Hacker News

points by pizlonator 2 days ago | 0 comments

There are a lot of systems that meet those requirements.

> - sshd compiled with musl

So alpine as well as a bunch of other embedded Linuxes. Huge install base.

> - not using PAM

What you get if you try to have a minimal setup. Default sshd config if you install from source.

> - password logins enabled

The default. Super common.

> - at least one account with '*' as the password "hash"

Almost every Linux system.

> - at least one OTHER account with a valid password

Almost every Linux system.

So sure, there are caveats, but they cover a massive install base.

This is a super bad bug

[–] tonnydourado 2 days ago

How many alpine installs are running sshd? Most containers using it as a base image aren't. Embedded Linux is unlikely to be running it, too. And if one IS running sshd, how often is it with unchanged defaults? I don't buy the inference here.

I'll concede that embedded linux might be my blindspot here. Maybe cheap web hosting, too, but that seems much less likely to be using musl.

[–] svnt 2 days ago

Embedded linux is your blindspot here.

[–] __MatrixMan__ 2 days ago

Rumor has it that Cisco has been hurriedly patching something and refusing to tell their customers what it is. I'm thinking it's this.

[–] tchebb 2 days ago

Most embedded systems I've seen use glibc or uClibc. I agree it would make sense for them to use musl, but the embedded space moves very slowly.

[–] pizlonator 2 days ago

Yes

[–] andix 2 days ago

A lot of embedded systems use musl and no PAM. Some of them might use Alpine, but the distribution doesn't matter that much.

[–] 3m4r 2 days ago

Most of those would be using dropbear rather than openssh.

[–] tonnydourado 2 days ago

And ssh? I'd assume most would use proprietary or industry-specific standard for data IO, or just https, for domestic IoT stuff

[–] andix 2 days ago

And also ssh in many cases.

[–] pera 2 days ago

I thought Dropbear was pretty much the defacto SSH server for embedded applications, is OpenSSH+musl actually a common combination for these scenarios?

[–] 0x457 2 days ago

Well, OpenWrt is OpenSSH + musl.

[–] pera 2 days ago

OpenWrt uses Dropbear by default:

https://openwrt.org/docs/guide-user/services/ssh/transfer_dr...

[–] andix 1 day ago

Some use Dropbear, some use openssh.

This vulnerability clearly is not one that affects everyone like the PHP vulnerability did. But it's exposure is still significant and very easy to exploit. As easy as it gets.

[–] lucideer 2 days ago

> Most containers using it as a base image aren't.

On top of the embedded linux blindspot, this statement seems unfounded.

> if one IS running sshd, how often is it with unchanged defaults?

By definition, I would imagine the answer to this is most of the time.

[–] qwm 2 days ago

For what it's worth, default Alpine installs don't have an account with * as its password hash if you use the root account as your main one. Not sure if that's also true for ones where you set up a user, maybe those ones are vulnerable.

[–] utopiah 2 days ago

I'm genuinely curious what's the Venn diagram here because I feel a lot of embedded systems precisely have one condition but not the other, e.g. password yes but not necessarily multiple accounts, e.g root only, while using musl. Namely almost all for almost all, but if only one is not overlapping another then it's actually very few.

[–] yjftsjthsd-h 2 days ago

>> - at least one account with '*' as the password "hash"

> Almost every Linux system.

But not, notably, on Alpine, which uses '!' instead.

Edit: or maybe yes on Alpine? I checked my desktop and it has zero *s in shadow, but Alpine's post seems to say they do use * sometimes

[–] tremon 2 days ago

I thought they had a difference in meaning, i.e. * means the user has no password and ! means that password logins are disabled for this user, but the man page does not make it clear if there's a distinction.

From man 5 shadow:

> A password field which starts with an exclamation mark means that the password is locked.

> If the password field contains some string that is not a valid result of crypt(3), for instance ! or *, the user will not be able to use a unix password to log in (but the user may log in the system by other means).

[–] LinaLauneBaer 2 days ago

does this really matter? It could be used to do something devastating. The number of systems that match those requirements is only one factor. If just a handful of those are highly critical for humanity it could lead to disaster. Eg. hacks into fridges, centrifuges etc.

[–] rhet0rica 2 days ago

Updates since this was posted:

- blue t-shirts and green socks have been added to the default loadout for new hackers, since it's optimal according to AI and costs nothing to the attacker in terms of compute

- there are so many ley line "maps" out there that basically any server placement counts as aligned with at least two, so this one's free also

[–] Onavo 2 days ago

Blue t shirts and green socks?

[–] petecooper 2 days ago

Vulnerability-branded merch? Unsure.

[–] b112 2 days ago

Someone owns a blue shirt/green socks clearance warehouse, this is all just and ad? I've seen weirder. I can imagine visiting SanFran in a few months, and it looks like a weird sci-fi movie scene, everyone dressed the same.

[–] dcrazy 2 days ago

SF has puffer jackets. Milan has men in blue suits. Paris has women whose wardrobes consist of black and white.

[–] alexchamberlain 2 days ago

> password logins enabled

Disabling sshd password logins is security 101, and the default for some cloud provided images these days. If password logins haven't been disabled, what other doors have been left open anyway?

[–] twothreeone 2 days ago

Now the question for the man: would fil-c prevent it :D

[–] vadansky 2 days ago

> > - password logins enabled

> The default. Super common.

This always seems bonkers to me. I think SSHD should give you ONE password free connection of setup to copy your key over and then it just shuts the door behind it.

[–] hnfong 2 days ago

I think it has to be a time limited FREE offer. (like, seriously, what if the user doesn't take the offer?)

It might actually a good idea, but I would likely avoid it since my built-in Bayesian filter would just mark it as spam.

[–] diath 2 days ago

Not sure why you're getting downvoted as from security standpoint that would be the right thing to do; but actual good server providers take it up a notch and allow you to upload the public key through their admin panel during server set up and the password you get only works locally for sudo etc. There's no reason why a fresh Linux setup should ever offer a publicly available SSH server with password based auth out of the box.