News for hackers. Stuff that matters.

A comment on Duplicate SSH Keys Everywhere. Parent comment

Re:Duplicate SSH Keys Everywhere by shuzchen on Tuesday February 17, 2015 @05:47PM (#9065675)
From the very first paragraph of that link: "Should ... an attacker manage to steal the private key ... the connection becomes vulnerable to active man-in-the-middle attacks".

Thus, all these machines with duplicate keys are VERY vulnerable to MITM, because anyone with access to one of them has access to the private key.

[ Parent | on HN ]
Re:Duplicate SSH Keys Everywhere by jewel on Tuesday February 17, 2015 @06:37PM (#9065962)
But in the second paragraph:

"there are no tools implementing MITM against an SSH connection authenticated using public-key method ... Being pressed to produce a PoC for this attack, I have attempted to implement it only to discover it is quite impossible and here is why."

[ Parent | on HN ]