It is crazy how in a country where everyone sues everyone all the time things like that happen. I had assumed that such a system would lead to a more robust system where every manager to ceo is vetting their business against these problems to not get sued. Apparently the liberal system of suing anyone all the time does not at all replaces a governmental body that defines strong consumer protection rights. Reading this, Turbotax and Wells Fargo News teaches me that a suing society is not cleansing itself from predatory behaviour.
Here is a list of the top 5 most litigious countries by capita: 1. Germany: 123.2/1,000 2. Sweden: 111.2/1,000 3. Israel: 96.8/1,000 4. Austria: 95.9/1,000 5. U.S.: 74.5/1,000. The Top 10 also includes the UK (64.4); Denmark (62.5); Hungary (52.4); Portugal (40.7); and France (40.3).
As you can see, the risk of lawsuits in the U.S. is less than in Germany, Sweden, Israel, and Austria, and not much greater than the other countries listed in the top 10. Simply stated, Americans are not as litigious as many believe. While the large verdict against McDonalds for serving hot coffee received enormous publicity, that judgment was significantly reduced on appeal and the plaintiff spent the left of her life being ridiculed.
For those of you who think you are using a local pharmacy, you might want to check whether or not they're owned by one of these. They buy out local pharmacies without obviously rebranding. And then they kill the store. At least, that's Rite Aid's MO.
I get your point that the exploit existed before it was identified, but an unmitigated exploit that people are aware of is worse than an unmitigated exploit people aren't aware of. Security through obscurity isn't security, of course, but exploiting a vulnerability is easier than finding, then exploiting a vulnerability. There is a reason that notifying the company before publicizing an exploit is the standard for security researchers.
You're right that it's never an OK title, because fuck clickbait, but until it's patched and said patch propagates into the real world, more people being aware of the hole does increase the risk (though it doesn't sound like it's actually a huge show stopper, either).
Weakness and risk are distinct things, though—and while security-through-obscurity is dubious, “strength-through-obscurity” is outright false.
Conflating the two implies that software weaknesses are caused by attackers instead of just exploited by them, and suggests they can be addressed by restricting the external environment rather than by better software audits.
In my opinion Dan Goodin always reports as an alarmist and rarely gives mitigation much focus or in one case I recall, he didn't even mention the vulnerable code never made it to the release branch since they found the vulnerability during testing, until the second to last paragraph (and pretended that paragraph didn't exist in the last paragraph). I can't say in that one case, it wasn't strategic but it sure seemed that way.
For example, he failed to note that the openssh 9.6 patch was released Monday to fix this attack. It would have went perfectly in the section called "Risk assessment" or perhaps in "So what now?" mentioned that people should, I don't know, apply the patch that fixes it.
Another example where he tries scare the reading stating that "researchers found that 77 percent of SSH servers exposed to the Internet support at least one of the vulnerable encryption modes, while 57 percent of them list a vulnerable encryption mode as the preferred choice." which is fine to show how prevalent the algorithms are used but does not mention that the attack would have to be complicated and at both end points to be effective on the Internet or that the attack is defeated with a secure tunnel (IPSec or IKE for example) if still supporting the vulnerable key exchange methods.
He also seems to love to bash FOSS anything as hard as possible, in what to me, feels like a quest to prove proprietary software is more secure than FOSS. When I see his name as an author, I immediately take it with a grain of salt and look for another source of the same information.
Even the researcher who reported this doesn’t go as far as this headline.
“I am an admin, should I drop everything and fix this?”
Probably not.
The attack requires an active Man-in-the-Middle attacker that can intercept and modify the connection’s traffic at the TCP/IP layer. Additionally, we require the negotiation of either ChaCha20-Poly1305, or any CBC cipher in combination with Encrypt-then-MAC as the connection’s encryption mode.
[…]
“So how practical is the attack?”
The Terrapin attack requires an active Man-in-the-Middle attacker, that means some way for an attacker to intercept and modify the data sent from the client or server to the remote peer. This is difficult on the Internet, but can be a plausible attacker model on the local network.
It definitely receives more clicks. I’ve posted this link here a day ago, but arstechnicas title is more engaging. My first thought was whether there’s been another vulnerability found.
