Hey, is it not just a simple honeypot reverse hack ssh server?
People understand that reverse hacking can happen when connecting to random ssh server, right?
Hey, is it not just a simple honeypot reverse hack ssh server?
People understand that reverse hacking can happen when connecting to random ssh server, right?
People understand that such "reverse hacking" can happen when their browser connects to any site (including all the indirect connections from dependent resources), right? Or when resolving any domain name? Or when even just pinging an IP?
The risk is far, far lower than browsing the internet. Unlike the massive surface of a browser and all the libraries and processes it is comprised of, the OpenSSH client is a tiny, with a singular purpose, contained in a small and very well-vetted codebase.
From the perspective of connecting to a foreign network service, the OpenSSH client is about the safest thing you can possibly use. Note the use of relative words here - not claiming it is 100% bug-free.
(The main caveat is that you can manually configure the client to do unsafe things, like writing a configuration by hand that enables X forwarding or agent forwarding by default for any host - but you can also actively disable sandboxing in your web browser or run everything as root, and we will never be able to stop you from actively making things insecure.)
There's also the terminal to consider, via terminal escape sequences.
Yes, but terminal escape sequences are a very, very small surface. It's just a few opcodes like "wipe screen", "switch to buffer B", "move to X,Y". All process output regardless of whether it is a terminal escape sequence or regular text just navigate and update the screen "cells", and in, say, alacritty this will be in boring, non-unsafe Rust.
For comparison, the surface exposed by your browser rendering this text controlled entirely by an adversary (me) is considerably greater as it also interacts with the style system, content reflow, javascript engine (even for non-javascript websites), etc.
> People understand that reverse hacking can happen when connecting to random ssh server, right?
No, actually, I've never heard of such a vector. How would that work?
An ssh server would exploit a vulnerability in the ssh client when it connects.
For example, openssh has both a client and server. There’s been vulnerabilities in openssh, in the client. Those vulnerabilities aren’t reachable unless you’re connecting to a server attempting to exploit you, so the risk is quite low because you know and trust most servers you’re connecting to with ssh.
To sum it up: Connecting to this server is probably fine, but in doing so most people are doing something significantly riskier without realizing it.
Isn't this exploit vector identical to the ones we'd expect on browser-based vulnerabilities? I believe that yes, there are possible risks involved, but no significant than our casual web-surfing through the net.
There has never been a real-world OpenSSH exploit that allows a server to RCE a client that connected to it without a bunch of dubious qualifiers. Connecting to a random SSH server is much, much less dangerous than running a random binary or executing a random curl install script, both of which people do all the time, and is probably about on par with the likelihood of a random website escaping your browser's sandbox and RCEing you.
Agreed, bugs in the terminal emulator are probably more concerning. The attack surface of those is much larger (there are some pretty wild ANSI escape sequences, and terminal emulators are often granted pretty wide disk access permissions on systems that have them if they're also used for local development).
Web browsers are generally built with security in mind. Terminal emulators surely much less so. The OpenSSH client probably sits somewhat in between, generally developed with security in mind, but not necessarily consistently expecting malicious servers.
At least for the more prominent terminal emulators i expect they probably devote a great deal of attention to security. They are developing the most commonly used interfaces for linking the most numerous, varied, and/or critical systems on the planet.
Went to the kitty website. No mentions of security.
Went to Alacritty. No mentions of security.
Went to Ghostty. No mentions of security, except for "secure keyboard entry".
None have a "security policy" on GitHub.
All written in memory unsafe languages (C, Zig).
I believe the recent cve-2026-55200 in libssh2 (client-side library) was allowing exactly this. https://nvd.nist.gov/vuln/detail/cve-2026-55200 ("Remote attackers can send crafted SSH packets with excessively large packet_length values to corrupt heap memory and achieve remote code execution.")
Of course the other abouts that you whatted (such as random curl install scripts, binaries, etc.) are still more dangerous.
OpenSSH doesn't use this library.
