The Research Of SSH Man-In-The-Middle Attack

With the development of computer network especially the Internet,the security of network receives more and more attention.In order to protect data security over network environment, SSH(Secure Shell) is a common measure. The SSH protocol uses openly published, strong cryptographic tools to provide network connections with privacy,integrity,and mutual authentication. Through secure authentication and encryption technologies, SSH supports secure remote logins, secure remote command exectution, secure file transfers, access control, TCP/IP port forwarding, and other important features. SSH protocol plays an important role in the Internet, when it first was introduced to the public. But it still had a number of shortcomings and flaws. Some hackers use these flaws to commit crimes.Presently, Man-in-the-middle attacks pose a serious threat to e-commerce and e-government applications, such as Internet banking.An adversary sits between you and your real peer, intercepting all traffic and altering or deleting messages at will.So how to prevent e-commerce and e-government based SSH protocol becomes very urgent. This problem should be token the attention from theory to action.The paper first introduces the work principle of SSH protocol, analyses its security mechanism, and discusses possible attacks on it. In view of the server authentication problem in the handshake of SSH protocol, the paper makes a concrete analysis of the principle of SSH MITM (man-in-the-middle) attack based on ARP redirection. The paper gives some improvements of SSH on how to prevent MITM attack. These improvements enhance server authentication and prevent SSH against MITM attack. In the end the author points out the work should be improved in the future.