attachment
<html><head><meta http-equiv="Content-Type" content="text/html; charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Ira,<div class=""><br class=""></div><div class="">Sorry, I guess I forgot to re-subscribe to the IDS list post-Apple, but I have some issue with the following text in section 12.7.17 on SSH:</div><div class=""><br class=""></div><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;" class=""><div class=""><div class="">Note: SSH is inherently dangerous, because implementation or configuration errors can allow privilege escalation and unconstrained remote shell capabilities on target systems. SSH has major security flaws and has often been used for widespread Internet attacks by intelligence agencies and criminal organizations. Therefore, SSH is unsuitable for use in any HCD.</div></div></blockquote><div class=""><div class=""><br class=""></div><div class="">SSH is an Internet Standard and is IMHO the only viable solution for a remote "shell" interface. Honestly I wouldn't want any vendor to try to invent their own "secure" solution (you know what happens then...)</div><div class=""><br class=""></div><div class="">I would much prefer that the PWG talk about *what* the actual security considerations are and not focus on historical issues that have a) been fixed and b) affected specific implementations of SSH and not the protocol itself.</div><div class=""><br class=""></div><div class="">For example:</div><div class=""><br class=""></div></div><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;" class=""><div class=""><div class="">Note: The Secure Shell protocol is a common target for exploitation by malicious actors. See section 9.X for a discussion of the security considerations of providing an SSH service on an HCD.</div></div></blockquote><div class=""><br class=""></div>and then:<div class=""><br class=""></div><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;" class="">9.X Secure Shell (SSH) Considerations</blockquote><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;" class=""><br class=""></blockquote><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;" class="">HCDs that provide a SSH service MUST NOT enable a common default password and MUST restrict the commands that can be executed to those needed for maintenance of the HCD that cannot be supported through other standard protocols.</blockquote><div class=""><br class=""></div>We can debate what the full text should be, but IMHO the focus should be that a) SSH is a common target, b) SSH (like all HCD software) needs to be updated to address security issues, and c) SSH should not provide general access to the device. Ideally it shouldn't be needed, but some HCDs are complex enough that a service tech might need to dig a bit to configure/fix things.<div class=""><div class=""><br class=""><div class=""><div class=""><div class="">________________________<br class="">Michael Sweet<br class=""><br class=""><br class=""></div><br class=""></div></div></div></div></body></html>