Attackers exploit SSHole vulnerability in Alpine Linux to add their own SSH keys

Attackers have gained access to Alpine Linux and started adding their own SSH keys for root and alpine users.

The SSHole vulnerability was detected several days ago, but attacks are still ongoing. It allows adversaries to access servers without entering a password.

Researchers observed the attacks on a honeypot server and identified four conditions that may put a system at risk:

1. The openssh-server package is installed without PAM, or openssh-server-pam is configured with UsePAM no.
2. Password login is enabled: PasswordAuthentication yes, which is the default OpenSSH setting.
3. An account exists with * in the password field. This includes root in the base image, users authenticated only by keys, and the alpine user in tiny-cloud images.
4. At least one local account uses a `$5Attackers have gained access to Alpine Linux and started adding their own SSH keys for root and alpine users.

The SSHole vulnerability was detected several days ago, but attacks are still ongoing. It allows adversaries to access servers without entering a password.

Researchers observed the attacks on a honeypot server and identified four conditions that may put a system at risk:

1. The openssh-server package is installed without PAM, or openssh-server-pam is configured with UsePAM no.
2. Password login is enabled: PasswordAuthentication yes, which is the default OpenSSH setting.
3. An account exists with * in the password field. This includes root in the base image, users authenticated only by keys, and the alpine user in tiny-cloud images.
4. At least one local account uses a or `$6Attackers have gained access to Alpine Linux and started adding their own SSH keys for root and alpine users.

The SSHole vulnerability was detected several days ago, but attacks are still ongoing. It allows adversaries to access servers without entering a password.

Researchers observed the attacks on a honeypot server and identified four conditions that may put a system at risk:

1. The openssh-server package is installed without PAM, or openssh-server-pam is configured with UsePAM no.
2. Password login is enabled: PasswordAuthentication yes, which is the default OpenSSH setting.
3. An account exists with * in the password field. This includes root in the base image, users authenticated only by keys, and the alpine user in tiny-cloud images.
4. At least one local account uses a `$5Attackers have gained access to Alpine Linux and started adding their own SSH keys for root and alpine users.

The SSHole vulnerability was detected several days ago, but attacks are still ongoing. It allows adversaries to access servers without entering a password.

Researchers observed the attacks on a honeypot server and identified four conditions that may put a system at risk:

1. The openssh-server package is installed without PAM, or openssh-server-pam is configured with UsePAM no.
2. Password login is enabled: PasswordAuthentication yes, which is the default OpenSSH setting.
3. An account exists with * in the password field. This includes root in the base image, users authenticated only by keys, and the alpine user in tiny-cloud images.
4. At least one local account uses a §§TOK_8§§ or `$6Attackers have gained access to Alpine Linux and started adding their own SSH keys for root and alpine users.

The SSHole vulnerability was detected several days ago, but attacks are still ongoing. It allows adversaries to access servers without entering a password.

Researchers observed the attacks on a honeypot server and identified four conditions that may put a system at risk:

1. The openssh-server package is installed without PAM, or openssh-server-pam is configured with UsePAM no.
2. Password login is enabled: PasswordAuthentication yes, which is the default OpenSSH setting.
3. An account exists with * in the password field. This includes root in the base image, users authenticated only by keys, and the alpine user in tiny-cloud images.
4. At least one local account uses a or password hash.

If any one of these conditions is met, the system may be vulnerable to attack.