search

RUB-NDS / Terrapin-Scanner

This repository contains a simple vulnerability scanner for the Terrapin attack present in the paper "Terrapin Attack: Breaking SSH Channel Integrity By Sequence Number Manipulation".
https://terrapin-attack.com
Apache License 2.0
931 stars 62 forks source link

13 security vendors and no sandboxes flagged this file as malicious #23

Closed Befeeter closed 7 months ago

Befeeter commented 7 months ago

I have analized the i386.exe and virustotal report that it has multiple trojans.

image

TrueSkrillor commented 7 months ago

I am aware that some vendors on VirusTotal are detecting our tool. I assume this is because our tool performs a single connection immediately after the program starts (and nothing else), a typical pattern for trojans when downloading additional malware. Also, I'd like to point out that the Windows binaries are not digitally signed, increasing the likelihood of being flagged maliciously.

I'd recommend to review the source code and build from the source if you have any concerns (as for all pre-built binaries). We are providing the binaries for convenience only here.