#terrapin — Public Fediverse posts

There appears to be a terrapin in the river Avon, just next to the weir in central Bath. Looks like it's having a nice time.

#terrapin #tortoise

#NYC #Water Day at #HudsonRiver #Park: time for #Diamondback #Terrapin 🐢

Jon's first Terrapin Experience:
#Chesapeake #Wildlife #Reptile #Terrapin #Dogs #Gundogdayafternoon

https://photos.app.goo.gl/n3EaJD4xEmWeXLwH9

Cosmic Turtle
Inspired by a photo taken by Samuel Benjamin: https://bsky.app/profile/samuelxl5.bsky.social/post/3lb3y3goknk2p

#scalie #turtle #redearedslider #terrapin #reptile #mastoart #art #artwork #digitalart #illustration #cosmos #space #outerspace #nebula #stars #worldturtle #fantasy

"BOW BEFORE ME, THE MASTER OF THE #POND!!
… uh, could you give me a nudge? Seem to have beached myself."

#Terrapin seen in Eltham Park whilst wandering the #LondonLoop

#NaturePhotography #LoveLondonWalkLondon #London #photography

The weather was so nice we walked to town through the woods. About 4 miles round trip. Met this guy along the way.

#wildlife
#terrapin
#boxturtle

Black Hat 2024: Secure Shells in Shambles [pdf]

✅ https://i.blackhat.com/BH-US-24/Presentations/REVISED02-US24_Moore_Secure_Shells_in_Shambles_Wednesday.pdf

✅ https://github.com/runZeroInc/sshamble

#SSHamble #BHUSA24 #blackhat2024 #ssh #terrapin

✅ Upcoming Fall USENIX Security

Terrapin Attack: Breaking SSH Channel

Tldr:

🤘SSH ➡️ TCP ➡️ Unauthenticated (MiTM-able) Control Messages Hell.

👉Put your SSH Session into an Stateless UDP Tunnel (eg. WireGuard) or use mosh.

(Unauthenticated) TCP is a security mess from the 1980s and leads to false integrity assumptions (see China Great FireWall RST/ACKs) and has to finally die. Now.

🤘Cryptographic agility will - sooner or later - ALWAYS translate direct into (downgrade) attack hell. Later is now.

Generate SSH Ed25519 keys.
👉 ssh-keygen -t ed25519

Lock (Client & Server) your OpenSSH Cipher & Kex config.

👉 Cipher: ChaCha20-Poly1305
👉 KeyExchage: curve25519-sha256

https://www.usenix.org/system/files/sec24fall-prepub-40-baumer.pdf

#ssh #openssh #security #downgrade #cipher #kex #terrapin #usenix

Anyone for #tennis?
Dear Friends as we may know. #Wombledon... eh #Wimbledon, will soon be upon us. Like #Peace. This morning our local tennis #courts in #Furzedown area, were being set up. On Tooting common all the courts were in full swing. Private tennis clubs? Probably #Streatham is the nearest one I am aware of. Anyway after a German breakfast (four pork sausages and sauerkraut) went for a 'morning constitutional' aka promenade...

A #dinner #plate sized red-eared #terrapin was on the #path, making a break to a #nearby wet area. The conservation people try and restrict this refugee from #amazonian climes. Personally I believe we can be improved, by bringing in the #legendary #sewer #alligators of #NYC to eat some of our #water #quality executives. Which I feel is an apex predator courtesy. 😆

I only brought my black hat and key, so no terrapin photos.

This #afternoon the weather forecast is #Thunder #Thor and #Lightening and very sunny. Should be fun for #rainbow #seekers.

Enjoying the #snails, which I have been watching in the garden, rather than relocating. The invasive Spanish slugs will be out in force soon.

#Nature, can not fight it. Must #accept and work with. Anyways... time for me to try and get 'Mumble' working... or something similar for #coms on #Linux.

Have a great day everyone ❤️

#brekky #newyork #conservation #lake #pond

Jenkins security advisory from 17 April 2024 patched against the Terrapin Attack vulnerability CVE-2023-48795 🔗 https://www.jenkins.io/security/advisory/2024-04-17/

#CVE_2023_48795 #Terrapin #vulnerability #Jenkins

#yoga #Terrapin

It wasn't just the humans being bothered by flying insects today. The turtles in the lagoon had a damselfly that kept landing on their noses.

