Key Takeaways (TL;DR): Hackers have begun exploiting the SSHole vulnerability (CVE-2024-6387) in OpenSSH, injecting their SSH keys into servers. Attacks have only been observed on honeypots so far, but the threat is real. A free auto-renewing subscription is available at /sub/happ/for-russia, and a private anti-DPI multi-key with white-list bypass is available in the Telegram bot @yavpn_robot.Researchers at GreyNoise have detected the first active exploitation of the SSHole vulnerability (CVE-2024-6387) in OpenSSH. Attackers are scanning the internet for vulnerable SSH servers and injecting their public keys to gain root access.
How the attack works
The vulnerability affects OpenSSH versions prior to 9.8p1. It is a signal handler race condition that allows remote code execution with root privileges. By sending specially crafted packets, an attacker can trigger the race condition and execute arbitrary code.
In the observed attacks, hackers used the following commands:
- Injecting an SSH key for the root user into authorized_keys
- Injecting an SSH key for the alpine user (common in Docker containers)
- Creating a new user with sudo privileges
GreyNoise recorded 15 command chains as of 12:40 UTC on November 8. Importantly, these attacks targeted honeypots, not real servers. However, once a public PoC exploit is released, mass exploitation is expected.
What administrators should do
First, update OpenSSH to version 9.8p1 or later. If an update is not possible, temporarily disable the SSH server or restrict access by IP address using a firewall.
Check authorized_keys files for all users, especially root, for any unknown keys. Also review logs for suspicious login attempts.
For additional protection, enable two-factor authentication and use passphrase-protected keys. If your ISP throttles traffic or you need to protect SSH connections from DPI, a private anti-DPI multi-key with white-list bypass is available in the Telegram bot @yavpn_robot.