Thread

1. 3dedb728-3f77 · 1785727851 · focus · HN ↗

   Hey, is it not just a simple honeypot reverse hack ssh server?

   People understand that reverse hacking can happen when connecting to random ssh server, right?

   1. scubbo · 1785732090 · focus · HN ↗

      > People understand that reverse hacking can happen when connecting to random ssh server, right?

      No, actually, I've never heard of such a vector. How would that work?

      1. jerrythegerbil · 1785733936 · focus · HN ↗

         An ssh server would exploit a vulnerability in the ssh client when it connects.

         For example, openssh has both a client and server. There’s been vulnerabilities in openssh, in the client. Those vulnerabilities aren’t reachable unless you’re connecting to a server attempting to exploit you, so the risk is quite low because you know and trust most servers you’re connecting to with ssh.

         To sum it up: Connecting to this server is probably fine, but in doing so most people are doing something significantly riskier without realizing it.

         1. applfanboysbgon · 1785737409 · focus · HN ↗

            There has never been a real-world OpenSSH exploit that allows a server to RCE a client that connected to it without a bunch of dubious qualifiers. Connecting to a random SSH server is much, much less dangerous than running a random binary or executing a random curl install script, both of which people do all the time, and is probably about on par with the likelihood of a random website escaping your browser's sandbox and RCEing you.

            1. Oxodao · 1785740091 · focus · HN ↗

               If you properly set up your ssh client (No agent forwarding or X11 forwarding)

               1. LoganDark · 1785743778 · focus · HN ↗

                  Terminal, too; some escape sequences are able to perform attacks in old or buggy terminal emulators.

                  1. tyingq · 1785765110 · focus · HN ↗

                     Even newer ones. Iterm2 had CVE-2026-41253 recently. Or things like Tmux.

                     1. LoganDark · 1785770409 · focus · HN ↗

                        Yes, I was thinking of iTerm2. "Older" means not the latest release and "buggy" includes well-intentioned vulnerabilities.

                        1. tyingq · 1785773993 · focus · HN ↗

                           Sure. 3.6.9 (which was affected) was the most recent iTerm2 when that CVE came out.

                           1. LoganDark · 1785775838 · focus · HN ↗

                              Hence "or"

Unofficial Hacker News client; not affiliated with Y Combinator.