{"id":112308,"date":"2023-12-19T03:10:22","date_gmt":"2023-12-19T01:10:22","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/terrapin-uyazvimost-v-protokole-ssh-pozvolyayushhaya-snizit-zashhitu-soedineniya"},"modified":"2023-12-19T03:10:22","modified_gmt":"2023-12-19T01:10:22","slug":"terrapin-uyazvimost-v-protokole-ssh-pozvolyayushhaya-snizit-zashhitu-soedineniya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pl\/blog\/news\/terrapin-uyazvimost-v-protokole-ssh-pozvolyayushhaya-snizit-zashhitu-soedineniya","title":{"rendered":"Terrapin \u2014 podatno\u015b\u0107 w protokole SSH, kt\u00f3ra umo\u017cliwia obni\u017cenie bezpiecze\u0144stwa po\u0142\u0105czenia","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Grupa badaczy z Uniwersytetu Ruhry w Bochum (Niemcy) zaprezentowa\u0142a now\u0105 technik\u0119 ataku MITM na SSH \u2013 Terrapin, wykorzystuj\u0105c\u0105 luk\u0119 (CVE-2023-48795) w protokole. Atakuj\u0105cy, zdolny do przeprowadzenia ataku MITM, mo\u017ce w trakcie negocjacji po\u0142\u0105czenia zablokowa\u0107 wysy\u0142anie wiadomo\u015bci z ustawieniem rozszerze\u0144 protoko\u0142u w celu zmniejszenia poziomu zabezpiecze\u0144 po\u0142\u0105czenia. Prototyp narz\u0119dzia do przeprowadzenia ataku zosta\u0142 opublikowany na GitHubie. <\/p>\n

W kontek\u015bcie OpenSSH luka ta na przyk\u0142ad pozwala na prze\u0142\u0105czenie po\u0142\u0105czenia na mniej zabezpieczone algorytmy uwierzytelniania oraz na dezaktywacj\u0119 ochrony przed atakami po\u015brednimi, kt\u00f3re odtwarzaj\u0105 wej\u015bcie poprzez analiz\u0119 op\u00f3\u017anie\u0144 mi\u0119dzy naci\u015bni\u0119ciami klawiszy na klawiaturze. W bibliotece Python AsyncSSH, w po\u0142\u0105czeniu z luk\u0105 (CVE-2023-46446) w implementacji wewn\u0119trznego automatu stan\u00f3w, atak Terrapin pozwala na wtykanie si\u0119 w sesj\u0119 SSH. <\/p>\n

Luka dotyczy wszystkich implementacji SSH, kt\u00f3re wspieraj\u0105 ChaCha20-Poly1305 lub szyfry w trybie CBC w po\u0142\u0105czeniu z trybem ETM (Encrypt-then-MAC). Na przyk\u0142ad, podobne mo\u017cliwo\u015bci dost\u0119pne s\u0105 w OpenSSH od ponad 10 lat. Luka zosta\u0142a zablokowana w dzisiejszym wydaniu OpenSSH 9.6 oraz w aktualizacjach PuTTY 0.80, libssh 0.10.6\/0.9.8 i AsyncSSH 2.14.2. W Dropbear SSH poprawka zosta\u0142a ju\u017c dodana do kodu, ale nowe wydanie na razie nie zosta\u0142o wydane. <\/p>\n

Luka jest spowodowana tym, \u017ce atakuj\u0105cy, kontroluj\u0105cy ruch po\u0142\u0105czenia (na przyk\u0142ad w\u0142a\u015bciciel z\u0142o\u015bliwego punktu dost\u0119powego), mo\u017ce zmodyfikowa\u0107 numery porz\u0105dkowe pakiet\u00f3w w trakcie negocjacji po\u0142\u0105czenia i w ten spos\u00f3b niezauwa\u017calnie usun\u0105\u0107 dowoln\u0105 liczb\u0119 komunikat\u00f3w SSH wysy\u0142anych przez klienta lub serwerem<\/a>. W szczeg\u00f3lno\u015bci atakuj\u0105cy mo\u017ce usun\u0105\u0107 komunikaty SSH_MSG_EXT_INFO, kt\u00f3re s\u0105 u\u017cywane do ustawiania wykorzystywanych rozszerze\u0144 protoko\u0142u. Aby druga strona nie zauwa\u017cy\u0142a znikni\u0119cia pakietu z powodu przerwy w numerach porz\u0105dkowych, atakuj\u0105cy inicjuje wysy\u0142anie fikcyjnego pakietu z tym samym numerem porz\u0105dkowym, co usuni\u0119ty pakiet. Fikcyjny pakiet zawiera komunikat z flag\u0105 SSH_MSG_IGNORE, kt\u00f3ry jest ignorowany podczas przetwarzania.

