Hacker News Reader

Comment by peteretep | Hacker News Reader

That’s a neat demo. Am I right to think it’s exceptionally difficult — without local exec access on a machine — to induce a machine to open an ssh connection to an arbitrary host?

View on HN

If you try to SSH into some new machine that you own, someone can redirect your request to an attacker's machine (via DNS attacks or MITM), and since it's a new machine, it won't be in your known_hosts file, so it will prompt if you want to trust this machine and 99% of people will say yes.

openssh makes the situation worse because if the key is already in your host file and it's just the ip/domain that changed it will not tell you that it recognises the key.

I mean, if a mitm has your SSH server key, chances are you are screwed anyway.

In the case which I am describing nobody other than you has your key.

But the key you are talking about the SSH client recognising is the server key right? Or did you mean after authorising your SSH client to connect to the unknown machine, and the key you were talking about was the identity public key? I ask because the thread you commented on was discussing users not looking carefully which servers they connect to when connecting to new servers, and that is based on the SSH servers key, not your identity key, which is why I said that if someone who is able to redirect your SSH connection to a different server also owns the correct servers SSH server key (as you said "just the ip/domain that changed"), then there isn't much the client can do to help keep you safe anyway.

> But the key you are talking about the SSH client recognising is the server key right?

Correct

> which is why I said that if someone who is able to redirect your SSH connection to a different server

I will try to be more clear. Often when I am away I use ssh to connect to my desktop pc which has a dynamic IP address. Even though I have already stored the public key of my server in known_hosts it keeps asking me to verify if I trust its public key every time that it changes IP address without even mentioning that it has met said public key before. So if I am not careful enough I might end up accepting the public key regardless, even if I am being MITMed.

This misunderstanding could have been avoided by formulating your initial statement like this:

>openssh makes the situation worse because +even+ if the key is already in your host file and it's just the ip/domain that changed it will not tell you that it recognises the key.

Ah, yes, I've always found that to be a little strange. It is cryptographically possible for the server to establish to the client that it is who it says it is, just on a different IP

Sorry for the confusion, I misread your initial comment, thought you were saying it does what we're saying would be a good behaviour, and was confused as to why you thought this was a problem, but it was just I who was confused!

Probably cannot induce the local machine to connect, but if you enabled agent forwarding, and then connected to a machine, someone who compromised that machine may be able to use your credentials to connect to other SSH servers.

Source: https://heipei.io/2015/02/26/SSH-Agent-Forwarding-considered...

I'm not sure I follow, induce what to open an ssh connection? If you mean the service in question (whoami.filippo.io) it is opening an ssh connection it just displays a message and closes instead of authenticating you and dropping you into a shell. If you mean launch an ssh session from a machine to something in general then yes you have to be able to execute programs on the machine as that's all an ssh client is - another program.

I think the question is if it's possible to add <img src=ssh://> to a webpage and have something dumb happen.

Exactly that, and I'm reasonably sure the answer is no.

I am sure there is some setup where that will work. Set a URL handler to open Emacs, format the filename as a TRAMP path, something like that. There are plenty of things that try to transparently SSH places, and I'm sure someone has accidentally hooked that into their browser.

Reply on news.ycombinator.com