SSH-Snake Worm Built from Open-Sourced Legitimate Tool
A freshly open-sourced tool for network mapping known as SSH-Snake has been repurposed by malicious actors for illicit purposes. Sysdig researchers revealed that SSH-Snake, identified as a self-modifying worm, exploits SSH credentials found on compromised systems to propagate itself across the network. The worm autonomously scans well-known credential locations and shell history files to determine its next actions.
Released on GitHub in early January 2024, SSH-Snake is characterized by its developer as a potent tool for automatic network traversal, utilizing SSH private keys discovered on systems. It creates a detailed map of a network and its dependencies, assisting in gauging the potential compromise of a network via SSH and SSH private keys originating from a specific host. The tool is also capable of resolving domains with multiple IPv4 addresses.
SSH-Snake Self-Replicates, Harvests Data
Described as entirely self-replicating, self-propagating, and fileless, SSH-Snake behaves like a worm by spreading from one system to another. Sysdig noted that the shell script not only facilitates lateral movement but also provides more stealth and flexibility compared to typical SSH worms.
In real-world attacks, threat actors deploy SSH-Snake to harvest credentials, target IP addresses, and bash command history after discovering a command-and-control server hosting the data. These attacks involve actively exploiting known security vulnerabilities in Apache ActiveMQ and Atlassian Confluence instances to gain initial access and deploy SSH-Snake.
Researchers emphasized that SSH-Snake attempts to exploit the recommended practice of using SSH keys, providing threat actors with a smarter and more reliable means to extend their reach into a network once they establish a foothold.
When questioned about SSH-Snake, Joshua Rogers, the tool's developer, asserted that the tool allows legitimate system owners to identify vulnerabilities in their infrastructure before attackers do. Rogers encouraged companies to use SSH-Snake to discover existing attack paths and address them proactively. He argued against the common belief that cyber terrorism occurs suddenly, advocating for a proactive approach to system design and maintenance with comprehensive security measures.