Good to know, but OpenSSH is not the scope here.
It seems to me you were replying to refute a claim about OpenSSH.
Per Red Hat:
> The integer overflow provides uncontrolled access to the heap, which reliably crashes the client process but is unlikely to achieve remote code execution in practice. Weaponizing the overflow for code execution would require a separate information disclosure vulnerability to defeat ASLR, along with a specific heap layout to place exploitable structures adjacent to the undersized allocation.
---
> abouts that you whatted
"Whataboutism" is perhaps the most infuriating and wildly misused word in the English language. Pointing out that somebody is scaremongering about an action that is significantly less dangerous than other everyday actions people take on their computers is not a fallacy. It is directly relevant to evaluating risk. Yes, technically there could be some critical bug that allows the posited thing to happen, but in reality it just doesn't happen. If it did happen, nobody would blow their once-in-decades exploit on pranking some people on a forum.
If you properly set up your ssh client (No agent forwarding or X11 forwarding)
Terminal, too; some escape sequences are able to perform attacks in old or buggy terminal emulators.
Even newer ones. Iterm2 had CVE-2026-41253 recently. Or things like Tmux.
Yes, I was thinking of iTerm2. "Older" means not the latest release and "buggy" includes well-intentioned vulnerabilities.
Sure. 3.6.9 (which was affected) was the most recent iTerm2 when that CVE came out.
Hence "or"
Malicious servers can send malicious terminal escape codes. For example https://www.sentinelone.com/vulnerability-database/cve-2026-...
> To sum it up: Connecting to this server is probably fine
And what are you basing this statement on?
theoretically a browser could have the same vulnerability and has a vastly higher attack surface.
has there ever been an example of such a vulnerability in openssh?
Here is a recent example. Currently unpatched in Debian stable.
https://www.cve.org/CVERecord?id=CVE-2026-60002
As I understood this, a malicious server can change its host key somewhere during key exchange and trigger a use-after-free in the client, which might be exploitable for code execution.
Vulnerability in your ssh client (unlikely) or terminal emulator (more common but lower reach).
Terminal emulators have, on occasion, had all kinds of interesting escape codes that I wouldn't want to expose to an attacker. Whether this is even a true "vulnerability" is somewhat a matter of opinion (in the sense that the feature works as designed, but that's maybe a bad thing).
Agent forwarding would be pretty big, if it for example pushed your git credentials to the remote host.
Would like to clarify that all my code is open source at https://github.com/jeninh/ssh.place , even the deployment is triggered through GitHub actions. I'm also a teen and not too familiar with most of these terms, so I might be forgetting something.
Prove it, I'll connect to any server you point me to, using default openssh client flags.
Is that more likely than getting hacked when visiting a website?
Are we all pretending we have no empirical data on this? How many RCEs has there been in popular web browsers over the past two decades (dozens? hundreds?), compared to how many RCEs there has been in the OpenSSH client (perhaps we can make it one if we include xterm in that)?
Visiting a random website is the normal use of HTTP. With SSH, there might be assumptions of connecting to a trusted server you have an account with and likely own. It's not very normal to ssh to a random server.
> likely own
I don't know how you are using ssh, but most ssh servers that I have connected to in my life, and still do, I don't own. Some of them I barely trust.
The ones I connect to the most often from my personal laptop I don’t physically own but I do pay to rent them and I installed the OS on them myself.
The main ones I don’t own are VPS servers from fairly large providers, or GitHub.
When I said "own", I meant more in the sense of personally administering. It's like how you own a domain, but you're really renting it from a registrar. Rented hardware and VPSs count, as well as other servers/hosts you're responsible for.
I got that, and I'm not saying that it doesn't apply to you, but it surely does not apply to everybody.
This is simply not true
What exactly is the mechanism by which you think that an SSH RCE is "simple"?
Not OP, but agent forwarding is a significant concern.
Is it enabled by default though?
AFAIK: No
It's not, but there is likely a small number people who have something like this configured:
Try me.