  The SSH protocol provides secure access to network services, particularly
remote terminal login and file transfer within organizational networks and to
over 15 million servers on the open internet. SSH uses an authenticated key
exchange to establish a secure channel between a client and a server, which
protects the confidentiality and integrity of messages sent in either
direction. The secure channel prevents message manipulation, replay, insertion,
deletion, and reordering. At the network level, SSH uses the Binary Packet
Protocol over TCP. In this paper, we show that the SSH Binary Packet Protocol
is no longer a secure channel: SSH channel integrity (INT-PST, aINT-PTXT, and
INT-sfCTF) is broken for three widely used encryption modes. This allows prefix
truncation attacks where encrypted packets at the beginning of the SSH channel
can be deleted without the client or server noticing it. We demonstrate several
real-world applications of this attack. We show that we can fully break SSH
extension negotiation (RFC 8308), such that an attacker can downgrade the
public key algorithms for user authentication or turn off a new countermeasure
against keystroke timing attacks introduced in OpenSSH 9.5. Further, we
identify an implementation flaw in AsyncSSH that, together with prefix
truncation, allows an attacker to redirect the victim's login into a shell
controlled by the attacker. We also performed an internet-wide scan and found
that 71.6% of SSH servers support a vulnerable encryption mode, while 63.2%
even list it as their preferred choice. We identify two root causes that enable
these attacks: First, the SSH handshake supports optional messages that are not
authenticated. Second, SSH does not reset message sequence numbers when
activating encryption keys. Based on this analysis, we propose effective and
backward-compatible changes to SSH that mitigate our attacks.
