The ssh private key file, stored under ~/.ssh/id_rsa in many *nix distros, is typically owned by the user, allowing any program invoked by that user to read the file, and perhaps upload it to a remote server.

Is this accurate? Are there examples of malware known to have done this? How common is this?

  • 2
    Yes, there is such a possibility. A malware can be programmed to do such data ex-filtration once the system is breached since the ssh key file is stored in a known location. The recent attack on Sony is one classic example. Commented Jan 11, 2015 at 14:22
  • While this doesn't answer your question, I'd suggest setting up passwords on your SSH keys to mitigate the risk
    – tokarev
    Commented Jan 14, 2015 at 14:16

2 Answers 2


Has been done, you can find a few reports online: Careto and Windigo. That said, it isn't your classical "let's own this machine and then use it for DDoS" kind of malware - people who operate the above are interested in long term peristence.


You cannot completely restrict the Malware stealing the private key. But you can protect in lot of ways by installing the latest antivirus with overall host protection. You can allow only root user to install the packages and execute it. So what ever the extraction its completely the root ownership and its password is only known to the particular person. And another one more thing that you can modify the keys regular to avoid these kind of stealing. Anyhow safety is in your hand to protect.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .