Mosh: An Interactive Remote Shell for Mobile Clients (2012) [pdf]

Re:Mosh: An Interactive Remote Shell for Mobile Clients (201... by jbj on Thursday November 24, 2022 @12:27PM (#33733872)

I have been using mosh on and off, and actually appreciated that the software was so robust that it just works without frequent updates, and as far as I understand, most security is in ssh, so there would not really be a need for a new version.

[ Parent | on HN ]

Re:Mosh: An Interactive Remote Shell for Mobile Clients (201... by loeg on Thursday November 24, 2022 @12:53PM (#33734177)

Your understanding is sort of mistaken. Mosh does an initial handshake over ssh, but after that it’s a custom UDP protocol. There have been and could be more security bugs in that UDP protocol.

[ Parent | on HN ]

Re:Mosh: An Interactive Remote Shell for Mobile Clients (201... by achernya on Thursday November 24, 2022 @01:06PM (#33734389)

The only mosh CVE [1] was in the terminal emulator (a DoS that could only be triggered by a local user), not in the protocol. There have been no vulnerabilities in mosh's UDP protocol.

[1] https://nvd.nist.gov/vuln/detail/CVE-2012-2385

[ Parent | on HN ]

Re:Mosh: An Interactive Remote Shell for Mobile Clients (201... by nibbleshifter on Thursday November 24, 2022 @02:20PM (#33735210)

yet.

I wonder if anyone's thrown a fuzzer at it.

[ Parent | on HN ]

Re:Mosh: An Interactive Remote Shell for Mobile Clients (201... by achernya on Thursday November 24, 2022 @02:31PM (#33735314)

Yes, mosh has fuzz tests in oss-fuzz [1].

[1] https://github.com/google/oss-fuzz/tree/master/projects/mosh

[ Parent | on HN ]

Re:Mosh: An Interactive Remote Shell for Mobile Clients (201... by jbj on Thursday November 24, 2022 @12:57PM (#33734244)

Ahh, thanks for clarifying! Yes, in that case it is very appreciated to see recent updates.

[ Parent | on HN ]