  The SSH protocol provides secure access to network services, particularly
remote terminal login and file transfer within organizational networks and to
over 15 million servers on the open internet. SSH uses an authenticated key
exchange to establish a secure channel between a client and a server, which
protects the confidentiality and integrity of messages sent in either
direction. The secure channel prevents message manipulation, replay, insertion,
deletion, and reordering. In this paper, we show that as new encryption
algorithms and mitigations were added to SSH, the SSH Binary Packet Protocol is
no longer a secure channel: SSH channel integrity (INT-PST) is broken for three
widely used encryption modes. This allows prefix truncation attacks where some
encrypted packets at the beginning of the SSH channel can be deleted without
the client or server noticing it. We demonstrate several real-world
applications of this attack. We show that we can fully break SSH extension
negotiation (RFC 8308), such that an attacker can downgrade the public key
algorithms for user authentication or turn off a new countermeasure against
keystroke timing attacks introduced in OpenSSH 9.5. We also identified an
implementation flaw in AsyncSSH that, together with prefix truncation, allows
an attacker to redirect the victim's login into a shell controlled by the
attacker. In an internet-wide scan for vulnerable encryption modes and support
for extension negotiation, we find that 77% of SSH servers support an
exploitable encryption mode, while 57% even list it as their preferred choice.
We identify two root causes that enable these attacks: First, the SSH handshake
supports optional messages that are not authenticated. Second, SSH does not
reset message sequence numbers when encryption is enabled. Based on this
analysis, we propose effective and backward-compatible changes to SSH that
mitigate our attacks.
