Client hacked via ssh session

Question

I was using my Mac's terminal for a ssh connection to a server from a hosting service provider. Sometime right after I finished the session and closed the terminal, my Mac stopped responding and showing the beach ball. After waiting for 2-3 minutes, I decided to unplug the network cable. I noticed that my Mac behaved differently and still not responding to mouse or keyboard. Another 2-4 minutes, I decided to force a shutdown by holding down the power switch until it is off.

After that my Mac would not boot up and indicated there is no disk. If I went into the discovery mode, it only shows the recovery partition. All other partitions were gone.

Could my Mac being hacked and partitions were deleted? I remembered when my first time setting up ssh connection with this hosting provider, I did get a warning something about the encryption version .99 needed to be updated, etc. But I have not done so.

Can a ssh client be hacked when using a ssh connection?

Answer 1

This looks like a coincidence. It looks like your hard drive broke while you happened to have an SSH session open.

SSH is a point-to-point protocol. As the client, the only one you are communicating with is the server. It is also a very secure protocol specifically designed to not allow any 3rd party to eavesdrop or manipulate data. Maybe if your SSH client has a vulnerability, a malicious server could exploit it. But that would assume that:

• The server you connected to is malicious. When it is a professional hosting provider, that's unlikely. Hacking your customers is bad for business.
• They had nothing better to do than randomly destroy your data. That's really unlikely, because there is no benefit in doing that. There is a million better things to do when you have a remote execution vulnerability, and most of them work best when the user doesn't notice anything at all.

Answer 2

Assuming you are connected via a CLI (i.e no GUI) the remote host cannot do this kind of damage via an ssh connection, the remote has zero privilege over you local machine as there is no shell back to you.

A malicious remote host could do a few things to ruin your experience and make your local machine run slow (console streaming etc)so this could cause the beachball etc but after a disconnect and at worst a reboot your machine would have been fine.

All the above is assuming there was nothing else going on, i.e this was a regular SSH connection, from the native terminal using unmodified protocols etc.