H is for HASSH — The Fingerprint the Tool Cannot Change

The Alphabet of Harm, letter H. A modality-bridge dossier: one entry in the OSINT archive, carried forward to what our own systems catch today, closed with a verdict — ENDED, CONTINUES, or MUTATED.

Verdict: CONTINUES — but legible.

The One Letter Where Our Systems Are the Star

Most of this alphabet is about harm that escapes. Greece's surveillers were never caught. Covert collection metastasized past anyone's ability to stop it. The archive holds the record, and our sensors, honestly, mostly hold the record too — we are the memory, not the net.

Letter H is the exception. This is the entry where the LSN sensor mesh is not the archivist but the instrument. The harm is as old and as daily as anything in this series — mass automated SSH intrusion, credential brute-forcing at industrial scale — and its defining trick is disposability: the attacker rotates through thousands of source IP addresses so that no single one is worth blocking. Block an IP, another takes its place in the same second. Measured by address, the attack is unbounded.

And then you fingerprint it, and it collapses. On live LSN honeypot data, 145,834 hostile SSH connections carry just 116 unique tool-signatures. The flood that feels infinite in IP-space is, in tool-space, a small and countable set. This letter is about the one message the attacker's software is forced to send in the clear — and how that forcing turns an anonymous deluge into a legible, attributable handful of tools.

The archive supplied the mechanism, decades before anyone thought to weaponize it defensively. It is sitting, unremarkable, in a 2006 RFC.

1. What the Archive Holds — A Handshake That Became an Identifier

Every SSH connection begins, before a single byte is encrypted, with a negotiation. RFC 4253 — "The Secure Shell (SSH) Transport Layer Protocol," 2006 — mandates it. The moment a client connects, it sends an SSH_MSG_KEXINIT message: an ordered list of every algorithm it is willing to use — the key-exchange methods, the host-key algorithms, the symmetric ciphers, the MAC algorithms, the compression methods. The server sends its own. They find the intersection, and the secure channel is built on top.

Here is the accident. The RFC fixes the mechanism — you must send this list — but it does not fix the ordering. Each SSH implementation offers its algorithms in a distinctive, hardcoded sequence: OpenSSH in one order, libssh in another, Go's crypto/ssh in a third, Paramiko in a fourth. The order is a property of the software, baked in at compile time, identical on every connection that software ever makes.

The 2006 standards authors were solving a compatibility problem: let any client and any server agree on cryptography without prior arrangement. They were not building an identifier. But determinism plus per-implementation variation is an identifier. The protocol that was designed to let SSH clients be interoperable made them, as a side effect, individually recognizable — and it did so in the one exchange that happens before encryption, in the clear, where any observer can read it.

Method note. The archive anchor here is the protocol standard itself — RFC 4253 — which is authoritative and unambiguous about the mandated SSH_MSG_KEXINIT handshake. The fingerprinting technique built on top of it (HASSH) is a later, separate contribution; the RFC does not mention fingerprinting. We keep the standard and the technique as distinct layers, exactly as with the ETSI standards and lawful-intercept abuse in letter G.

2. HASSH — Hashing the Mandated Handshake

In 2018, Salesforce open-sourced HASSH: an MD5 hash of the client's SSH_MSG_KEXINIT algorithm lists — the ordered key-exchange, encryption, MAC, and compression fields, concatenated and hashed. That is the whole idea. It fingerprints the software, by hashing the one thing RFC 4253 forces the software to announce.

The property that matters is stability. A given SSH client library produces the same HASSH on every connection it ever makes — regardless of source IP, regardless of the username it tries, regardless of the target it attacks. The HASSH follows the tool, not the address.

For a defender buried under disposable source IPs, this is the whole game. The attacker's core evasion — burn a new IP constantly so nothing is worth blocking — assumes the defender is counting IPs. HASSH doesn't count IPs. It counts tools. And the attacker cannot cheaply change his tool's HASSH: to alter it he must alter the algorithm list his SSH library offers, which means patching and recompiling the library itself, for every node, continuously. The IP is free to rotate. The handshake is expensive to change. That asymmetry is the defender's leverage.

3. The Bridge — 145,834 Connections, 116 Tools

Now the present. The LSN honeypot exists to be attacked, and it fingerprints every SSH client that touches it. The current tally:

Read the first two rows against each other. A five-figure volume of hostile connections, sprayed across thousands of source addresses, reduces to 116 actual pieces of software. The compression ratio is the finding. The IP cloud — the thing that makes SSH brute-forcing feel like an unstoppable natural phenomenon — is noise. The HASSH is signal, and there is remarkably little of it.

This is the modality-bridge in its cleanest form. The archive (RFC 4253) mandated a handshake. The technique (HASSH) turned the handshake into a tool-identifier. And our present-day sensor mesh uses the identifier to strip the disguise off the daily flood, live, right now — turning an unbounded IP problem into a bounded, countable tool problem.

