SSHole Vulnerability Turns Alpine Containers Into Free Botnet Nodes
Most remote-access bugs demand a groomed heap, a race window and a small miracle. SSHole asks for something far humbler: a password of 257 characters or more. On musl-based Linux without PAM, sshd compares the output of crypt() against the * in /etc/shadow, decides the two match, and logs you in as any account whose password field is locked — root included. OpenSSH rushed out 10.6p2 as an emergency fix, and just like that the SSHole vulnerability became the cheapest recruitment pipeline a botnet operator could wish for.
A DoS guardrail repurposed as a skeleton key
Since 2016 OpenSSH has defended against username enumeration by timing: when an account carries no password, sshd still calls crypt() with the salt of a real user's hash and compares the returned value to the stored one. musl, however, returns the literal string * for SHA-512 hashes whenever the supplied password exceeds 256 bytes — a cap introduced in 2012 so that oversized inputs could not burn CPU. And * is exactly what /etc/shadow uses to mark accounts with password authentication disabled. Two unrelated engineering decisions, one shared symbol, and authentication collapses into a formality.
The blast radius is the part of the fleet nobody rebuilds: Alpine containers, OpenWrt routers, Buildroot and Yocto firmware, and the stock Alpine cloud images on AWS and Azure, where root's password field has been * since 2022. glibc hosts and anything routing password checks through PAM are untouched — which is precisely why the vulnerable population is the one that never gets patched on schedule.
The patch gap is the real attack surface
Alpine and OpenWrt shipped fixes within hours, and the OpenSSH maintainers were quick to point out that the defect lives in musl rather than in their own code. That distinction is cold comfort for a container image pinned to an older base layer, a router whose vendor ships firmware twice a decade, or a CI runner built from a Dockerfile nobody has opened since 2023. Enumerating those hosts is trivial: Shodan and Censys return OpenSSH banners on Alpine and BusyBox systems by the thousand, and a single 257-byte credential tests the entire list in milliseconds.
Expect automated SSH brute-force and credential-stuffing frameworks to absorb a working PoC first, then spray it across whole netblocks. What falls out is a supply of bots that is unusually quiet — no IRC channel, no HTTP beacon, no domain to sinkhole, just a shell on a host inside a datacenter with a fat uplink and a monitoring stack that was never watching for inbound SSH. The SSHole vulnerability is, in other words, a patch-gap problem wearing a cryptography costume.
From free shells to floods
A few thousand of those containers make an excellent attack platform. They sit close to the victim's network with low latency and generous bandwidth, which is exactly what a UDP flood, a UDP PPS flood, a SYN flood or an ACK flood wants. Where the target hides behind scrubbing, the same nodes pivot to layer 7: HTTP GET flood and HTTP POST flood traffic driven by headless browser emulation, TLS flood sessions with rotated JA3 fingerprints, Slowloris connections held open by the thousand, or HTTP/2 Rapid Reset against whoever forgot to patch their edge. Add user-agent rotation and a little JS challenge bypass work and you have a serviceable cloudflare bypass pipeline.
From there the economics write themselves. The nodes feed ip stresser panels, booter resellers and any ddos service renting capacity by the minute — no infrastructure to buy, no C2 to lose, no ddos protection vendor holding a signature for a login attempt. We have written before about what a few thousand fat pipes can do when they fire together; the numbers live on our achievements page.
If you run Alpine, OpenWrt, Buildroot or Yocto anywhere in your estate, set PasswordAuthentication no today and rebuild the images tomorrow — the fix exists, the images do not. And if you would rather discover how much of that leftover capacity your own edge can absorb before somebody else does, our free stress test at /contact is a considerably friendlier way to find out.