Uncovering Compromised SSH Hosts in the Internet

SSH is a core tool for remote access to systems, which makes it a desirable target for malicious actors. We present a method to identify compromised servers by checking whether they recognize SSH keys previously observed in attacker operations. Because attackers often reuse keys, this uncovers systems where their keys were installed. We apply this technique at Internet scale and managed to uncover thousands of affected hosts, with many remediated after our notification. This is how we at the Max Planck Institute for Informatics are researching methods to strengthen Internet security.