A group of researchers from Ruhr University in Bochum (Germany) has introduced a new MITM attack technique on SSH called Terrapin, which exploits the vulnerability (CVE-2023-48795) in the protocol. An attacker capable of orchestrating a MITM attack can block the transmission of the message containing protocol extension settings during the connection negotiation, thus reducing the security level of the connection. A prototype toolkit for executing the attack has been published on GitHub.
In the context of OpenSSH, the vulnerability, for example, allows for the downgrading of the connection to use less secure authentication algorithms and disables protection against attacks via side channels that reconstruct input by analyzing delays between keystrokes. In the Python library AsyncSSH, combined with the vulnerability (CVE-2023-46446) in the implementation of the internal state machine, the Terrapin attack allows for intrusion into an SSH session.
The vulnerability affects all SSH implementations that support ChaCha20-Poly1305 or cipher modes in CBC combined with the ETM (Encrypt-then-MAC) mode. Such capabilities have been available in OpenSSH for over 10 years. The vulnerability is blocked in the current release of OpenSSH 9.6, as well as in the updates for PuTTY 0.80, libssh 0.10.6/0.9.8, and AsyncSSH 2.14.2. In Dropbear SSH, the fix has already been added to the code, but a new release has not yet been made.
The vulnerability arises from the fact that an attacker controlling the traffic of the connection (for example, the owner of a malicious wireless access point) can adjust the sequence numbers of the packets during the connection negotiation and achieve the unnoticed removal of an arbitrary number of SSH service messages sent by the client or proxy server. Among other things, the attacker can delete SSH_MSG_EXT_INFO messages that are used to configure the applied protocol extensions. To prevent the other side from detecting the packet loss due to a gap in the sequence numbers, the attacker initiates the sending of a dummy packet with the same sequence number as the removed packet. The dummy packet contains a message with the SSH_MSG_IGNORE flag, which is ignored during processing.
An attack cannot be carried out using stream ciphers and CTR, as integrity violations will be detected at the application level. In practice, only the ChaCha20-Poly1305 cipher (chacha20-poly1305@openssh.com) is vulnerable, where the state is tracked only by the message sequence numbers, and the combination of Encrypt-Then-MAC mode (*-etm@openssh.com) and CBC ciphers.
In OpenSSH 9.6 and other implementations, a protocol extension called 'strict KEX' has been implemented to block attacks, which is automatically enabled if supported on the client's side. server The extension terminates the connection upon receiving any abnormal or extraneous messages (for example, with the SSH_MSG_IGNORE or SSH2_MSG_DEBUG flag) during the key exchange negotiation, as well as resets the MAC (Message Authentication Code) counter after each key exchange is completed.
Source: opennet.ru
