0:00So, for the last couple weeks, a lot of what we've seen with these giant kind of vulnerabilities being exposed to the public is that it takes a pretty sophisticated attack to actually make it work. PHP, the big attack, it took like something like 19 hours for $1,000 to be stolen. So, it does take a little bit of time. Claude was able to reproduce the TCP vulnerability in about 45 minutes.
0:22But there's a new one in town. One that's so egregious that if you have an Alpine distribution of Docker, that means if you use say the default image for Docker for Alpine and then you happen to have SSHD open for the public to be able to access, well, anybody can just log in as root. There's a couple other requirements, but it's pretty much that straightforward. I mean, anybody.
0:46The write up in the vulnerability was discovered by Osgen. So, thank you very much for that. By the way, go check out his Twitter. It is linked below. This guy is obviously making magic happen or not magic. I'm not really. Either way, super fantastic. Great job. This has to be one of the wildest bugs. So, I'm going to go through it how it actually worked because when I read the article, I had so many questions and I did not actually understand how it worked, but I figured it out and I will talk to you about it. But, of course, before we do, a quick thank you from our sponsors.
1:16We've been building a lot of internal apps here at Terminal. Discord automation, a shared document editor, synchronized music player, a Minecraft server. One thing that's typically really annoying is getting everyone logged in. Well, not anymore with work OS. Work OS makes this easy with Pipes.
1:33With Pipes, anyone from Terminal can link their GitHub, their cursor, Twitch, whatever. And the best part, this is free for your first million users. So that means you and all of your friends will still have 999,999 seats left. And if you ever cross a million, you can trust Work OS just like Cursor does, Plaid, OpenAI, and many more. Check out Work OS today. Links in the description. So, the lovely vulnerability we're going over today that's going to be affecting like literally millions of Linux machines is
2:02SSH hole. I'm not really sure how to say it. I mean, I see a Claude logo right there. I mean, I'm not, you know, it's a little confusing. Now, this does not affect all Linux machines. You have to have SSHD running on an Alpine instance, Open Word or any muscle box with password off on. So not every Linux machine, but if you just use say the default recommended Alpine image on Docker and also have SSH on, yeah, you pretty much you pretty much getting had
2:30without the pluggable authentication modules PAM enabled. Effectively, there is a bug in open SSH and how it handles passwords that if you provide a password longer than 256 characters, boom, you could just log in like, "Hey, I'm root, baby. I'm logging in. Here's my password. All A's." And it's going to be like, "Dude, I love you. Come on in, man. Hey, you're root. What do you want to do? What are you doing around here?
2:55You come you come here often? [laughter] Nice IP." But to understand the bug, you need to understand the origin a little bit. It all starts with our boy Bill Joy. Now, if you don't know Bill Joy, you're an ignorant Bill Joy, he created the VI text editor in 1976. Yes, Vi, the spiritual father to Vim, which of course is the literal ancestor to Neo Vim. Neo Vim being the greatest text editor of all time. Bill Joy, top contender for programmer of the month.
3:24You know, I think it might just happen.
3:26So, back in the old days in 1980 on Unix, Bill Joy created this account called the Damon. And to prevent anyone from being able to log in, he set the password as just an asterk. Now, you're probably wondering what what does this mean? Why does an asterk prevent logging in? Well, it's simple. Let's just pretend Alice right here provides dolphins for her password. Well, it's going to go through a cryptography function. It's going to pass in dolphins plus a salt and out's going to come this kind of long hash. Then, it's going to
3:55go to the passwords and go, "Hey, inside the password file, what's your hash?
3:59Like, what does it look like?" And if they match, hey Alice, Alice, you're logged in. But of course, if they don't match, it's going to be like, "No, sorry, you're not logged in." And of course, this process since the '90s has taken place in this thing called Etsy/Shadow, which has, hey, here's the type of hashing algorithm we're going to use. Here's the salt right here, this ABC. Here's the expected hash that should come back out. So long as your password you provide plus the salt get hashed and they come out to be identical
4:27to whatever this hash says it should be.
4:30That is you. You're the user. Welcome onto the machine. Now that you kind of get login, we do have to sidebar for a quick second on PAM which is the pluggable authentication modules. And to quote the project, PAM provides a way to develop programs that are independent of authentication scheme. These programs need an authentication module to be attached to them at runtime in order to work. So think of open SSH you're logging into a machine. It needs an authentication scheme. Now this is kind of the cool part. So if you were to look
4:58at the open SSH code, it would look something like this. Like hey, do I have PAM enabled? If I do, I'm just going to log in with PAM. Now the cooler part about PAM is that say you are working at an enterprise and enterprise wants two-factor authentication. Well, it just works. Now it goes, hey, are you logged in? Are you like really who you say you are? And now you're going to have to say, "Yep, this is me logging into the machine via SSH." Cool. Okay, you're logged in. You are who you are.
5:25Fantastic. Else with Open SSH, it needed to have a way to be able to log in without PAMP. So, they kind of have their own little handrolled password check. Now, you're probably thinking, okay, so this is what happened, right?
5:37They screwed up the password checking.
5:39Actually, it's it's a little bit more confusing than that. Okay. All right. So going back to crypt, it turns out in the '9s that when they did this whole like password hashing scheme where you could have like dollar sign 6 dollar sign to say hey I want to use this particular hashing scheme if you provided say the wrong type of hashing scheme and the system didn't have it or just something went wrong during the processing it would actually return back out a null.
