In recent developments, cyber attackers have begun exploiting a critical authentication bypass vulnerability affecting certain OpenSSH servers. This alarming trend was highlighted by recent findings from the SANS Internet Storm Center.
Exploitation of Vulnerability
The vulnerability, identified as SSHole, enables remote attackers to gain access to some Linux accounts with password authentication disabled. This is achieved by submitting an exceptionally long password, bypassing the need for valid credentials or an SSH key.
According to Johannes Ullrich, a researcher at SANS, the first definite attempts to exploit this flaw were recorded on November 5. These attempts involved the use of passwords composed entirely of repeated ‘A’ characters.
Recorded Attempts and Analysis
Ullrich’s Cowrie SSH honeypots documented 232 such requests on the initial day, which surged to 713 by November 6. It’s important to note that these figures represent suspicious activity rather than confirmed breaches. Early indicators of this activity were observed on November 1, but they appeared as faulty brute-force scripts rather than intentional SSHole exploitation.
The honeypots recorded significant scanning activity from IP addresses such as 213.86.169.133, 152.233.50.185, and 92.255.57.7, with 48, 44, and 43 attempts respectively. Although some logins may have been successful, Ullrich’s report does not confirm any definitive breaches, leaving the full extent of the exploitation unclear.
Technical Details and Mitigation
Revealed by researcher Özgün Kültekin, the SSHole vulnerability affects OpenSSH when running with musl libc, specifically when password authentication is enabled. The exploitation also requires a target account with a stored password field of *, and another local account with a valid SHA-crypt password hash.
The vulnerability arises when passwords exceed 256 bytes, causing musl’s crypt() function to return *, which OpenSSH may mistakenly accept as valid credentials. This issue, affecting password lengths from 257 to 1,024 bytes, does not bypass accounts with legitimate password hashes.
OpenSSH version 10.6p2 addresses this issue, and Alpine has released updates to mitigate the risk. Administrators are advised to apply these patches and restart sshd. In scenarios where immediate patching is not feasible, disabling password authentication or using PAM for password checks can provide interim protection.
Monitoring successful logins to key-only accounts is crucial, particularly if failed attempts are followed by successful logins in quick succession. This practice is essential to detect potential breaches in real-time.
While the current evidence does not support claims of SSH options leaking passwords or API keys to GitHub, the focus remains on addressing the authentication bypass. Security teams are recommended to enhance their alert systems to prevent incidents swiftly.
