id: dropbear-weakmac info: name: Dropbear Weak MAC Algorithms Enabled author: pussycat0x severity: low description: | The mac-alg command specifies which MAC algorithms in the SSH client profile for SSH encryption negotiation with an SFTP server when the DataPower Gateway acts as an SFTP client. reference: | https://www.virtuesecurity.com/kb/ssh-weak-mac-algorithms-enabled remediation: | Disable MD5 and 96-bit MAC algorithms. metadata: max-request: 1 shodan-query: product:"Dropbear sshd" verified: true tags: network,ssh,dropbear,misconfig tcp: - inputs: - data: "\n" host: - "{{Hostname}}" port: 22 matchers-condition: and matchers: - type: word words: - "hmac-md5" - "hmac-sha1" condition: or - type: word words: - "SSH-" # digest: 4a0a0047304502201e312e2112fd02be44c3d23cd1171be0f3e848d31cb26cebf4fef752f3cd645a022100ec6214b3268a8c3179da31e03e230be9b84a0750e5ce1bf134e50d2dc5e9fe2d:922c64590222798bb761d5b6d8e72950