News, news analysis, and commentary on the latest trends in cybersecurity technology.

10 Steps to Detect, Prevent, and Remediate the Terrapin Vulnerability

You don't have to stop using SSH keys to stay safe. This Tech Tip explains how to protect your system against CVE-2023-48795.

Dotan Nahum, Head of Developer-First Security

March 27, 2024

3 Min Read
Close-up of terrapin from South Africa
Source: Sean Tilden via Alamy Stock Photo

New vulnerabilities emerge into the spotlight almost daily, capturing the public's attention for a fleeting moment before the next sinister incident comes along. This time, the Terrapin vulnerability takes center stage.

This vulnerability in the SSH protocol, identified as CVE-2023-48795, is a security flaw affecting all SSH connections that use specific configurations in OpenSSH. Secure Shell (SSH) is a network protocol used for secure communication between systems, such as secure remote login, command execution, and file transfer over unsecured networks, like the Internet. SSH provides strong authentication and encrypted data communication, ensuring security and confidentiality in network communications.

Terrapin allows an adversary-in-the-middle (AitM) attacker to interfere with the SSH handshake process. The handshake begins with the client initiating a TCP connection, followed by a protocol version exchange as outlined in RFC 4253. During this process, an attacker can exploit the vulnerability to cut critical parts of the exchange without disrupting the SSH connection, creating a significant security risk for both the SSH client and server.

Effectively, the Terrapin vulnerability allows an attacker to downgrade secure signature algorithms and disable specific security measures, particularly in OpenSSH 9.5. Here's how to find out whether you've been attacked, fix the underlying vulnerability, and then clean up afterward.


1. Examine SSH configurations.

Use the command ssh -Q cipher to list all ciphers supported by your SSH client. Look specifically for [email protected] or any cipher block chaining (CBC) mode ciphers and remove them.

Also, check your SSH configuration files (/etc/ssh/sshd_config for the server, ~/.ssh/config or /etc/ssh/ssh_config for the client) for lines like Ciphers aes256-ctr,aes192-ctr,aes128-ctr and remove them.

2. Perform SSH client and server version check.

Run ssh -V on your client and sshd -V on your server to check their versions. If they are earlier than OpenSSH 9.6p1, they might be vulnerable.

Pay particular attention to configurations mentioned in the CVE-2023-48795 report.

3. Use specialized vulnerability scanners.

Use tools like Nessus or OpenVAS to scan your SSH implementations. These tools can automatically detect vulnerable SSH versions and configurations.


4. Set up continuous monitoring for SSH traffic.

Implement monitoring tools to detect unusual SSH traffic patterns, indicating potential AitM attacks.

5. Align security policies with SSH best practices.

Regularly update your SSH configurations to use strong, current encryption algorithms.

Use strong ciphers like [email protected], and disable root login (PermitRootLogin no in sshd_config).

Also, replace passwords with public key authentication.

6. Run regular SSH risk assessments and compliance checks.

Perform thorough SSH security audits using open source tools like OpenSCAP or your choice of commercial solutions to identify configuration weaknesses and outdated software.

Regularly check for compliance with standards like NIST or CIS benchmarks for SSH.

7. Automate updates for SSH software.

Implement a patch management process to regularly update SSH software.

Use automated tools like Red Hat Satellite or WSUS for Windows systems to manage updates.

Monitor sources like the OpenSSH mailing lists or CVE databases for new vulnerabilities.


8. Update OpenSSH.

The primary solution is updating OpenSSH to version 9.6p1 or later. This can be done using your system's package manager — for example, execute sudo apt-get update && sudo apt-get upgrade openssh-server on Ubuntu.

9. Adjust SSH configuration settings.

If you cannot immediately update OpenSSH, modify your SSH configuration to disable vulnerable ciphers:

  • For servers, edit /etc/ssh/sshd_config and set Ciphers aes256-ctr,aes192-ctr,aes128-ctr (excluding [email protected] and CBC mode ciphers).

  • For clients, edit ~/.ssh/config or /etc/ssh/ssh_config similarly.

After making changes, restart the SSH service using sudo systemctl restart sshd.

10. Keep up with ongoing security updates.

Regularly monitor for and apply security updates to SSH clients and servers, as part of a continuous security maintenance program.

By combining these methods, you can conduct a comprehensive security assessment to detect and address the Terrapin vulnerability in your SSH infrastructure.

About the Author(s)

Dotan Nahum

Head of Developer-First Security, Check Point Software Technologies

Dotan Nahum is the Head of Developer-First Security at Check Point Software Technologies. Dotan was the co-founder and CEO at Spectralops, which was acquired by Check Point Software. Dotan is an experienced hands-on technological guru and code ninja, and a major open-source contributor with high expertise with React, Node.js, Go, React Native, distributed systems, and infrastructure (Hadoop, Spark, Docker, AWS, etc.).

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like

More Insights