Name: Secure Copy Vulnerability (SCP) - Computerphile
Uploaded: 2020-03-27T16:56:16.000Z
Duration: 9 min 37 s
Description: Thousands of YouTube videos with English-Chinese subtitles! Now you can learn to understand native speakers, expand your vocabulary, and improve your pronunciation...

Past simple

Earlier this week. There was a sort of announcement about a bug in a program called SCP

Gerund

SCP stands for secure copy it's a way of copying files between two different machines

So it's a secure way of copying a file from one remote machine to your local machine or vice versa

Personally I use it all the time to copy files from my laptop to the desktop machines particularly from outside the office and so on

It's a very easy way to do things from the command line

so he talked about SCP the name of a machine and then the file we want to copy so I know it's

Stored at this location remember name and so they want Corey to the local machines. I don't give a machine name

I'm putting a full stop for the current directory hit return ask me for my password

And it starts copying it in this case. It's going over to wireless network. So it's not going that fast, but it's copying it off

This machine on here. And so we're copying that file from that machine to here

So the books that were sort of disclosed by Harry Sentinel and f-secure

When you ask it to copy a file it allows a malicious server to return

Basically any file it likes to your machine. There are some limitations and the client will happily write it into the right thing

even if it's not a file it requested so I could say please download our PI to

Our PI - image GZ from my machine and the server could say here. Here's dot bash profile

and it would copy that into the current directory and if that was the

My home directory that would override my dot bash profile

Which is a script that gets run every time I log into the machine and so the server would be able to pass it down

A file but the next time I logged on would allow the malicious actor who's taking control of the server to sort of

Infect my machine with some code that they wanted to run the way the exploit works. The server is able in certain circumstances to

But to send something else down and put it in a way that and that it gets the client to put it in a place

authorized keys that allow you to log into the system or

Replace a script that gets run a startup like your batch profile. I mean actually this burg dates back way before

SCP existed because it's actually come from an earlier program called RCP, which start was stood for remote

Copy did pretty much the same thing, but unlike SCP. It didn't bother encrypting the data as it went over

He just did a straight transfer. This was written in 1983. It's part of one of the early berkeley

Releases of unix and there's been quite popular until obviously SCP came along in the mid 90s

SCP takes the RTP protocol and basically implements it exactly the same but using a secure transport using ssh

To transfer the data the interesting thing though

Is that both the way that SCP and RCP work is I find a little bit interesting and that when I ran

This command on my machine here SCP it connected to the other machine

But you might think okay talk to the SSH daemon on there

The protis is a server on there and says please send me this file but somebody does

I chose a file that was big enough. It would take a while to do that. I'm gripped to see what SCP is doing

So I'm looking all the processes and particularly the ones that are SCP. I

Find the program I ran SCP. Jailer the name of the machine to copy the file

But there's also this other one on the line above and what's actually happening the way

SCP actually work because it makes a standard SSH connection from my laptop to the remote machine or whatever machines are connecting and

It runs the SCP program on the remote machines with a specific flag in this case

It's minus F and then the name of the file that you want to copy

And if we look on this machine just to show the case

Then we can see again that that program is running on that machine

So the way that SCP works it connects to the remote machine and runs

with a flag telling it it's being run on the remote machine and if you look in the source code for SCP you can see

How it does that it detects that flag in it, then those it's going to send a file back over and what SCP does?

Is it sends their over a little header which describes the fire that's going to send and then it just sends the data

Over the standard output the UNIX provides which gets routed over the SSH connection back to the copy of SCP

You're running on machine, which doesn't writes it out the disk

So let's have a look at how that sends things and we can do that

Because if we go back to where we're transferring the file and stop it, we can actually ask SSH or SCP in this case

They give us more information about what's going on and get it to print out

The message isn't is something between thing give us debug information by using the minus V flag. So if we run

Then we get all sorts of information about the key exchanges that are happening

It's asking me for my password again, and then eventually we get down here

Where it says I'm sending the command that I want to run so it sent the command

SCP with the minus three and the minus F flags across that's now running on the other machine

And then it shows us the command that it received from the copy of SCP running on this thing

permission bytes for the file in this case 0 644 in octal and standard UNIX permissions

We've got the size of the file in bytes three four one zero seven

Nine one one more one in this case a big file and then the file name and then we can see it

Transferring the file and occasionally as it's doing that

We'll see the keys get updated as it changes encryption keys to make sure that we don't lose anything. The problem is

That this line here the ones preceded sync the source code before the SCP client

Just takes the filename that's returned and uses that as the file

It writes to the disk now just do some simple checks it checks that you're not trying to traverse up the directory structure

It checks that you haven't given it an absolute path. But other than that, it just writes that file

to do so if you were to write a malicious piece of software and all we need to do is replace the

Don't you do anything more complicated than write a program that?

Returns the right values to compromise the system and then replace the SCP binary on that machine

We've got root access to that server. That would be relatively easy

so what we need to do is change the value that

then this client because he doesn't check that value is a what it asked for or

B make sense beyond some very very simple checks. We'll write that new file

Into the current directory or if you've asked for a recursive copy copy lots of files in different directories

It could write them into other directories or it could even change the permission on the current directory. So it

could be used in certain circumstances to

Enable people who've got control of the server

To push files down onto your client when you use that command

I mean some ways this functionality has to be there because we specify our wild-card and you're copying files

Then the server has to be able to drive the client what files is going to send down?

Otherwise you'd have to know what the files are on the server before you could copy them down

I think the real core the problem here is it's not doing