Dr. Hax on Nostr: I just saw an attack in the wild. Fun! An exit node is hijacking SSH traffic to ...

I just saw an attack in the wild. Fun!

An exit node is hijacking SSH traffic to github. The host fingerprint didn't match, the SSH key failed, and then it prompted for a password, which presumably would be harvested.

I didn't spend much time on it, so I don't know if they patched their version of sshd to accept any password and then tie it to the repo that was pushed. That'd be smart.

And I'm sure a reply-guy is going to jump in and say this is only a risk for Tor users, ignoring the fact that your ISP, their peers, and maybe a CDN can all pull off the same thing. And anyone who compromised any of these entities can do likewise.

This is alway a risk. It's why we have things like TLS for websites and host fingerprints to verify for SSH.