Tell HN: Ubiquiti APs probably vulnerable to Terrapin due to unpatched Dropbear
{{HOSTNAME}} = U6-Enterprise running firmware v6.6.65
$ Terrapin_Scanner_MacOS_arm64_darwin -connect {{HOSTNAME}}
================================================================================
==================================== Report ====================================
================================================================================
Remote Banner: SSH-2.0-dropbear_2020.81
ChaCha20-Poly1305 support: true
CBC-EtM support: false
Strict key exchange support: false
The scanned peer is VULNERABLE to Terrapin.
Note: This tool is provided as is, with no warranty whatsoever. It determines
the vulnerability of a peer by checking the supported algorithms and
support for strict key exchange. It may falsely claim a peer to be
vulnerable if the vendor supports countermeasures other than strict key
exchange.
For more details visit our website available at https://terrapin-attack.com
$ ssh {{HOSTNAME}}
{{HOSTNAME}}-BZ.6.6.65# dropbear --help
Invalid option --
Dropbear server v2020.81 https://matt.ucc.asn.au/dropbear/dropbear.html
Usage: dropbear [options]
References:
https://terrapin-attack.com/patches.html
https://github.com/mkj/dropbear/releases
https://github.com/mkj/dropbear/issues/270
https://community.ui.com/questions/UbiOS-Dropbear-upgrade/b66ca71f-adef-4a3f-b6c6-2d26f9d3bc67