OpenSSH

What else is in the toolkit?

You'll need OpenSSH.

And finally, you'll need a command line JavaScript framework.

For our purposes today, we'll just refer to it broadly as the script framework.

I want to pause on OpenSSH for a second.

because I know SSH is used for remote access.

But if my test phone is literally sitting on the desk right in front of me, plugged into my laptop via USB, Why do we need to remotely log into it?

It's just a workflow thing.

Yeah.

Okay, next up we have from the OpenBSD journal Undeadly.org, OpenSSH 10.5 release contributed by Peter N.M. Hanstein from the SSH! SSL is the ring out to the World Department.

In another move that signals a new OpenBSD release is in the works, the OpenSSH project has released, without fanfare, its new version, OpenSSH 10.5.

The release notes read, Recently the SSH...

No, that's not how they read it.

Microsoft shipped the algorithms into Windows.

OpenSSL and OpenSSH have it built in.

The standards body NIST finalized the algorithms two years ago, and now the entire ecosystem has shipped.

Post-quantum crypto stopped being an availability problem.

Mm-hmm.

Because Cydia installs OpenSSH in the background, we can connect the phone to Wi-Fi, find its IP address, and use a computer terminal to SSH directly into the phone's root file system.

You're initiating a connection targeting the root user account, and it asks for a password.

And this is crazy to me.

I think I'm more balanced in terms of, I think any product has a potential, shall we say, to have a CVSS 10.

I think Timer Memorial has shown that, you know, if we go back to, Back in the day, we had OpenSSH with similar, you know, pretty much every technology that we had seen at some point either has demonstrated the ability to have or has had to have.

So I think I'm less surprised that it came to pass.

I think you have to be an optimist in these roles.

Standard SSH for Linux environments.

WinRM or OpenSSH for Windows.

It multiplexes the connection to speed things up, runs the modules, and then just drops the connection.

Which is brilliant.

Um, if you zoom out a little bit, we have kind of these pillars of s- the software industry as a whole, and they're...

It's really built on top of very large, highly scrutinized open source software projects like, like Linux, things like, um, OpenSSH, OpenSSL, um, protocols and standards and software libraries that are very well trusted, highly reviewed, very conservative in terms of like the change process, like what you have to go through to come in as a developer and make changes to those official software libraries.

And Bitcoin Core, you know, today the, the, the torch that carries the flame originally given to the world by Satoshi all those years ago is, is by and large, you know, one of the most trusted, heavily scrutinized, and conservative change processes for software in the world.

So we have this really great thing that Satoshi gave us, which is this, this great piece of software that's been iterated on a lot over the years and improved tremendously since it first released.

Like by and large, they're, they're unauditable.

Um, they're, they're massive attack surfaces because you're basically trusting the manufacturer with your secret, right? Um, if, if you're not...

You know, a lot of-- there's a lot of open source tooling like OpenSSH or OpenSSL that a lot of like websites, like the internet, for example, is built on top of this idea of having a secret that you generate that no one else knows, that you keep safe, that you use to sign a certificate that says, "Yes, this website is, at the very least, was published by the person who holds this key." That's an SSL certificate.

It's that HTTPS thing that you see all over the internet that, uh, we didn't used to have years ago when the internet was a lot crazier.

Hello, gentlemen.

Coming up on the show, we'll break down the OpenSSH flaw you probably need to know about.

And then we're going to attack our own systems in the spirit of finding issues before the bad guys do.

We're going to go over how to red team your own network for fun and security.

But you want to be able to use that throughout a network, right? So like you're going to one box and then you want to be able to still use your agent to be able to answer cryptographic questions further down the chain.

So that's where SSH agent forwarding comes in.

Well, there was an interaction between agent locking and OpenSSH's session binding that could allow certain operations that were supposed to stay local happen remotely through a forwarded agent.

Uh-oh.

And institutional sponsorship.

The OpenSSH project, born out of OpenBSD, now community-maintained, has provided continuous stewardship for over 25 years.

That's not a small thing.

Someone has to write the code, review the patches, respond to vulnerability reports, shepherd the RFC updates.

OpenSSH has done that without a corporate owner and without fragmentation.

That's

the graveyard and the exemplar.

That's the technical adaptability factor