Infecting SSH Public Keys with Backdoors

https://blog.thc.org/infecting-ssh-public-keys-with-backdoors

by zdw • 3 years ago

4 3 3 years ago

blog.thc.org

theamk2• 3 years ago

They are talking about command= option in authorized_keys file, not "public keys". And there are no tricks or other way to obfuscate it, looking at the authorized_keys file, it stands out very clearly, as one sees english words instead of random hex.

moreati• 3 years ago

The first paragraph claims (I've not tried it) that the same trick works in ~/.ssh/id_*.pub.

theamk2• 3 years ago

it lies, as neither ssh nor sshd does not care about .pub file at all. This file is written by ssh-keygen and only exists to make it easier to create authorized_keys.

I suppose one can put evil command into .pub file and wait until user does "cp id_foo.pub authorized_keys" without examining contents of either file. But that does not happen often at all (how often do you setup new machine?), and it is defeated trivially by checking authorized_keys file after you update it, something which is always a good idea anyway.

Infecting SSH Public Keys with Backdoors

Related Stories