#turtle #terrapin #reptile

Атака на SSH и взлом туннелей VPN

SSH стал практически стандартом де-факто для подключения к серверу или удалённому десктопу. Поэтому уязвимости вызывают определённое беспокойство. Тем более в нынешних условиях, когда весь трафик в интернете записывается и сохраняется в хранилищах провайдеров и хостеров. То есть в будущем его могут расшифровать, будь найдена уязвимость, подрывающая базовую криптографию. Опасную уязвимость нашли исследователи из Рурского университета в Бохуме. Атака получила название Terrapin (CVE-2023-48795). Правда, её вряд ли можно использовать именно на сохранённом трафике, потому что схема MiTM предусматривает подбор значений во время рукопожатия сервера и клиента. У злоумышленника должен быть доступ к каналу и возможность подменять пакеты.

https://habr.com/ru/companies/globalsign/articles/788980/

#SSH #TunnelCrack #SSH3 #SSH2 #HTTP/3 #QUIC #VPN #LocalNet #ServerIP #TLS_13 #HTTP_Authorization #авторизация #OAuth_20 #OpenID #сканирование_портов #OpenSSH #MiTM #Terrapin

Атака на SSH и взлом туннелей VPN

SSH стал практически стандартом де-факто для подключения к серверу или удалённому десктопу. Поэтому уязвимости вызывают определённое беспокойство. Тем более в нынешних условиях, когда весь трафик в интернете записывается и сохраняется в хранилищах провайдеров и хостеров. То есть в будущем его могут расшифровать, будь найдена уязвимость, подрывающая базовую криптографию. Опасную уязвимость нашли исследователи из Рурского университета в Бохуме. Атака получила название Terrapin (CVE-2023-48795). Правда, её вряд ли можно использовать именно на сохранённом трафике, потому что схема MiTM предусматривает подбор значений во время рукопожатия сервера и клиента. У злоумышленника должен быть доступ к каналу и возможность подменять пакеты.

https://habr.com/ru/companies/globalsign/articles/788980/

#SSH #TunnelCrack #SSH3 #SSH2 #HTTP/3 #QUIC #VPN #LocalNet #ServerIP #TLS_13 #HTTP_Authorization #авторизация #OAuth_20 #OpenID #сканирование_портов #OpenSSH #MiTM #Terrapin

If you need to mitigate the #Terrapin attack against your SSH server (https://terrapin-attack.com/#scanner) and you can't simply update to a patched version I found this page helpful to prepare the sshd config and check your ssh client: https://bobcares.com/blog/how-to-disable-weak-ssh-ciphers-in-linux/
Here is a description of what needs to be done: https://blog.rwth-aachen.de/itc-changes/2024/01/09/terrapin-attack-counter-measures-ssh/
Finally check your configuration with the scanner above and e.g. https://sshcheck.com/
Most important: Don't make mistakes and lock yourself out. #1 check your recovery options!

Buongiorno da @github che annuncia il suo programma di certificazioni (e un nuovo modo di generare i suoi SDK), e poi i server SSH non sono ancora stati patchati per Terrapin e ci sono nuovi round di layoff in Twitch e Unity.

In intro la parola chiave sarà #enshittification.

#github #terrapin #ssh #security #layoff #gaming

https://www.youtube.com/watch?v=kDp5yimI8Lk

Communing with turtles again, this time in the business park in Sydney where the AAO offices are.

#reptile #turtle #terrapin

Configuring SSH on AWS EC2 Amazon Linux Instances to Protect Against the Terrapin Attack
~~
Patch OpenSSH — AND — Disallow insecure connections by removing them from your configuration
~~
#Terrapin #AWS #SSH #Encryption #Downgrade #OpenSSH #Cybersecurity

https://medium.com/cloud-security/configuring-ssh-on-aws-ec2-amazon-linux-instances-to-protect-against-the-terrapin-attack-136d8ce4ca89

#Terrapin-Attacke: Millionen #SSH-Server angreifbar, Risiko trotzdem überschaubar | Security https://www.heise.de/news/Terrapin-Attacke-Millionen-SSH-Server-angreifbar-Risiko-trotzdem-ueberschaubar-9587473.html

Communed with the turtles at the lagoon earlier this evening.

#reptile #turtle #terrapin

thx @lambdafu, @Skrillor et al @ RUB for the excellent research on the [Terrapin Attack](https://terrapin-attack.com).

The #Terrapin Scanner is available here:
https://github.com/RUB-NDS/Terrapin-Scanner

For Your reference:

- CVE-2023-48795: General Protocol Flaw
- CVE-2023-46445: Rogue Extension Negotiation Attack in AsyncSSH
- CVE-2023-46446: Rogue Session Attack in AsyncSSH

Terrapin-Angriff: Fast 11 Millionen online erreichbare SSH-Server sind anfällig https://www.computerbase.de/2024-01/terrapin-angriff-fast-11-millionen-online-erreichbare-ssh-server-sind-anfaellig/ #Terrapin #SSH #MitM

In Deutschland könnten noch ca. 1 Million SSH-Server durch die #Terrapin-#Schwachstelle angreifbar sein. Um die eigene Verwundbarkeit zu überprüfen, stellen die Sicherheitsforschenden von
@ruhrunibochum
unter https://terrapin-attack.com ein Tool zur Verfügung.

„Für all jene, die einen #SSH-Server betreiben, bieten die Forscher der Ruhr Universität Bochum, die #Terrapin im Dezember vorgestellt haben, auf Github einen Schwachstellen-Scanner an. Damit lässt sich die Anfälligkeit überprüfen.“

https://www.golem.de/news/deutschland-auf-platz-3-millionen-von-ssh-servern-anfaellig-fuer-terrapin-angriff-2401-180805.html