HASSH is a network fingerprinting standard that identifies specific SSH client and server implementations by analyzing the algorithms used during the initial SSH negotiation. It leverages MD5 hashing of the algorithms exchanged in the SSH_MSG_KEXINIT packets. By concatenating these algorithms with a delimiter and calculating the MD5 hash, a unique fingerprint is generated for each SSH configuration. This allows for detailed analysis and identification of potentially malicious or unusual SSH clients.
HASSH provides a granular method for identifying SSH clients beyond simple IP addresses, offering improved detection of attacks like brute-force and credential stuffing. It supports use cases like detecting covert data exfiltration, application control, and forensic analysis. Its relatively small fingerprint size makes it suitable for storage and sharing, and it can be implemented with minimal overhead. Additionally, it serves as an indicator of compromise, contributing to enhanced security posture.
- Client Fingerprinting: Identifies specific SSH client implementations (e.g., Cyberduck, PuTTY) based on supported algorithms.
- Server Fingerprinting: Identifies specific SSH server implementations (e.g., OpenSSH) based on supported algorithms.
- Anomaly Detection: Can be used to alert on unusual or unexpected SSH client/server configurations.
- Application Control: Enables blocking connections from non-approved SSH clients based on their HASSH fingerprint.
- Forensic Analysis: Provides a higher level of abstraction than IP addresses, aiding in identifying malicious activity.
The HASSH project is no longer actively maintained by Salesforce, but a fork is under active development by Corelight. The project maintains a well-defined specification and is a mature method with documented examples. Community usage is growing, and readily available tools are emerging to leverage HASSH fingerprints. The existence of a fork indicates ongoing community support and evolution.
HASSH benefits security analysts and system administrators by providing a method to identify SSH clients and servers at a detailed level. It aids in detecting malicious activity, enforcing application control policies, and improving forensic investigations related to SSH connections. HASSH offers a more robust and granular approach compared to relying solely on IP addresses, making it valuable for organizations seeking to enhance SSH security.