[tor-relays] Re: Ebury 1.8.3 on two Quetzalcoatl relay servers: timeline, lessons, open questions

[George via tor-relays <tor-relays@xxxxxxxxxxxxxxxxxxxx>]

On 10/7/26 11:20, Jonathan D. Proulx via tor-relays wrote:
> Hi Zimmer
> 
> Thanks for the excellent write up.
> 
> We got hit by Ebury more than a decade ago now (on our research
> infrastructure not tor relays) and it still stings, good luck with
> your clean up. We'll definitely review our detection rules based on
> your updated details.
> 
> One of our key remediations which you didn't mention was adding
> multifactor authenitcation (MFA) to our ssh, so even if a password or
> key leaks that's no longer sufficient.
> 
> Nothing is perfect but MFA seems like a substantial mitigation to the
> typical Ebury vector.
I started looking at the Ebury issue and saw it dates back to 2009?

https://attack.mitre.org/software/S0377/

There are the practices with SSH that should be considered normal, which
seem to mitigate the issue, some of which is mentioned by Dr Remmiz:

* protect your private SSH keys as if they're the physical keys to you
residence

* passwd protect your private SSH keys

* rotate your SSH keypairs if you think your private key has been
compromised. In past days, certain enterprises required @weekly
replacement of SSH keys.

* ed25519 is the key type you should use, but with OpenSSH 10.3 you can
start using mldsa44-ed25519, which is apparently post-quantum
cryptanalysis proof:

https://www.openssh.org/releasenotes.html

And just to be clear, passwd-protected SSH keys is not considered
multi-factor authentication (MFA)... MFA would require another factor
besides "what you have" in the private key. The passwd is just
protecting usage of the private key. MFA would mean Yubikey, TOTP, etc.

There are other mitigations people run to protect SSHD, but at the end
of the day, relays/bridges need to be treated as highly targeted
production machines.

These are the slides from a while ago about sysadmin'g a Tor box which
includes a slide on SSH:

https://nycbug1.nycbug.org/sysadmin101/

g
_______________________________________________
tor-relays mailing list -- tor-relays@xxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to tor-relays-leave@xxxxxxxxxxxxxxxxxxxx