Cybersecurity Friday, Cursor and your .ssh directory¶
I had this funny idea of doing Cybersecurity Fridays where I take one step to improve my system security and/or reduce the exposure of my personal data.
My first quick win was to ask if I still needed Node.js installed on my Laptop. Homebrew told me that there were zero packages managed by it that depend on it, so it was time for brew remove node. That's it done, I thought and started packing my lunch for a day in the office.
Just a quick check of Hacker News and off I would be on my bike. Turns out today was the day a malicious version of the Claude Code plugin was published on the Cursor marketplace. I spent the morning letting people know and trying to provide meaningful updates in places full of people who don't read Hacker News but should probably know.
I will leave it to Cybersecurity professionals like Kevin Beaumont to give us the final word on what happened and what follows from this.
However, the one lesson to take away from this incident is that we should look for opportunities to work with minimum permissions. One thing the malicious code did was to append a key to the ~user/.ssh/authorized_keys file. It could do that because users typically have rights to do so. Do they really need this? How often we do really create new keys and need to install them?
As I self-manage my machines, I set about taking away privileges from myself as a normal user:
sudo zsh
cd ~user
chown root .ssh
chmod g+rx .ssh
ls -ld .ssh
drwxr-x--- 2 root user 4096 Oct 27 07:58 .ssh
A process running with my normal user privileges can now read the content of my .ssh directory but it cannot write to it. This is important so that malicious code cannot just (re-)create authorized_keys files.
The next step is to ensure the authorized_keys file is not writable with normal user permissions:
cd .ssh
chown root authorized_keys
chmod g+r authorized_keys
ls -la
total 16
drwx------ 2 user user 4096 Oct 27 07:58 .
drwx------ 12 user user 4096 Oct 30 11:43 ..
-rw-r----- 1 root user 105 Oct 27 07:50 authorized_keys
There is one file that users modify quite often as part of day-to-day work and that is known_hosts. If you don't have one already, create it and make sure it is owned by the user as well as readable and writable for them:
Now, making changes in .ssh is more cumbersome but I would argue that it was too easy with the default settings.