The Anatomy of a Signature

It is worth seeing exactly what gets hashed, because the precision is the point. When an SSH client sends its SSH_MSG_KEXINIT, four of the ordered lists inside it are what HASSH captures, concatenated in a fixed layout:

• Key-exchange algorithms — e.g. curve25519-sha256, ecdh-sha2-nistp256, diffie-hellman-group14-sha256, in the client's preferred order.
• Encryption ciphers — e.g. chacha20-poly1305@openssh.com, aes128-ctr, aes256-gcm@openssh.com.
• MAC algorithms — e.g. hmac-sha2-256-etm@openssh.com, umac-64-etm@openssh.com.
• Compression methods — e.g. none, zlib@openssh.com.

Those four lists are joined with delimiters and reduced to a single MD5 digest — the HASSH. Two clients built on the same library, at the same version, compiled with the same options, will produce byte-identical lists and therefore an identical hash. Change the library, or its version, or the build flags, and the ordering shifts and the hash changes. That is why the honeypot can read libssh_0.9.6, libssh_0.11.x, and libssh_0.12.0 as three distinct signatures: they are three versions of the same library, and each announces its own generation in the handshake.

The consequence for an attacker is quietly brutal. To evade the fingerprint he must make his tool lie convincingly about which algorithms it supports and in which order — and then actually honour that lie through the rest of the negotiation, because a mismatch between the advertised list and the algorithms he can really speak breaks the connection. Forging a believable HASSH is not a flag you flip; it is a re-engineering of the client's crypto stack, per node, maintained across every library update. Against a defender who only needs to read a hash, that is an absurd cost. So the attacker doesn't pay it, and the signature holds.

4. The Clusters — One Tool Wearing a Thousand Faces

Zoom into the 116 signatures and the coordination becomes undeniable. The largest HASSH clusters, counted by distinct source IP:

The top line says it all: one tool, libssh_0.11.x, appearing from 1,341 separate IP addresses. That is not 1,341 attackers. It is one piece of software, operated across 1,341 disposable addresses, every one of them announcing the identical handshake. The IP-rotation evasion is total — and completely defeated, because the thing being rotated (the address) is not the thing being measured (the tool).

The host keys close the loop. A single ssh-rsa key with fingerprint d4:98:c4:f3:12:ef:3e:29… was offered from 17 different source IPs. A private key is a secret; reusing one across seventeen "different" attackers proves they are one operator who could not be bothered to generate seventeen keys. The fingerprint doesn't just cluster by tool — it hard-links infrastructure by shared secret. The anonymity the IP rotation was supposed to buy is gone twice over.

5. The Mutation the Fingerprints Reveal

There is a second finding hiding in the distribution of those signatures, and it is a genuine mutation.

Look at what generates the heaviest traffic. It is not OpenSSH — not a human at a terminal typing ssh. By connection volume, the top clients are:

These are not clients you use. They are libraries you embed — libssh, Go's crypto/ssh, libssh2, AsyncSSH, Paramiko — the SSH stacks you call from inside a scanner or a botnet worker, in a loop, a thousand times a second. The interactive remote-login SSH that RFC 4253 was written to standardize — a person, logging into a machine — has, on the hostile side of the wire, mutated into a subroutine.

That is the letter's mutation, and HASSH makes it watchable. Because the library must send the mandated handshake exactly like a human's client does, the industrialization is not hidden — it is written directly into the fingerprint distribution. A defender can literally watch the attack economy retool over time by watching which HASSH clusters swell: the rise of Go-based scanners, the shift from libssh_0.9.6 to 0.11.x to 0.12.0 as operators upgrade their libraries. The archive's SSH became a library in a loop, and the loop cannot stop announcing itself.

6. The Same Principle That Pierces the HTTP-200 Mask

Step back and HASSH stops looking like an SSH curiosity and starts looking like a principle.

The evasion HASSH defeats — disposable source IPs — is structurally identical to the evasion the LSN web-threats pipeline was rebuilt to defeat at the HTTP layer. There, the disguise is the uniform HTTP 200: every request, benign or malicious, returns the same status code, so intent is masked until you read the request method- and host-aware and see what was actually being attempted. The disposable thing (a request that looks like every other request) is beaten by an invariant the attacker cannot cheaply fake (what the request actually does, to which host, with which method).

HASSH is the SSH-layer instance of the exact same move:

• Attacker's disposable thing: the source IP (rotate freely, costs nothing).
• Protocol-forced invariant: the SSH_MSG_KEXINIT handshake (fixed per tool, expensive to change).
• Defensive act: cluster on the invariant, and the disposability collapses.

This is the LSN thesis stated in general form: wherever a protocol forces an invariant into the clear, that invariant is a defensive handle that attacker disposability cannot erase. SSH forces the algorithm handshake. HTTP forces the method and the Host header. TLS forces the ClientHello (that is JA3, HASSH's sibling). Every one of them is the same trick — find the persistent thing behind the disposable one — applied at a different layer. Letter H is the cleanest, most quantified example of it, because SSH's handshake is mandatory, in the clear, and our honeypot has 145,834 samples of it.

