undefined | Better HN

0 pointsfn-mote1y ago0 comments

There are many points made in the presentation, including that a significant number of ~~targets~~ hosts are not running OpenSSH. See the list and the claims that some classes of them are important.

The swipe at "running shell commands" isn't very credible, but the second attack surface is legitimate.

0 comments

hello_computer1y ago

4th bullet from the bottom sounds credible to me:

> Supports the execution of shell commands on behalf of valid SPA packets.

Even if it were only a statically configured command (no idea if it is or isn't), as soon as that door is opened, it leads to a morass.

j / k navigate · click thread line to collapse