6:04Now, of course, everybody knows what happens with null, right? He crashes the program. And even Tony previous programmer of the month, said that this was a billiondoll mistake. And of course, Crypt did it, too. They had null. But about 20 years later, they actually, you know, undid their mistake.
6:20They got rid of null and said, "Hey, from here on out, we're returning a star." Now, you're probably thinking, "Okay, now I know where this is going."
6:28I mean, there's a star here. There's a star with Bill Joyy's Damon. This is probably it, right? Well, actually, it's still it's still just so much more ridiculous than that. And that is because this crypt function actually fell prey to a classic security bug in which anybody say working at a large company could accidentally pro I mean it's not like they're trying to program it and perhaps they find that this bug exists in a let's just throw out like a
6:57multi-billion dollar corporation that they accidentally programmed and it's in production and then they have to report to a security team and say whoopsie pups. I actually put a small little bug in here that a single request could take down a single machine in production.
7:10like it's really bad. We should fix it right now. And then I let's just say this theoretical person has to spend the next 3 months cleaning up their mess.
7:16Yeah. Well, this is effectively what Crypt figured out as well. They had what is now lovingly referred to as a repulsive grizzly attack vector in which a single lowvolume request could force a back-end service to generate billions of objects and crash the system. In this particular case, it's closer to a reax attack where a single request could cause your system to freeze indefinitely on CPU processing. And that is because if you provide a really really large string for your password, it turns out cryptography functions they could take
7:45some time processing like they're actually pretty CPU intensive and so you could just eat a CPU core with a single request by say sending in a 10,000 character long password. So crypt in their very smartness said okay if it's longer than 256 you get a star. Bad password though wrong. Now at this point you're probably saying okay now I know what's going on. No you don't. Not yet.
8:08Not yet. All right. So, let's bring it all together and actually show the bug.
8:12So, this is kind of like the final fun step. I can't believe that this is part of the problem, but it actually comes from a CVE 2016 6210 in which Ozun calls out on his most excellent article that you got to check out. But effectively, the CVE says SSHD and open SSH before 7.3 when Shaw 256 or Shaw 512 are used for user password hashing uses blowfish hashing on static passwords when a username does not exist, which allows a
8:41remote attacker to enumerate users by leveraging the timing difference between responses when large passwords are provided. It's probably easier if you just see the example. In other words, let's pretend Bob doesn't exist, Alice does exist. We're using, say, Shaw 512 for hashing. If I were to send a really large password before the CVE fix, Bob's answer would come back right away. Hey, password incorrect. But Alice, it would take a while. It's using a real kind of complicated hashing algorithm. And you can see right here that took way too long. So I could actually just determine
9:10by timing Bob's fake. Alice is real.
9:13Bob's always been fake though. No, nobody likes Bob. So the implication of this is that open SSH when it gets a user that's not supposed to be logged into or does not exist, it's going to go grab some random users like hashing mechanism and then the password you've provided, it will use that hashing mechanism to simulate real logging in time. And then in 2019, another fix landed. It turns out that without Pam, they set this like bang for the root password which caused uh SSH to fail. So
9:43then in 2022 they used an asterk yes an asterk yet again. Thank you, Bill Joy to come back as saying, "Hey, okay, the root its password is asterk. You can't login with asterric because you need a valid hash. Okay, this should be just fine. Fantastic. I'm sure nothing bad will happen." Well, it turns out from that moment onward, very bad things happen. Which makes your system vulnerable if you happen to have SSHD on Alpine, Open Word, or any Muscle Box with password off on. So, I'm sure
10:12there's a few of you that are watching me right now going, "Oh my gosh." So, you probably got to update. And this is how the actual vulnerability works. It's quite simple. Let's just say that you happen to try to log in with root user and then you provide a password greater than 256. Well, the first thing it's going to do is go, okay, well, root doesn't have a hashing algorithm. I'm just going to go grab a random user's hashing algorithm to simulate real login time. Then it's going to call crypt.
10:39Now, what happens with crypt? If you have a password longer than 256, what does result become? it becomes a star.
10:47Remember, it's the 2012 fix they did.
10:51They made it into a star. Look how white this screen is. I'm getting flashbanged right now. So, this thing returns star.
10:58So, that's what result is. Now, of course, remember the 2022 fix I just said for SSH. What's the root password?
11:06Well, it's a star, right? Okay. So, we're just going to do a quick, you know, string compare because obviously if you provided, say, any password, there should be a hash that comes back.
11:15So, shouldn't be any problems, right? Oh my gosh, that that's a problem, everybody. That's a really big problem.
11:22So, it turns out all you needed was the 2022 fix. And you, yes, you your machine was just open. It's just open to anybody that wants to say, "Yo, I'm root." And also, here's a 257 long password. Bing, I'm in. I got all the privileges, baby. I get to do whatever I want to do. Like, this is so crazy. Can you believe this actually is happening? I had to go over this. It was so fantastic. And it's also just you can
11:50just see all these incoming influences that just create this bug that's so not obvious. So, first off, big shout out Ogun. Awesome. That was awesome. That was a great write up. Amazing site and an incredible find. He did find it, by the way, by throwing 17,000 weird loginins using an agent swarm to just go wild on some machines and open SSH. Oh, pretty dang good work there, buddy. The name is the a legit. [laughter] I'm sorry. I'm sorry. This Claude logo
12:19just It just is I can't help but to see Okay. When I see Claude, it just gets me again.