The sibling techniques make the generality concrete. JA3 and its successor JA4 hash the TLS ClientHello the same way HASSH hashes the SSH KEXINIT; JARM actively probes a server to fingerprint its TLS stack. Each lives at a different layer, each exploits the same structural fact: a protocol that demands a capability announcement in the clear has handed the defender a stable identifier for free. The attacker's disposable IPs, disposable domains, and disposable request paths all rotate above a small number of non-disposable tools, and every one of those tools is legally obligated by the protocol it speaks to keep saying its own name. Letter H is simply the layer where that obligation is loudest and our sample count is highest.

From Fingerprint to Firewall

A signature that only sits in a database is trivia. What makes letter H a live defensive fact rather than a clever observation is that the fingerprint feeds action. Once the honeypot has resolved the daily flood into a countable set of tools, three things follow that raw IP-blocking could never deliver.

Durable clustering. A newly-seen IP that has never touched our sensors before is not unknown the moment it completes a handshake — its HASSH places it instantly into an existing campaign. The 1,342nd IP of the libssh_0.11.x cluster inherits everything we already know about the first 1,341, before it has tried a single password. Reputation attaches to the tool and transfers to the address on contact, instead of every fresh IP starting from zero.

Shared-secret escalation. When a HASSH cluster is cross-checked against offered host keys and a reused private key turns up — as with the ssh-rsa key seen across 17 addresses — the link hardens from "same software" to "same operator." That is the difference between a statistical grouping and an attribution, and it is the moment a cluster becomes a named adversary worth its own campaign record.

Retooling as an early warning. Because the fingerprint distribution moves as operators upgrade, a swelling HASSH cluster is a leading indicator. The migration from libssh_0.9.6 toward 0.11.x and 0.12.0, or a sudden bloom of Go-based scanners, is the attack economy re-equipping in public view. A defender watching the fingerprints sees the next wave's toolkit before the wave itself is fully underway — the opposite of the surprise the IP-rotation evasion was meant to guarantee.

None of this requires knowing who is behind the keyboard. It requires only that the protocol keeps forcing the tool to introduce itself, which RFC 4253 has mandated since 2006 and cannot stop mandating without breaking SSH itself. The handshake is not an optional courtesy the attacker can withhold. It is the price of speaking the protocol at all, and the defender collects it on every connection.

7. What Our Systems Actually Hold

Honesty about scope, as in every letter. This one is the strong case, and it still has limits.

What we hold, fully: the fingerprints, the clusters, the host-key links, the mutation-in-progress. Unlike the surveillance letters, this is not borrowed archive — it is our own wire, 145,834 connections deep, and it demonstrably works. The IP-rotation evasion that makes SSH brute-forcing look unattributable is, on our sensors, defeated: we can point at libssh_0.11.x across 1,341 IPs and say "that is one tool," and at a reused RSA key across 17 IPs and say "that is one operator."

What HASSH does not do: it identifies the tool, not the human. Knowing that 1,341 IPs are all libssh_0.11.x tells us they run the same software; it does not, by itself, tell us they are the same actor — popular libraries are used by many independent operators, so a shared HASSH is a weaker link than a shared host key. It can be spoofed by a determined adversary willing to patch his library's algorithm ordering — though almost none do, because the whole point of their operation is cheap scale, and cheap scale means unmodified off-the-shelf libraries. And it says nothing about what happens after login; it fingerprints the knock, not the burglary. We treat HASSH clustering as HIGH confidence for tool identity and MEDIUM for operator identity unless a shared secret (like the reused host key) raises it.

So the LSN role in letter H is real and specific: we are the net, not just the memory. The fingerprint that pierces the disposable-IP mask is running on our honeypot, on live hostile traffic, today — and it is the one place in this alphabet where the harm that continues is also the harm we can see whole.

8. The Verdict — CONTINUES, but Legible

SSH credential brute-forcing at industrial scale does not end. It runs every day on the LSN wire; new HASSH values keep appearing across every recent date in the timeline; the libraries upgrade and the loops keep looping. There is no version of this letter that says ENDED. The harm is permanent, ambient, and global.

But letter H earns a qualifier no other CONTINUES verdict in this alphabet has earned. In the surveillance letters, the harm continues and escapes — the perpetrators vanish into anonymity and the caught column stays empty. Here, the harm continues and is caught in full view. HASSH strips the IP-rotation disguise off the daily flood and renders it as what it actually is: a small, countable, attributable, watchable set of tools, one of them wearing 1,341 faces and fooling no one who reads the handshake.

That is the difference between a harm that is invisible and a harm that is merely relentless. This one is relentless. But it is not invisible — not on our wire, not since a 2006 RFC accidentally minted a fingerprint and a 2018 technique taught us to hash it. The attacker keeps his addresses disposable and loses his tools to the one message the protocol will not let him take back.

Verdict: CONTINUES — but legible. The tool cannot change the fingerprint the standard forces it to send.

The Alphabet of Harm is a modality-bridge series: each letter takes one entry from the OSINT archive — truth as it was recorded at the time — and carries it forward to what the LSN sensor mesh, honeypot, and web-threat telemetry catch today, then closes with a verdict. We include what the record and the vectors show. We do not judge; we let the reader judge. H is for HASSH. Next: I.