Cybersecurity

5650 readers

53 users here now

c/cybersecurity is a community centered on the cybersecurity and information security profession. You can come here to discuss news, post something interesting, or just chat with others.

THE RULES

Instance Rules

Be respectful. Everyone should feel welcome here.
No bigotry - including racism, sexism, ableism, homophobia, transphobia, or xenophobia.
No Ads / Spamming.
No pornography.

Community Rules

Idk, keep it semi-professional?
Nothing illegal. We're all ethical here.
Rules will be added/redefined as necessary.

If you ask someone to hack your "friends" socials you're just going to get banned so don't do that.

Learn about hacking

Hack the Box

Try Hack Me

Pico Capture the flag

Other security-related communities [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected]

Notable mention to [email protected]

founded 1 year ago

MODERATORS

[email protected]

New SSH-Snake malware steals SSH keys to spread across the network (www.bleepingcomputer.com)

submitted 8 months ago by [email protected] to c/[email protected]

4 comments fedilink hide all child comments

SSH-Snake, a network mapping tool, has been adapted by hackers to stealthily find and use private SSH keys for lateral movements in targeted networks. Identified by Sysdig as a self-altering worm, it diverges from standard SSH worms by avoiding predictable attack patterns. Launched on January 4, 2024, it's a bash script that self-modifies to minimize detection, scanning directories, shell histories, and system logs to find SSH credentials. Sysdig confirmed its use after detecting a C2 server storing data from around 100 victims, indicating the exploitation of Confluence vulnerabilities for access. SSH-Snake represents a significant evolution in malware, exploiting the widely used SSH protocol in businesses.

all 5 comments

sorted by: hot top controversial new old

[–] [email protected] 7 points 8 months ago

This is why I keep my ssh credentials on a flash drive and add it to ssh agent for time limited periods. Adds some insulation.

[–] [email protected] 2 points 8 months ago (1 children)

SSH keys should always have paraphrases.

[–] [email protected] 2 points 8 months ago* (last edited 8 months ago)

At the very least keys without passphrases (such as for automated tasks) should restrict what commands can be run, should not give access to an interactive shell, and should go to a very specific user with as little file system access as is necessary to do the task. If an automated ssh task is giving access to the places you put your private keys and bash history, you're probably doing something very wrong.