Thinking Elixir Podcast 251: SSH Vulnerability and Cookies are Changing
Apr 29, 2025
A critical vulnerability in Erlang/OTP's SSH raises alarms about potential risks for Elixir applications. Innovations like Oban Pro's new 'Cascade Mode' feature offer exciting tools for collaborative storytelling. The podcast discusses NERVS device security, stressing timely updates and risk assessment tools. Also highlighted are emerging AI integrations in development, including cost-effective solutions over traditional hiring. The open-sourcing of Semaphore CI sparks interest, alongside advancements in web security techniques, shaping the future of the tech landscape.
AI Snips
Chapters
Books
Transcript
Episode notes
Critical Erlang SSH Vulnerability
- The Erlang OTP SSH server has a critical unauthenticated remote code execution vulnerability rated 10/10 severity.
- Most Phoenix apps are not vulnerable as they do not expose the Erlang SSH daemon by default on the public internet.
Update Vulnerable Nerves Devices
- Nerves devices exposed on public or local networks may be vulnerable due to open SSH ports.
- Update to the patched Nerves system release immediately to protect your devices.
Check Exposure with Nmap and Shodan
- Use Nmap or Shodan to scan your systems and networks to check if they expose vulnerable Erlang SSH services.
- Close exposed ports or patch vulnerable systems as early as possible to reduce risk.
