# Can malware travel back to my computer over an SSH session?

Not by itself: an ordinary SSH session carries your keystrokes and the server's screen output, and a compromised server cannot push a program onto your computer through it. The risks come from the features you add. Agent forwarding lets the server use your SSH keys while you are connected, so a compromised server can reach other servers as you; use it only towards trusted hosts, or use a jump-host setting instead. Port forwarding and X11 forwarding open channels back to your machine. Files you copy from the server can carry malware like any download. And a vulnerable SSH client can in principle be attacked by a malicious server, so keep the client updated. On the network, a session from an admin laptop to a server is normal; NetSenX flags unusual sessions between hosts as lateral movement, on every plan, so an SSH session that starts hopping onwards from a server stands out.

FAQ: [Remote work and exposed services](https://netsenx.com/en/faq/remote) · https://netsenx.com/en/faq/can-malware-travel-back-over-an-ssh-session

## Read next

- https://netsenx.com/en/is-someone-inside-your-network
- https://netsenx.com/en/encrypted-traffic-analysis

## Related questions

- [How can SSH tunnels bypass a firewall?](https://netsenx.com/en/faq/how-can-ssh-tunnels-bypass-a-firewall)
- [Is it safe to use SSH over public Wi-Fi?](https://netsenx.com/en/faq/is-ssh-over-public-wifi-safe)
- [How dangerous is port forwarding to a server in the office?](https://netsenx.com/en/faq/how-dangerous-is-port-forwarding-for-an-office-server)
- [How do I check what our company exposes to the internet?](https://netsenx.com/en/faq/how-to-check-what-our-company-exposes-to-the-internet)
- [Is automatic port opening (UPnP) on the office router a risk?](https://netsenx.com/en/faq/is-upnp-on-the-office-router-a-risk)