SSH is the protocol most engineers trust without a second thought. Terrapin, disclosed in December 2023 as CVE-2023-48795, showed that a network attacker sitting between client and server can quietly delete messages from the very start of an SSH connection, and the encryption never notices. It does not decrypt anything. It manipulates the sequence numbers that hold the session together.
Terrapin is a prefix truncation attack. That phrase does most of the work: an attacker who controls the network path can chop a controlled number of messages off the front of the encrypted stream so that both sides end up in a slightly different state than they agreed to. The research came from Fabian Bäumer, Marcus Brinkmann, and Jörg Schwenk at Ruhr University Bochum, and it is notable because SSH had spent two decades being treated as effectively unbreakable at the transport layer.
The attack does not recover your password or read your files. What it does is subtler, and understanding it is a good lesson in how real cryptographic protocols fail. They rarely fail because the cipher is broken. They fail at the seams between the parts.
How SSH keeps a session honest
When an SSH client and server connect, they run a handshake. They exchange version strings, negotiate which algorithms they will use, perform a key exchange, and then switch on encryption for everything that follows. To make sure nobody has tampered with any of the messages in transit, SSH uses a running sequence number. Every binary packet gets an implicit counter, starting from zero, and that counter feeds into the message authentication code that protects each packet.
