SoylentNews is people
SoylentNews
Cybercriminals Weaponizing Open-Source SSH-Snake Tool for Network Attacks:
A recently open-sourced network mapping tool called SSH-Snake has been repurposed by threat actors to conduct malicious activities.
"SSH-Snake is a self-modifying worm that leverages SSH credentials discovered on a compromised system to start spreading itself throughout the network," Sysdig researcher Miguel Hernández said. "The worm automatically searches through known credential locations and shell history files to determine its next move."
SSH-Snake was first released on GitHub in early January 2024, and is described by its developer as a "powerful tool" to carry out automatic network traversal using SSH private keys discovered on systems.
In doing so, it creates a comprehensive map of a network and its dependencies, helping determine the extent to which a network can be compromised using SSH and SSH private keys starting from a particular host. It also supports resolution of domains which have multiple IPv4 addresses. "It's completely self-replicating and self-propagating – and completely fileless," according to the project's description. "In many ways, SSH-Snake is actually a worm: It replicates itself and spreads itself from one system to another as far as it can."
Sysdig said the shell script not only facilitates lateral movement, but also provides additional stealth and flexibility than other typical SSH worms.
The cloud security company said it observed threat actors deploying SSH-Snake in real-world attacks to harvest credentials, the IP addresses of the targets, and the bash command history following the discovery of a command-and-control (C2) server hosting the data.
"The usage of SSH keys is a recommended practice that SSH-Snake tries to take advantage of in order to spread," Hernández said. "It is smarter and more reliable which will allow threat actors to reach farther into a network once they gain a foothold."
When reached for comment, Joshua Rogers, the developer of SSH-Snake, told The Hacker News that the tool offers legitimate system owners a way to identify weaknesses in their infrastructure before attackers do, urging companies to use SSH-Snake to "discover the attack paths that exist – and fix them." "It seems to be commonly believed that cyber terrorism 'just happens' all of a sudden to systems, which solely requires a reactive approach to security," Rogers said. "Instead, in my experience, systems should be designed and maintained with comprehensive security measures."
"If a cyber terrorist is able to run SSH-Snake on your infrastructure and access thousands of servers, focus should be put on the people that are in charge of the infrastructure, with a goal of revitalizing the infrastructure such that the compromise of a single host can't be replicated across thousands of others."
SSH-Snake: Automated SSH-Based Network Traversal:
(Score: 2) by quietus on Wednesday February 28 2024, @07:07PM (5 children)
It would be better, for one, as it is the habit -- I assume -- of a security professional to check the SANS news letter for vulnerabilities; while it is not so much a habit to scan the whole of GitHub, GitLab and other places for open source programs exploiting security vulnerabilities. So many hours in a day, eh?
(Score: 1) by khallow on Thursday February 29 2024, @02:47AM (4 children)
Looks like SANS didn't have any trouble [sans.org] hearing about the project.
(Score: 2) by quietus on Thursday February 29 2024, @09:50AM (3 children)
On February 22, yes. The tool was released in early January.
(Score: 1) by khallow on Thursday February 29 2024, @01:01PM (2 children)
(Score: 2) by quietus on Thursday February 29 2024, @03:19PM (1 child)
More than a month later. How long do you wait with patches to your operating system?
As to the rest of your reply, about five eyes informants and such: maybe you spend too much time on the Internet.
(Score: 1) by khallow on Friday March 01 2024, @04:44AM
Hopefully you had patched the system more than a month earlier, right?