full-disclosure - Re: SSH scans, i caught one

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4CE7D408.8040002@rbsec.net>
Date: Sat, 20 Nov 2010 13:58:32 +0000
From: Robin <robin@...ec.net>
To: Marco van Berkum <marco@...t.nl>, full-disclosure@...ts.grok.org.uk
Subject: Re: SSH scans, i caught one

MIPS is very common in routers - most home ones I've seen are MIPS. As
for purpose, it's a good place to DDoS from, because it's very hard to
detect. It's also a very nice place to sniff passwords from, as you get
a whole network's traffic passing through, and it's extremely hard to
detect.

~Robin
> On 11/19/2010 09:11 PM, OrderZero wrote:
>   
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA1
>>
>> Looks like the syslgd is your average botnet, simply connects to an
>> irc for cnc, from strings...
>>
>> WHO@...CKªH^@c^_Ã¬{JOIN^_:^ONULL^GOÃ¾Ã¿>^f3ÂµT%9:unable to
>> resolveÃ?`Ã;#spoofs:
>>
>> where #spoofs could be the channel, no cleartext server however
>> (other than a conspicuous string "nubnet")..a disassembly of said
>> syslgd is attached...
>>     
> Nice one. I assumed the syslgd was for overwriting syslogd to hide its 
> tracks but it doesn't look like that indeed. Like many people already
> thought, this is starting to look like a mips-router-hacking-irc-botnet.
> Leaves me with two questions. Why MIPS? And whats the purpose. I think 
> DDOS, but who knows...
>
> Grtz,
> Marco van Berkum
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/