Full Disclosure mailing list archives
Re: Re: Automated SSH login attempts?
From: Stefan Janecek <stefan.janecek () jku at>
Date: Fri, 30 Jul 2004 11:38:53 +0200
On Thu, 2004-07-29 at 19:52, dmargoli () stwing org wrote:
Stefan Janecek wrote:This does not seem to be a stupid brute force attack, as there is only one login attempt per user. Could it be that the tool tries to exploit some vulnerability in the sshd, and just tries to look harmless by using 'test' and 'guest' as usernames? The compromised machine was running an old debian woody installation which had not been upgraded for at least one year, the sshd version string says 'OpenSSH_3.6.1p2 Debian 1:3.6.1p2-10'Does the Debian machine that was compromised have a ``test'' or ``guest'' username?
No.
Also, if it wasn't patched in a year, it may still be vulnerable to this: http://www.cert.org/advisories/CA-2003-24.html
Thanks, I'll have a look at it.
I would tend to think this isn't a 0day kinda vuln, as if it were, he'd be a lot more successful than he seems (unless we're all rooted and don't even know it). But who can tell?
Yes, agreed - I am also convinced it must be something old, and shouldn't be dangerous for reasonably administered machines. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Re: Re: Automated SSH login attempts?, (continued)
- Re: Re: Automated SSH login attempts? Jan Muenther (Jul 30)
- Re: Re: Automated SSH login attempts? Andrei Galca-Vasiliu (Jul 29)
- Re: Re: Automated SSH login attempts? Max Valdez (Jul 29)
- Re: Re: Automated SSH login attempts? dmargoli (Jul 29)
- Re: Re: Automated SSH login attempts? Ron DuFresne (Jul 29)
- Re: Re: Automated SSH login attempts? joe smith (Jul 29)
- Re: Re: Automated SSH login attempts? Andrei Galca-Vasiliu (Jul 29)
- Re: Re: Automated SSH login attempts? Max Valdez (Jul 29)
- Re: Re: Automated SSH login attempts? Dagur Valberg Johannsson (Jul 29)
- Re: Re: Automated SSH login attempts? dmargoli (Jul 29)
- Re: Re: Automated SSH login attempts? Stefan Janecek (Jul 30)
- Re: Re: Automated SSH login attempts? andrewg (Jul 30)
- Re: Re: Automated SSH login attempts? nicolas vigier (Jul 30)
- Re: Re: Automated SSH login attempts? morning_wood (Jul 30)
- Re: Automated SSH login attempts? Dan Margolis (Jul 30)