Encrypted copies of Bitbucket SSH keys leaked

#1

Post by dentarg » Fri, Jun 30, 2023, 6:21 AM UTC

Encrypted copies of Bitbucket SSH keys leaked
bitbucket.org

Re: Encrypted copies of Bitbucket SSH keys leaked

#2

Post by necovek » Fri, Jun 30, 2023, 6:41 AM UTC

Title made it confusing: how did bitbucket even have users' SSH keys?

However, it seems to be about their host keys. The article seems down for me, but https://bitbucket.org/blog/ has a title "ACTION REQUIRED: Update your Bitbucket Cloud SSH Host Keys".

That means that you need to drop their entries from your known_hosts file or you risk a MITM attack on an insecure network.

Considering we usually blindly accept new SSH hosts without checking for fingerprints (eg on new or reinstalled machines), it's probably unlikely this will be exploited in the wild since it already could have been.

Re: Encrypted copies of Bitbucket SSH keys leaked

#3

Post by necovek » Fri, Jun 30, 2023, 6:44 AM UTC

necovek wrote: post #2

Title made it confusing: how did bitbucket even have users' SSH keys? However, it seems to be about their host keys. The article seems down for me, but https://bitbucket.org/blog/ has a title "ACTION REQUIRED: Update your Bitbucket Cloud SSH Host Keys". That means that you need to drop their entries from your known_hosts file or you risk a MITM attack on an insecure network. Considering we usually blindly accept new…

Another point worth bringing up: it'd be nice if we set up either a PGP-like trust ring for host SSH signatures, or relied on a set of CAs like we do for TLS.

Something as simple as confirm-fingerprint-over-https (eg. look for https://ssh-host/.host-ssh-fingerprint) could work if enough ssh clients used it.

Re: Encrypted copies of Bitbucket SSH keys leaked

#4

Post by dentarg » Thu, Jul 06, 2023, 8:17 AM UTC

necovek wrote: post #3

necovek wrote: post #2

Title made it confusing: how did bitbucket even have users' SSH keys? However, it seems to be about their host keys. The article seems down for me, but https://bitbucket.org/blog/ has a title "ACTION REQUIRED: Update your Bitbucket Cloud SSH Host Keys". That means that you need to drop their entries from your known_hosts file or you risk a MITM attack on an insecure network. Considering we usually blindly accept new…

Another point worth bringing up: it'd be nice if we set up either a PGP-like trust ring for host SSH signatures, or relied on a set of CAs like we do for TLS. Something as simple as confirm-fingerprint-over-https (eg. look for https://ssh-host/.host-ssh-fingerprint ) could work if enough ssh clients used it.

You can do that with DNS (preferably DNSSEC is used): https://en.wikipedia.org/wiki/SSHFP_record, https://man.openbsd.org/ssh_config#VerifyHostKeyDNS