Catch-22: Uncovering Compromised Hosts using SSH Public Keys
summary
A scalable method probes SSH servers by sending public key auth requests and treating a server challenge as proof the key exists locally, using a patched ZMap 2 SSH client, rate limits and a canary key to filter misconfigurations. An Internet-wide scan of ports 22 and 222 for usernames root, admin and ubuntu checks 52 malicious keys from Bitdefender and flags 21,700+ compromised systems in 1,649 ASes across 144 countries, with notifications routed to Shadowserver and a national CSIRT for remediation.
AI-written summary · about
chapters (9)
- 0:00SSH public key attacks
- 1:57SSH handshake reveals keys
- 4:30Designing SSH scan tool
- 5:57Testing SSH server compatibility
- 7:25Ethical and legal compliance
- 8:06Malicious public keys from Bitdefender
- 9:11Scanning internet for hosts
- 10:38Coordinating with Shadowserver
- 11:43Research results and conclusion
related talks
31mCharting the SSH Multiverse
21mCAUDIT: Continuous Auditing of SSH Servers To Mitigate Brute-Force Attacks
30mPublic-private partnership unveils the full scale of a sophisticated Linux threat
15mWhere The Wild Things Are: Brute-Force SSH Attacks In The Wild And How To Stop Them
27mSSH Keys: Security Asset or Liability?
24mFinding insecure cryptographic keys in DKIM, DNSSEC, OpenID Connect & elsewhere
38mHackers Gonna Hack: Identifying and Fixing Vulnerabilities Proactively
01h 27mProactive Defense: Leveraging Hacker Tools for Early Vulnerability Detection