454
Meet *sshole, the vulnerability that lets hackers SSH into Linux devices (arstechnica.com)
submitted 4 days ago by to c/technology@lemmy.world
126 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 70 points 4 days ago (22 children)

It seems like the pattern emerging is that AI is great at finding these obscure vulnerabilities that are only exploitable on very particular systems with very particular, non-typical configurations, and only on nights where unicorns fart candycorn.

Sure, fix them, but the hype is too much. Also, disable password auth on SSH already. Jesus. Keys arnt that hard.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 22 child comments
    •
  • [–] 23 points 4 days ago (2 children)

    I agree about the AI, but desktop Linux has never been under haxxor pressure the same way windows or apple has. I also think the newer parts of the userbase are less technical than even ten years ago. Previously undocumented bugs found and squashed is great for everyone.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 19 points 4 days ago (12 children)

    More like AI is much faster at finding obscure vulnerabilities, because it doesn't get tired of digging into the mind-numbing details of human-generated spaghetti code. Give a human the same kind of task, and they would die of boredom 12 hours into it.

    We're entering an age where AI is quickly cleaning up the stupid security holes that have been created by decades of human mistakes, and will continue to be this way until increased AI security reviews will become more standard. The tribals wielding spears will continue to get shot by superior firepower until they adapt to the same weapons and protection themselves.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 12 child comments
    •
  • [–] 10 points 4 days ago (7 children)

    "Cleaning up" seems a little generous. It's finding them, but someone still has to patch them.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 7 child comments
    •
  • [–] 3 points 3 days ago (1 child)

    "Finding" is also rather generous, going by numbers from Anthropic and from the Linux kernel, things like Mythos are wrong 95% of the time.

    They're much easier to run though, compared to more reliable tools. So even being wrong 95% of the time wins out if you've got 100x more people running them.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 2 days ago

    A 95% false positive rate isn't actually that big a deal if you have a good way to test the claims. I wonder if you could set it up CtF-style, where you don't get notified until the LLM can write to a specific file on the target box.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 1 point 3 days ago (4 children)

    Most vulnerability patches are a few lines of code. Finding it is the hard part.

    Even then, the AI session that found it probably already has a solution to fix it.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 4 points 3 days ago (3 children)

    In my experience, the LLM usually proposes a solution, but it's a crapshoot whether it works well. And plenty of bugfixes go well beyond a few lines, especially in older code.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 2 points 3 days ago (2 children)

    I use this shit on a daily basis at work. They work well, as long as you're choosing the right models, making the right engineering decisions, and have a good set of baseline rules.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 2 days ago (1 child)

    Do you have a guide on which baseline rules are good? I use Claude Opus 5.5 at work and while it's definitely more helpful than not having it, it also does some incredibly baffling things that a human would realize immediately are unproductive.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 2 days ago

    "Baseline" is subjective, so I'd recommend just start a global rules file and steer it away from the behaviors you don't like. Don't be afraid of quizzing the agent itself on why it did that thing, and what's a good bit of language to add to the rules file to prevent it from happening.

    Also, for specific tasks, skill files are really useful, and LLMs can write the whole thing, based on what you did the hard way in a session. Same thing for triggering a skill file and then ask it if there are any useful improvements to make to the skills file in the future, at the end of the session.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 6 points 4 days ago

    Yeah and this isn’t a new paradigm, in the sense that tools to find exploits have gotten better repeatedly and allowed those with enough knowledge to use the tools to find them, regardless of if they could manually craft the exploit themselves. There’s a multitude of bug bounties that have been claimed by those who knew how to let a reverse engineering tool like ghidra hammer away at something with variation for long enough. And the models are capable of novel exploits on their own, but generally they are just doing the same, hammering ghidra with an MCP at accelerated scale. So “only ai would have found this bug” is technically untrue and moot.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 2 points 4 days ago (2 children)

    This example demonstrates my point though. It requires an extremely unusual system configuration that may or may not even exist in the real world it is so unusual. AI doesnt get tired, like you said, but its not about spaghetti code (both musl and openssh are gold-standard opposite of spaghetti code), its about trying every possible software combination in ways a human wouldnt bother.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 3 days ago (1 child)

    It requires an extremely unusual system configuration that may or may not even exist in the real world it is so unusual.

    You have to remember that the same AI agents finding the code are also able to exploit the code. So, if it's some extremely rare race condition requiring some convoluted pattern, it's still easy to exploit.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] -1 points 3 days ago*

    When I stack dominoes in a line on the floor and I push one of them on the outside as it is in the shape of a snake... they fall down in a prdictable pattern. I never knew that would happen until I was shown the first time. This knowlege was past down via print made by humans scraped by bots. For what and for who? Louder faster and dumber.... on a foundation of jUsT gEt iT d0Ne... now you are fired. Loops, poops and dupes.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 3 points 3 days ago

    I think you're buying snake oil, my friend. What is "AI"? Statistical tools have been used in security auditing for decades.

    The people riding the AI bubble want you to think things are magically different right now, but we won't know that until we can get some solid data over the next year or five to do a proper comparison.

  • permalink
  • fedilink
  • source
  • parent
  • [+] -6 points 4 days ago (4 children)

    This particular vulnerability is precisely about logins with key. Using password login renders this vulnerability useless.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 23 points 4 days ago (2 children)

    Using password login renders this vulnerability useless.

    This isn't the case, though I can see how the article could lead you to believe that.

    It's directly based on password rather than key input. The entire vulnerability is that typing a password longer than 256 characters automatically defaults to crypt() outputting the * character instead of a normal password hash, which is coincidentally the same default character used as the "hash" (not actually a value you could get from a normal hash, intended to be impossible to get from any normal password for that reason) for the built-in daemon account.

    When the Ars Technica article says "Second, the target system account must be configured to be passwordless", what they mean is the default daemon account, which has a hash set to * by default, and thus wouldn't normally be accessible via any hashed password... unless you happen to find out that the system chooses to not make a hash, and just send * if you type more than 256 characters.

    Look at https://sshhole.com/ if you want the details.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 3 points 4 days ago

    Technically they're correct though, in a way. If every account has a password, the system isn't vulnerable.

    You're also not vulnerable if you use two factor auth, because all 2FA modules require PAM, whereas this vulnerability only exists when PAM is disabled or not installed.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 4 points 4 days ago

    Other way around. This requires a passwordless account configured with sha256 or sha512 password hash, musl system with openssh installed, no PAM, and password authentication allowed:

    When logging into a passwordless account, the attacker can gain access by inputting more than 256 characters in the password field.

  • permalink
  • fedilink
  • source
  • parent