Please Don't Look This Up...

Summary

Mutahar explains a Linux/SSH authentication vulnerability he calls “Star SSHole.” Under a narrow set of conditions, a password longer than 256 characters could cause the affected system’s password-checking process to fail open, potentially allowing an attacker to log in without the correct password.

How it works

Linux systems generally store password hashes—not plaintext passwords—in /etc/shadow. The vulnerability involved sshd authentication and musl, the C library used by Alpine Linux.

In the affected case, musl’s handling of long passwords could return *, a marker normally used to indicate that an account cannot log in with a password. A faulty comparison could then treat the attempted password as matching that marker.

Why it persisted

The video traces the issue to older compatibility behavior involving password hashing and crypt(), along with later changes related to SHA-512 crypt, password-length limits, and Alpine Docker images. The interaction between these changes created a specific set of conditions in which authentication could be bypassed.

Who may be affected

The risk is limited. It generally requires an affected, outdated system or container using musl, with SSH enabled and exposed in the relevant configuration. The speaker says most updated Linux installations are not vulnerable. OpenWrt systems are also unlikely to be affected by default because they typically use Dropbear rather than the affected SSH setup.

Severity and response

The bug was patched, and the speaker emphasizes that headlines implying all Linux systems are vulnerable are misleading. Anyone running an exposed system that meets the required conditions should update it and check whether SSH is enabled and accessible.

Broader security advice

Mutahar argues that users remain a major security risk. He recommends caution when installing browser extensions or developer tools, even from official-looking marketplaces, and notes that social engineering and malicious downloads can pose more common risks than old software bugs.

Guide or review

This is a cybersecurity explainer rather than a product review or step-by-step tutorial. The speaker describes how to inspect Linux password entries and use SSH, and mentions that researcher Oz9 provided a script for checking exposure.

Main speakers or sources

• Mutahar, host of SomeOrdinaryGamers, provides the explanation and security commentary.
• Oz9 is credited with identifying or demonstrating the vulnerability.
• The video also refers to Linux and Alpine maintainers’ patches and to media coverage, while disputing some of the broader headline claims.