Catch-22: Uncovering Compromised Hosts Using SSH Public Keys#

Cristian Munteanu et al., Max Planck Institute for Informatics; Delft University of Technology (Distinguished Paper Award Winner) — Wildcard

• Why: A clever, minimally-invasive Internet-scale detection technique — using SSH's own public-key-authentication challenge behavior to fingerprint compromise without ever needing valid credentials or touching the compromised system — that found state-actor-associated keys inside sensitive ASes.
• What: A method identifying 21,700+ compromised SSH servers across 1,649 ASes and 144 countries by checking for the presence of known-malicious attacker public keys, without needing to log in or test passwords; surfaced new context on botnets (fritzfrog), threat actors (teamtnt), and state-actor-linked keys in sensitive networks. (from abstract only)
• How: Exploits the fact that SSH only sends a public-key-authentication challenge if the corresponding key is actually present on the server — letting a scanner test for known malicious keys' presence with zero access and zero risk of triggering an actual login. (from abstract only)
• Where applicable: General Internet-scale compromise detection; the technique's elegance (a side effect of protocol behavior, not a vulnerability) is the interesting part, applicable anywhere an authentication protocol leaks presence information.