Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
github.com/pavelz/ssh-chat
Custom SSH server written in Go. Instead of a shell, you get a chat prompt.
Join the party:
$ ssh chat.shazow.net
The server's RSA key fingerprint is MD5:e5:d5:d1:75:90:38:42:f6:c7:03:d7:d0:56:7d:6a:db
or SHA256:HQDLlZsXL3t0lV5CHM0OXeZ5O6PcfHuzkS8cRbbTLBI
. If you see something different, you might be MITM'd.
(Apologies if the server is down, try again shortly.)
Recent releases include builds for MacOS (darwin/amd64) and Linux (386, amd64, and ARM6 for your RaspberryPi).
Grab the latest binary release here.
Play around with it. Additional deploy examples are here.
Most people just want the latest binary release. If you're sure you want to compile it from source, read on:
You can compile ssh-chat by using make build
. The resulting binary is portable and
can be run on any system with a similar OS and CPU arch. Go 1.8 or higher is required to compile.
If you're developing on this repo, there is a handy Makefile that should set
things up with make run
.
Additionally, make debug
runs the server with an http pprof
server. This allows you to open
http://localhost:6060/debug/pprof/ and view profiling data. See
net/http/pprof for more information about pprof
.
Usage:
ssh-chat [OPTIONS]
Application Options:
-v, --verbose Show verbose logging.
--version Print version and exit.
-i, --identity= Private key to identify server with. (default: ~/.ssh/id_rsa)
--bind= Host and port to listen on. (default: 0.0.0.0:2022)
--admin= File of public keys who are admins.
--whitelist= Optional file of public keys who are allowed to connect.
--motd= Optional Message of the Day file.
--log= Write chat log to this file.
--pprof= Enable pprof http server for profiling.
Help Options:
-h, --help Show this help message
After doing go get github.com/shazow/ssh-chat/...
on this repo, you should be able
to run a command like:
$ ssh-chat --verbose --bind ":22" --identity ~/.ssh/id_dsa
To bind on port 22, you'll need to make sure it's free (move any other ssh daemons to another port) and run ssh-chat as root (or with sudo).
The FAQs can be found on the project's Wiki page. Feel free to submit more questions to be answered and added to the page.
This project is licensed under the MIT open source license.
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.