News for hackers. Stuff that matters.

A comment on Trivial authentication bypass in libssh leaves servers wide open.

Re:Trivial authentication bypass in libssh leaves servers wi... by jzwinck on Wednesday October 17, 2018 @07:00PM (#18244555)
"GitHub isn’t vulnerable [...] my guess is you’ll be left with a small handful of random sftp servers or IoT devices and little else!”

That sounds reassuring. It's not as if hacking some random IoT device is going to win the jackpot.

Oh wait, it totally can: https://www.washingtonpost.com/news/innovations/wp/2017/07/2...

[ Parent | on HN ]
Re:Trivial authentication bypass in libssh leaves servers wi... by ploxiln on Thursday October 18, 2018 @01:02PM (#18250033)
Most embedded devices which have ssh server functionality use Dropbear. You'll have to look really hard to find anything which uses this "libssh" server functionality (which, again, is _not openssh_).
[ Parent | on HN ]