8

I am working on distributed architecture where we have automated data distributions using bit-torrent. But sometimes we need instant access to some data stored on remote server. So I wanted to know how secure SSH (SCP) file transfers are (generally tar.gz of Images OR 2-3GB access logs). Can my ISP or anyone else sense what I am transferring and intercept them?

Also how network manage will see these data on their monitoring server?

4 Answers 4

13

The SSH/SCP traffic will be practically impervious to snooping (presuming you validate server fingerprints the first time you're connecting to prevent man-in-the-middle shenanigans).

From an attackers point of view, it'll look a little like this XKCD comic:

http://xkcd.com/538/

Basically, an attacker will find it more useful to compromise the end points (perhaps by beating you with a $5 wrench) than to try to snoop the traffic itself.

4
  • Does it still counts as HTTP Download? I mean will size and content-type are traceable? Jul 17, 2012 at 12:40
  • 5
    Size - kind of, in that anyone monitoring the network will know how many bits went over the wire. They won't be able to tell the difference between command traffic and file downloads, however. And content-type doesn't exist in SCP, so no.
    – mfinni
    Jul 17, 2012 at 20:38
  • 2
    @whoru SSH/SCP traffic is not HTTP traffic, so someone watching the network can tell that you are not using HTTP and possibly block that. But they will not be able to tell what that SSH traffic actually is, be it top secret documents, financial records, or videos of your kid's birthday party. It will all be gibberish to someone who does not have the SSH keys.
    – cjc
    Jul 17, 2012 at 20:48
  • 4
    In addition, if you're using compression with SSH (-C flag) there is no way for a middle-man to know how much uncompressed data is being transferred; you could transfer a 500 MB plaintext file (highly compressible) and use a few megabytes of actual bandwidth, which is all they would see. Jul 18, 2012 at 0:49
4

SCP is as secure as any other SSH based traffic, unless they're particularly talented and/or determined then your ISP or anyone else won't be able to tell what data you're sending at all, to them it'll look like just a hell of a lot of SSH traffic.

So I'm not saying it's impossible for them to know what you're up to (what are you up to? :) ) but it's improbable that they will.

1
  • 7
    Just note that he MUST verify the remote public key the first time or he expose himself to MITM, generally the remote public key signature is stored locally after the first connection.
    – Shadok
    Jul 16, 2012 at 14:44
4

If you're using SSH, the data is encrypted. As long as your keys are secure, your data is secure. Anyone running a sniffer or netflow, etc, will only see that there's an SSH connection between the two IP addresses. The contents will be secure.

Now, you say "intercept", which I take to only mean "read" or possibly "hijack/inject." They could inject packets, but they won't decrypt into anything useful (to you or them.) They could block them, and you'd know about it right away.

What attack mode(s) are you concerned about?

3

SSH is a fully encrypted protocol for point-to-point communication. They will see the source and the destination, but not the contents of the packets.

Secure Shell on Wikipedia

The encryption used by SSH is intended to provide confidentiality and integrity of data over an unsecured network, such as the Internet.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .