Hacker News Reader

Hacker News

Comment by pizlonator | Hacker News Reader

Parent Full thread

pizlonator

There are a lot of systems that meet those requirements.

> - sshd compiled with musl

So alpine as well as a bunch of other embedded Linuxes. Huge install base.

> - not using PAM

What you get if you try to have a minimal setup. Default sshd config if you install from source.

> - password logins enabled

The default. Super common.

> - at least one account with '*' as the password "hash"

Almost every Linux system.

> - at least one OTHER account with a valid password

Almost every Linux system.

So sure, there are caveats, but they cover a massive install base.

This is a super bad bug

View on HN

How many alpine installs are running sshd? Most containers using it as a base image aren't. Embedded Linux is unlikely to be running it, too. And if one IS running sshd, how often is it with unchanged defaults? I don't buy the inference here.

I'll concede that embedded linux might be my blindspot here. Maybe cheap web hosting, too, but that seems much less likely to be using musl.

Embedded linux is your blindspot here.

Yes

Most embedded systems I've seen use glibc or uClibc. I agree it would make sense for them to use musl, but the embedded space moves very slowly.

Rumor has it that Cisco has been hurriedly patching something and refusing to tell their customers what it is. I'm thinking it's this.

A lot of embedded systems use musl and no PAM. Some of them might use Alpine, but the distribution doesn't matter that much.

And ssh? I'd assume most would use proprietary or industry-specific standard for data IO, or just https, for domestic IoT stuff

And also ssh in many cases.

I thought Dropbear was pretty much the defacto SSH server for embedded applications, is OpenSSH+musl actually a common combination for these scenarios?

Well, OpenWrt is OpenSSH + musl.

OpenWrt uses Dropbear by default:

https://openwrt.org/docs/guide-user/services/ssh/transfer_dr...

We don’t know that dropbear isn’t vulnerable. The bug here is in musl and OpenSSH is just being a bro by working around it

I wouldn't say the bug is only in musl. Musl is probably the "worst" offender here (at least choose something other than "*"!), but the change in sshd was also a little suspect. i.e. the "let's find a user and take their salt (and hashing algorithm) and use it to compute and compare the hash to avoid timing attacks" change.

I haven't thought it through, but I suspect in an ideal world, sshd shouldn't have accepted the user password regardless of the outcome of crypt() if the user did not exist and it only pretended to go through the motions to avoid a timing attack.

Did look into their patch yesterday(?) which seemed to mitigate this issue which they (rightfully IMHO) consider caused by musl. But it seems their fix is to do a sanity check on the supposed hashed password char length, and thus still theoretically still allowing the possibility of those "!!!INVALID_PASSWORD!!!" suggestions to fall through....

Tried it, doesn't work.

Some use Dropbear, some use openssh.

This vulnerability clearly is not one that affects everyone like the PHP vulnerability did. But it's exposure is still significant and very easy to exploit. As easy as it gets.

Most of those would be using dropbear rather than openssh.

> Most containers using it as a base image aren't.

On top of the embedded linux blindspot, this statement seems unfounded.

> if one IS running sshd, how often is it with unchanged defaults?

By definition, I would imagine the answer to this is most of the time.

For what it's worth, default Alpine installs don't have an account with * as its password hash if you use the root account as your main one. Not sure if that's also true for ones where you set up a user, maybe those ones are vulnerable.

I'm genuinely curious what's the Venn diagram here because I feel a lot of embedded systems precisely have one condition but not the other, e.g. password yes but not necessarily multiple accounts, e.g root only, while using musl. Namely almost all for almost all, but if only one is not overlapping another then it's actually very few.

>> - at least one account with '*' as the password "hash"

> Almost every Linux system.

But not, notably, on Alpine, which uses '!' instead.

Edit: or maybe yes on Alpine? I checked my desktop and it has zero *s in shadow, but Alpine's post seems to say they do use * sometimes

I thought they had a difference in meaning, i.e. * means the user has no password and ! means that password logins are disabled for this user, but the man page does not make it clear if there's a distinction.

From man 5 shadow:

> A password field which starts with an exclamation mark means that the password is locked.

> If the password field contains some string that is not a valid result of crypt(3), for instance ! or *, the user will not be able to use a unix password to log in (but the user may log in the system by other means).

does this really matter? It could be used to do something devastating. The number of systems that match those requirements is only one factor. If just a handful of those are highly critical for humanity it could lead to disaster. Eg. hacks into fridges, centrifuges etc.

Updates since this was posted:

- blue t-shirts and green socks have been added to the default loadout for new hackers, since it's optimal according to AI and costs nothing to the attacker in terms of compute

- there are so many ley line "maps" out there that basically any server placement counts as aligned with at least two, so this one's free also

Blue t shirts and green socks?

Vulnerability-branded merch? Unsure.

Someone owns a blue shirt/green socks clearance warehouse, this is all just and ad? I've seen weirder. I can imagine visiting SanFran in a few months, and it looks like a weird sci-fi movie scene, everyone dressed the same.

SF has puffer jackets. Milan has men in blue suits. Paris has women whose wardrobes consist of black and white.

> password logins enabled

Disabling sshd password logins is security 101, and the default for some cloud provided images these days. If password logins haven't been disabled, what other doors have been left open anyway?

Now the question for the man: would fil-c prevent it :D

> > - password logins enabled

> The default. Super common.

This always seems bonkers to me. I think SSHD should give you ONE password free connection of setup to copy your key over and then it just shuts the door behind it.

I think it has to be a time limited FREE offer. (like, seriously, what if the user doesn't take the offer?)

It might actually a good idea, but I would likely avoid it since my built-in Bayesian filter would just mark it as spam.

Not sure why you're getting downvoted as from security standpoint that would be the right thing to do; but actual good server providers take it up a notch and allow you to upload the public key through their admin panel during server set up and the password you get only works locally for sudo etc. There's no reason why a fresh Linux setup should ever offer a publicly available SSH server with password based auth out of the box.

Reply on news.ycombinator.com