That said, this headline isn’t as bad as it could’ve been.
Yeah, if the attacker is in a position to do a MitM attack you have much larger problems than a ssh vulnerability that so far can at most downgrade the encryption of your connection in nearly all cases
Just checked my own sshd configs and I don’t use CBC in them. I’ve based the kex/cipher/Mac configs off of cipherlist.eu and the mozilla docs current standards. Guess it pays to never use default configs for sshd if it’s ever exposed to the Internet.
Edit: I read it wrong. It’s chacha20 OR CBC. I rely heavily on the former with none of the latter.
So you need an MitM situation to even be able to perfom the attack, and the the attack on works on two ciphers? The article says those ciphers are commonly enabled, but are they default or used in relatively modern distributed versions of openssh?
A scan performed by the researchers found that 77 percent of SSH servers exposed to the Internet support at least one of the vulnerable encryption modes, while 57 percent of them list a vulnerable encryption mode as the preferred choice.
That means a client could negotiate one or the other on more than half of all internets exposed openssh daemons.
I haven’t got too whizzed up over this, yet, because I have no ssh daemons exposed without a VPN outer wrapper. However it does look nasty.
Since he doesn't mention it in his 'fantastic' reporting, OpenSSH 9.6 was released Monday that will patch this attack. Also, since he doesn't mention it, if on the Internet, the MITM would have to be installed at both end points (client side and server side) to be effective without the patch.
Since he doesn’t mention it in his ‘fantastic’ reporting, OpenSSH 9.6 was released Monday that will patch this attack.
I am tempted to delete this post just for the article’s stupid clickbait headline, but it still will probably cause some people to go update their OpenSSH installs, so… meh.
Anyone who actually wants to know details of the vulnerability should read the website about it which is obviously much better than this article.
Also, since he doesn’t mention it, if on the Internet, the MITM would have to be installed at both end points (client side and server side) to be effective without the patch.
Huh? No. The attacker doesn’t need to be in two places or even near either end per se, they could be located at any fully on-path position between the client and server.
“develop a technological standard that might turn a user’s electronic device into the proof of age necessary to access restricted online content.”
Can we not? Can parents just take care of their kids like they have for thousands of years instead of futility trying to babyproof the internet for a minority of people? Jesus.
Can parents just take care of their kids like they have for thousands of years
Okay, so lets be certain that kids do not have a direct connection with every intelligence agency, mafia and terrorist organization in the world right in their pocket, just as they did not for thousands of years. Now, to be clear I really don’t like the approach they’ve chosen here (I think we need to go much deeper into the fundamental design of the Internet), but I would hope it’s not a controversial statement to assert that our society has taken a very sharp turn for the worse ever since the Internet became ubiquitous in children’s development, and I think that really ought to prompt discussion about how it’s being used.
Controversially, I think the Internet has made society better. We’re still in the growing years of the age of information, so plenty of challenges to overcome for sure, but it largely has made for a more informed society and really empowered the average person despite the resurgence of authoritarianism.
Basically PH and other xxx sites need you to verify your identity by uploading your ID. It’s what should be unconstitutional and a violation of privacy.
I believe the responsibility should be on the parents to keep their children from viewing porn before they’re 18. Not the government. I also believe there should be at least some control over what minors have access to. Will it ever be 100%? Nope. All we can do is the best we can do
The difference is that the people involved there are adults and there is no equivalent to the parent responsible for their behaviour so a technical solution makes more sense there.
or a real example that most newer cars have a “check rear seat for occupant” alert because some people forget their babies in the backseat and they die…
This is a world for everyone in it. We shouldn’t actively make it hostile to children, but we also shouldn’t be prioritizing forcing every aspect of it to fit their needs.
Our need to keep it alive isn’t just for children, it’s for everyone, which is also completely unrelated to censorship of sexual content
Especially since parenting is the only thing that’s going to actually work. Do you think kids won’t figure out a VPN? If they heard enough to type “pornhub”, they’ll hear about the one extra step.
And there are worse things on the Internet than porn. Some likely on Roblox.
You’re just going to have to parent your kid with or without this nanny state blocking scheme.
arstechnica.com
Oldest