The scenario as stated makes little sense.
When Junior uses ssh -J
he would be connecting to a machine (destHost) through an intermediate one (jumpHost).
So, in your scenario Junior would connect to a trusted destHost (owned by his grandma, perhaps?) by jumping through an untrusted jumpHust [potentially] owned by an evil third party.
Now, if can ssh to jumpHost
, he almost surely can directly ssh to destHost
as well, so there is no need for the untrusted intermediary. But let's suppose he does that.
What can a malicious jumpHost
do?
As long as the Junior uses the tools properly (and they are updated enough), very little. This includes actually checking the fingerprint of destHost
on the first connection (compared to the right fingerprint, provided off-band), and actually using -J
(ProxyJump
directive), not connecting to jumpHost
and then to destHost
from a jumpHost
shell.
The information that could be gathered by the malicious jumpHost
would be that related to traffic. Mainly that would be: origin ip (Junior's), destination ip (destHost's), connection times and amount of traffic exchanged on each direction. The traffic itself would be encrypted, so it shouldn't be able to figure out what gets transmitted (but there might be nasty side-attacks).
If Junior needs to enter some password over the connection, jumpHost might be able to partially guess some typed data based on frequency (CVE-2001-0572), but there are some countermeasures designed to make that hard.
I should note that Junior is unlikely to be visiting Reddit with a console browser over ssh, or reading their mail on destHost
using mutt
.
Note that if Junior was to use jumpHost
as a proxy instead (which would be a far more likely scenario) the analysis would be completely different.
Finally, while a different kind of security risk, the (continuous) connection of Junior machine to a foreign-country-considered-an-enemy (and source of many cyberattacks), may raise some security alarms. And the responding team will not be pleased that what they thought was a compromised machine, an insider, data exfiltration or first step of ransomware attack, turned out to be a silly junior violating company policy (or actually, they will prefer this outcome, but won't enjoy the heart attack he almost caused them).
If Junior wanted to visit Reddit or Gmail during work hours, it would be far easier for him to do so using a different computer than the one used for work, or simply a smartphone. That is likely to still contravene company policy by procrastinating during work time (depending on his actual job and contract), but it wouldn't bypass other security policies that the ssh connection would.