full-disclosure - Re: targetted SSH bruteforce attacks

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4C1A3DEE.5070908@baribault.net>
Date: Thu, 17 Jun 2010 11:23:26 -0400
From: Gary Baribault <gary@...ibault.net>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: targetted SSH bruteforce attacks

Looks like what I'm seeing, most source IPs don't repeat, and they are
sharing a dictionary. I have Denyhosts running and since last night
20:38 have only denied about 60 addresses. My denyhost config bans a
host that misses twice!

The attacks are from all around the world, I've seen reverse lookups
from .fr .tw .jp .com .net everything ..

I've attached an excerpt from my /var/log/messages and you can see
that the attacks are not that fast and there is a surprisingly short
list of denied hosts at the end of the file. I could change my
denyhosts to deny IPs after only one fail, but then I risk locking
myself out by accident.

Gary Baribault
Courriel: gary@...ibault.net
GPG Key: 0x685430d1
Signature: 9E4D 1B7C CB9F 9239 11D9 71C3 6C35 C6B7 6854 30D1

On 06/17/2010 10:42 AM, Frank Bures wrote:
> Gary Baribault wrote:
>> I just knew that people would say that, and that's why I specified
>> that I WANT to keep SSH on 22 .. it's fun to see the attacks, and it's
>> interesting to see new types of attacks. The question here is whether
>> anyone else is seeing such a targeted attack.
>
> I've seen an interesting SSH attack in the last couple of days on our /22
> network.  Instead of probing port 22 on many machines in the shortest
> possible time period as usual, this attack seems to be trying to be
> stealthy.  It never attacks more than 4 machines in an hour and never twice
> from the same IP address.  As all attacking addresses are subsequently
> blocked, I wonder how long is it going to take for the guy(s) to run out of
> available addresses at this rate :-)
>
> Cheers
> Frank
>
>
>

Content of type "text/html" skipped

View attachment "denyhosts.log" of type "text/plain" (191382 bytes)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/