Security News > 2023 > December > Terrapin attacks can downgrade security of OpenSSH connections

This manipulation lets attackers remove or modify messages exchanged through the communication channel, which leads to downgrading the public key algorithms used for user authentication or disabling defenses against keystroke timing attacks in OpenSSH 9.5.

"The Terrapin attack exploits weaknesses in the SSH transport layer protocol in combination with newer cryptographic algorithms and encryption modes introduced by OpenSSH over 10 years ago."

A Terrapin attack lowers the security of the established connection by truncating important negotiation messages without the client or server noticing it.

Researchers from the Ruhr University Bochum developed the Terrapin attack and also discovered exploitable implementation flaws in AsyncSSH. The weaknesses and flaws associated with the attack are bow identified as CVE-2023-48795, CVE-2023-46445 and CVE-2023-46446.

One thing to note about Terrapin is that the attackers need to be in an adversary-in-the-middle position at the network layer to intercept and modify the handshake exchange, and the connection must be secured by either ChaCha20-Poly1305 or CBC with Encrypt-then-MAC. The data in the messages exchanged after the completion of the handshake determines the severity of the attack's repercussions.

"The Terrapin attack exploits weaknesses in the SSH transport layer protocol in combination with newer cryptographic algorithms and encryption modes introduced by OpenSSH over 10 years ago," say the researchers, adding that "These have been adopted by a wide range of SSH implementations, therefore affecting a majority of current implementations."

News URL

https://www.bleepingcomputer.com/news/security/terrapin-attacks-can-downgrade-security-of-openssh-connections/