>{{cite web|url=http://www.securityfocus.com/bid/2347/discuss|title=SSH CRC-32 Compensation Attack Detector Vulnerability|website=[[SecurityFocus]]|url-status=live|archive-url=https://web.archive.org/web/20080725110345/http://www.securityfocus.com/bid/2347/discuss|archive-date=2008-07-25}}</ref> was introduced into most implementations. Many of these updated implementations contained a new [[integer overflow]] vulnerability<ref>{{cite web|url=http://www.kb.cert.org/vuls/id/945216|title=Vulnerability Note VU#945216 - SSH CRC32 attack detection code contains remote integer overflow|website=US CERT|url-status=live|archive-url=https://web.archive.org/web/20051013074750/http://www.kb.cert.org/vuls/id/945216|archive-date=2005-10-13}}</ref> that allowed attackers to execute arbitrary code with the privileges of the SSH daemon, typically root.

In January 2001 a vulnerability was discovered that allows attackers to modify the last block of an [[International Data Encryption Algorithm|IDEA]]-encrypted session.<ref>{{cite web|url=http://www.kb.cert.org/vuls/id/315308|title=Vulnerability Note VU#315308 - Weak CRC allows last block of IDEA-encrypted SSH packet to be changed without notice|website=US CERT|url-status=live|archive-url=https://web.archive.org/web/20100711103528/http://www.kb.cert.org/vuls/id/315308|archive-date=2010-07-11}}</ref> The same month, another vulnerability was discovered that allowed a malicious server to forward a client authentication to another server.<ref name="cert1">{{cite web|url=http://www.kb.cert.org/vuls/id/684820|title=Vulnerability Note VU#684820 - SSH-1 allows client authentication to be forwarded by a malicious server to another server|website=US CERT|url-status=live|archive-url=https://web.archive.org/web/20090901012536/http://www.kb.cert.org/vuls/id/684820|archive-date=2009-09-01}}</ref>

Since SSH-1 has inherent design flaws which make it vulnerable, it is now generally considered obsolete and should be avoided by explicitly disabling fallback to SSH-1.<ref name="cert1" /> Most modern servers and clients support SSH-2.<ref>{{cite web |title=How to use SSH keys for authentication |url=https://upcloud.com/community/tutorials/use-ssh-keys-authentication/ |website=Up Cloud |date=17 September 2015 |access-date=29 November 2019}}</ref>

===CBC plaintext recovery===
In November 2008, a theoretical vulnerability was discovered for all versions of SSH which allowed recovery of up to 32 bits of plaintext from a block of ciphertext that was encrypted using what was then the standard default encryption mode, [[Block cipher modes of operation#Cipher-block chaining (CBC)|CBC]].<ref name="SSH CBC vulnerability">{{cite web|url=http://www.kb.cert.org/vuls/id/958563|title=Vulnerability Note VU#958563 - SSH CBC vulnerability|website=US CERT|url-status=live|archive-url=https://web.archive.org/web/20110622005639/http://www.kb.cert.org/vuls/id/958563|archive-date=2011-06-22}}</ref> The most straightforward solution is to use [[Block cipher modes of operation#Counter (CTR)|CTR]], counter mode, instead of CBC mode, since this renders SSH resistant to the attack.<ref name="SSH CBC vulnerability"/>

===Suspected decryption by NSA===
On December 28, 2014 ''[[Der Spiegel]]'' published classified information<ref name=Spiegel2014>{{cite news|url=http://www.spiegel.de/international/germany/inside-the-nsa-s-war-on-internet-security-a-1010361.html|title=Prying Eyes: Inside the NSA's War on Internet Security|date=December 28, 2014|work=[[Spiegel Online]]|url-status=live|archive-url=https://web.archive.org/web/20150124202809/http://www.spiegel.de/international/germany/inside-the-nsa-s-war-on-internet-security-a-1010361.html|archive-date=January 24, 2015}}</ref> leaked by whistleblower [[Edward Snowden]] which suggests that the [[National Security Agency]] may be able to decrypt some SSH traffic. The technical details associated with such a process were not disclosed. A 2017 analysis of the [[CIA]] hacking tools ''BothanSpy'' and ''Gyrfalcon'' suggested that the SSH protocol was not compromised.<ref>{{cite web|first=Tatu|last=Ylonen|url=https://www.ssh.com/ssh/cia-bothanspy-gyrfalcon|title=BothanSpy & Gyrfalcon - Analysis of CIA hacking tools for SSH|website=ssh.com|date=3 August 2017|access-date=15 July 2018}}</ref>

=== Terrapin attack ===
{{main|Terrapin attack}}
A novel man-in-the-middle attack against most current ssh implementations was discovered in 2023. It was named the [[Terrapin attack]] by its discoverers.<ref>{{Cite web |title=Terrapin Attack |url=https://terrapin-attack.com/ |access-date=2023-12-20 |website=terrapin-attack.com}}</ref><ref>{{Cite web |last=Jones |first=Connor |title=SSH shaken, not stirred by Terrapin downgrade vulnerability |url=https://www.theregister.com/2023/12/20/terrapin_attack_ssh/ |access-date=2023-12-20 |website=www.theregister.com |language=en}}</ref> However, the risk is mitigated by the requirement to intercept a genuine ssh session, and that the attack is restricted in its scope, fortuitously resulting mostly in failed connections.<ref name="El Reg">{{Cite web |last=Jones |first=Connor |title=SSH shaken, not stirred by Terrapin downgrade vulnerability |url=https://www.theregister.com/2023/12/20/terrapin_attack_ssh/ |access-date=2023-12-20 |website=www.theregister.com |language=en}}</ref><ref name=":1">{{Cite web |date=2023-12-18 |title=OpenSSH 9.6 release notes |url=https://www.openssh.com/txt/release-9.6 |website=openssh.com}}</ref> The ssh developers have stated that the major impact of the attack is to degrade the [[Keystroke dynamics|keystroke timing]] obfuscation features of ssh.<ref name=":1" /> The vulnerability was fixed in OpenSSH 9.6, but requires both client and server to be upgraded for the fix to be fully effective.