How were attackers able to login to the Apache Foundation’s infrastructure over ssh with passwords? (2010)

SSH passwords should not have been enabled for login over the Internet. Although the Infrastructure Team had attempted to configure the sshd daemon to disable password-based logins, having UsePAM yes set meant that passwor… Continue reading How were attackers able to login to the Apache Foundation’s infrastructure over ssh with passwords? (2010)

Loading a passphrase-protected private SSH key from a file with the cryptography Python module

I am trying to load a passphrase-protected private SSH key from a file using the cryptography Python module. However, I’m not exactly sure how to proceed. The following yields a Crypto.Util.Padding.PaddingError: Padding is incorrect. error… Continue reading Loading a passphrase-protected private SSH key from a file with the cryptography Python module

36-Year-Old SCP Clients’ Implementation Flaws Discovered

A set of 36-year-old vulnerabilities has been uncovered in the Secure Copy Protocol (SCP) implementation of many client applications that can be exploited by malicious servers to overwrite arbitrary files in the SCP client target directory unauthorized… Continue reading 36-Year-Old SCP Clients’ Implementation Flaws Discovered