Seal broke, theft waved through
Every night cron tidied cache and logged success. Last night, midway, it also shipped Bitcoin wallet to stranger — nothing left out of place: file present, log clean, one copy of the key astray. By morning, every coin gone.
21 July 2026
The job had run on schedule every night for months. It tidied a cache, wrote success to its log, and went quiet until the next night. Last night it did all of that — and somewhere in the middle it also copied the Bitcoin wallet to a stranger. Afterwards, nothing on the server looked wrong. The wallet file was still in its place. The log said the job had finished. “The only thing out of place was my private key, sitting on someone else’s computer.”
Tamper-evident seals were supposed to stop it.
SSH backs almost every remote login and automated server-to-server task on the internet. It does two jobs at once: it encrypts the connection so no eavesdropper can read it, and it stamps every message with a small tamper-evident seal. Change a single byte of a message in transit and the seal no longer fits, so the receiver is meant to notice, throw the message away, hang up. “Everything checked out. That is the part I can’t get past — everything checked out, and the coins were gone.”
Narrow power, perfect target
Here the library did the hard half correctly — it recomputed the seal, saw it did not fit — and then read broken as fine and ran the tampered message anyway: Seal failed; command ran. The attacker is granted the machine’s own voice: without reading a byte of traffic, they can rewrite a single message into almost any command they choose. The only catch (and it is the whole game) is that they must already know what the machine was going to say.
The attacker doesn’t control the machine. The traffic is still encrypted, so they can’t read the session. Take the seal off and you don’t get a broken cipher, you get a lesser one, still unreadable, simply no longer tamper-proof. Their power is narrow, and exact: replace one message whose contents they already know with another.
An automated job sends the same command at the same time every night, identical to the byte; learn it once (from a manual, a published recipe, one earlier look at the host) and rewrite it quietly, every night after. Read on →