\"Terrapin<\/center> <\/p>\n

Atak nie mo\u017ce by\u0107 przeprowadzona przy u\u017cyciu szyfr\u00f3w strumieniowych i CTR, poniewa\u017c naruszenie integralno\u015bci zostanie wykryte na poziomie aplikacji. W praktyce atakowi podlega tylko szyfr ChaCha20-Poly1305 (chacha20-poly1305@openssh.com), w kt\u00f3rym stan \u015bledzenia oparty jest wy\u0142\u0105cznie na numerach kolejnych wiadomo\u015bci oraz na po\u0142\u0105czeniu z trybem Encrypt-Then-MAC (*-etm@openssh.com) i szyfrach CBC. <\/p>\n

W OpenSSH 9.6 i innych implementacjach w celu zablokowania ataku wprowadzono rozszerzenie protoko\u0142u \u201estrict KEX\u201d, kt\u00f3re automatycznie w\u0142\u0105cza si\u0119 przy wsparciu po stronie serwera<\/a> i klienta. Rozszerzenie ko\u0144czy po\u0142\u0105czenie w przypadku otrzymania jakichkolwiek nietypowych lub zb\u0119dnych wiadomo\u015bci (na przyk\u0142ad z flag\u0105 SSH_MSG_IGNORE lub SSH2_MSG_DEBUG), kt\u00f3re zosta\u0142y odebrane w trakcie negocjacji po\u0142\u0105czenia, a tak\u017ce resetuje licznik MAC (Message Authentication Code) po zako\u0144czeniu ka\u017cdej wymiany kluczy.
\n
\u0179r\u00f3d\u0142o: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0420\u0443\u0440\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0432 \u0411\u043e\u0445\u0443\u043c\u0435 (\u0413\u0435\u0440\u043c\u0430\u043d\u0438\u044f) \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u043d\u043e\u0432\u0443\u044e \u0442\u0435\u0445\u043d\u0438\u043a\u0443 MITM-\u0430\u0442\u0430\u043a\u0438 \u043d\u0430 SSH — Terrapin, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0449\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2023-48795) \u0432 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0435. \u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439, \u0441\u043f\u043e\u0441\u043e\u0431\u043d\u044b\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c MITM-\u0430\u0442\u0430\u043a\u0443, \u0438\u043c\u0435\u0435\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435 \u0441\u043e\u0433\u043b\u0430\u0441\u043e\u0432\u0430\u043d\u0438\u044f \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f \u0441 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u043e\u0439 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0439 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 \u0434\u043b\u044f \u0441\u043d\u0438\u0436\u0435\u043d\u0438\u044f \u0443\u0440\u043e\u0432\u043d\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f. \u041f\u0440\u043e\u0442\u043e\u0442\u0438\u043f \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f \u0434\u043b\u044f \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u043d\u0430 GitHub. \u0412 \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442\u0435 OpenSSH \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":112309,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-112308","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Terrapin \u2014 luka bezpiecze\u0144stwa w protokole SSH, kt\u00f3ra pozwala na obni\u017cenie ochrony po\u0142\u0105czenia | ProHoster","description":"Grupa badaczy z Uniwersytetu Rury w Bochum (Niemcy) zaprezentowa\u0142a now\u0105 technik\u0119 ataku MITM na SSH - Terrapin, wykorzystuj\u0105c\u0105 luk\u0119 (CVE-2023-48795) w protokole.","canonical_url":"https:\/\/prohoster.info\/pl\/blog\/news\/terrapin-uyazvimost-v-protokole-ssh-pozvolyayushhaya-snizit-zashhitu-soedineniya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pl_PL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Terrapin \u2014 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0435 SSH, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0441\u043d\u0438\u0437\u0438\u0442\u044c \u0437\u0430\u0449\u0438\u0442\u0443 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0420\u0443\u0440\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0432 \u0411\u043e\u0445\u0443\u043c\u0435 (\u0413\u0435\u0440\u043c\u0430\u043d\u0438\u044f) \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u043d\u043e\u0432\u0443\u044e \u0442\u0435\u0445\u043d\u0438\u043a\u0443 MITM-\u0430\u0442\u0430\u043a\u0438 \u043d\u0430 SSH - Terrapin, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0449\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2023-48795) \u0432 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0435.","og:url":"https:\/\/prohoster.info\/pl\/blog\/news\/terrapin-uyazvimost-v-protokole-ssh-pozvolyayushhaya-snizit-zashhitu-soedineniya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-12-19T01:10:22+00:00","article:modified_time":"2023-12-19T01:10:22+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"112308","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-09 21:46:41","updated":"2026-02-22 15:30:29","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/112308","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/comments?post=112308"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/112308\/revisions"}],"predecessor-version":[{"id":162280,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/112308\/revisions\/162280"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/media\/112309"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/media?parent=112308"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/categories?post=112308"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/tags?post=112308"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}