1

Can a ransomware attack on a user's local machine affect the server of the company he works for, even if that server is in the cloud (VPS) and can only be accessed via SSH (with a key file, no password)?

Team environment for remote administration: The only software that allows access to the server with files from the website are Termius (SSH) and Transmit (SFTP), TablePlus (for direct connection to a database, on another server and without access to configuration files). All with IP restriction for access.

Server environment: Servers will only allow writing, deleting and modifying files if the user is root. To run sudo by the user who connected via SSH, it is always necessary to enter a password.

With these settings is there any risk?

2

If the user's public ssh key is stored in the cloud server's authorized_keys, then the user's local machine has unfettered access any files that the user has been granted permissions to access on the cloud server. In that case, once the ransomware has infected the user's local machine, there is nothing to stop it from accessing these files on the cloud server. It's just a matter of whether or not the ransomware has been programmed to look for this possibility and exploit it.


Edit - I see that you added the following to your question after I posed the answer above:

Server environment: Servers will only allow writing, deleting and modifying files if the user is root. To run sudo by the user who connected via SSH, it is always necessary to enter a password.

If that's the case, then the ransomware would need the root password to delete or modify files. Having said that, the fact that the user's local machine has been compromised means that the attacker is only limited by the user's privileges in terms of what they can do on the machine. Therefore, the ransomware or the attacker could easily install a keylogger, and pickup the root password that way. Again, it's a matter of whether or not the ransomware was programmed to look for this possibility and exploit it.

6
  • 1
    And if the key for access is protected with a passphrase, does the risk decrease?
    – Tom
    Jun 24 '21 at 17:15
  • 1
    @Tom, I edited my answer in response to the edit that you made to your question. Please see above.
    – mti2935
    Jun 24 '21 at 17:19
  • 1
    What would be the best, perhaps even paranoid, measure to prevent an attack on the machine that accesses the servers? Ex.: Staying on a separate LAN? Run in a virtual machine?
    – Tom
    Jun 24 '21 at 17:25
  • 1
    FYI: Because of this problem, I recommend a backup system where the backup server 'pulls' the files from the primary server, rather than the primary server 'pushing' the files to the backup server. See security.stackexchange.com/questions/222082/… for more info. With this setup, your files are safe on the backup server, even if the primary server is compromised.
    – mti2935
    Jun 24 '21 at 17:27
  • 1
    While you should do what you can to reduce the attack surface of the client machine, you could also harden the server setup by requiring a cryptographic one-time 2FA using eg. a hardware key. So if someone does attempt to log in with the key from the client and fails at providing the second factor, you can be notified and still be sure that the key wasn't used to log in.
    – Alex
    Jun 25 '21 at 9:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.