Re:Terrapin Attack for prefix truncation in SSH
by pas on Wednesday December 20, 2023 @10:34AM
(#38709775)
it seems obvious that as long as there's no disclosure there's no real need to fix things. audits mean nothing if suddenly things can disappear from The Scope and appear somehow mItIgAtEd.
Re:Terrapin Attack for prefix truncation in SSH
by archi42 on Wednesday December 20, 2023 @11:01AM
(#38710098)
"But they're ISO certified!" /s
Strictly speaking audit is the wrong word for what I did (I'm not a certified auditor). I don't want to say too much in case I break some confidentiality agreement. Though I'm curious how that will be argued away, or if they get the manufacturer to get their shit together and build a new firmware...
Uh, if it was that easy. I recently(!) audited a brand new system for deployment in what most nations consider critical infrastructure. They had just updated to the newest firmware supplied by a well-known and established manufacturer in that industry (not some garbage by a small company). That ran a dropbear ssh server version from 2016 with multiple CVEs, including an unauthenticated RCE. So essentially it's a root shell for anyone that can talk IP to that device.
I predict I will start seeing this terrapin in my Nessus reports soon, and stop seeing it when I enter pension.