HD·摩尔与罗布·金_安全外壳混乱不堪.pdf

1、BLACK HAT BRIEFINGSSecure Shellsin ShamblesHD MOORE|ROB KING|AUGUST 7,2024Agenda2This is a talk about the evolution of the Secure Shell(SSH)An overview of the SSH ecosystemWhats changed&what hasntNew&interesting attacksOpenSSH fragmentationIntroducing SSHambleDefending SSH2024In the beginning was SS

2、H3Tatu Ylnen created SSH v1 in 1995 as freewareContinued development as the proprietary SSH.comBjrn Grnvall forked Ylnens free SSH v1.2.12 as OSSHOpenBSD forked OSSH into OpenSSH in 1999199519961997199819992000200120022003200420052006SSHOSSHOpenSSHOpenSSH PortablePKIX-SSHDropbearOpenSSH20,200,340Dro

3、pbear sshd5,482,314Linksys WRT45G modified dropbear sshd46,214lancom sshd43,574SCS sshd8,215HP Integrated Lights-Out mpSSH7,493WeOnlyDo sshd6,458ZyXEL ZyWALL sshd3,417NetScreen shhd1,854DrayTek Vigor 2820n ADSL router sshd1,848CoreFTP sshd1,700SSH is mostly OpenSSH&Dropbear4https:/www.shodan.io/sear

4、ch/facet?query=shodan.module%3A%22ssh%22&facet=productNot-OpenSSH/Dropbear are importantFirewall,networking,&storageCisco,NetScreen,Adtran,ComWare,LancomOT/ICS equipmentSiemens,NetPower,Mocana,CradlePoint,DigiSensitive applicationsMOVEIT,CrushFTP,GlobalScape,JSCAPEBitVis,GoAnywhere,ConfDGerrit,Forge

5、jo,GitlabOther implementations5Standalone product examplesSSH library examplesPKIX-SSH popular in networking equipment,forked from OpenSSHWolfSSH small implementation popular in embedded systemslsh an old implementation that predates OpenSSH Portablelibssh open source,bindings forlots of languagesGo

6、 x/crypto/ssh a pure Go implementationApache MINA a Java implementationParamiko SSH in PythonSSH is everywhere6Second-most common remote admin service behind HTTPEnabled by defaultin cloudsPart of every major OSEmbedded&serversEven mobile!https:/exposure.shodan.io/#/USMostly SSHEncryptedTransportCle