Catch-22: Uncovering Compromised Hosts using SSH Public Keys

Cristian Munteanu, Georgios Smaragdakis, Anja Feldmann, Tobias Fiebig

34th USENIX Security Symposium · Day 1

This distinguished paper from USENIX Security 2025 presents a novel, scalable methodology to identify compromised SSH (Secure Shell) servers across the Internet. Authored by researchers from the Max Planck Institute for Informatics and Delft University of Technology, the work leverages a specific, intended behavior of the SSH protocol: a server only sends a cryptographic challenge during public key authentication if the provided public key is actually installed for the specified user. This subtle distinction allows researchers to remotely ascertain the presence of known malicious public keys without requiring access to the corresponding private keys or completing the authentication process.

AI review

This is the kind of research that makes you sit up. They took a documented-but-ignored protocol quirk, weaponized it for defense, and found 21,000+ compromised hosts including a core router at a major European ISP. Novel method, real-world impact, responsible execution. Distinguished paper award was earned.