Security Incidents mailing list archives

Re: MASSIVE ssh attack attempt

From: rslau () VELA USC EDU (Robert Lau)
Date: Thu, 17 Feb 2000 18:51:38 -0800


We've contacted the person responsible.  He claims he just ran
make-ssh-known-hosts on our net.  Whether you want to believe this, or
if you think it's benign is up to you but it is a valid alibi.

Robert Lau
Information Services Division - Core Services
University of Southern California

Robert Lau wrote:


Similar scan here.  They're going through our hosts in alphabetical
order.  Contacting linkline.com.  All times PST.

  YYYYMMDD hhmmss
  20000215 193224 ain.usc.edu sshd[6775]: refused connect from
dsl-cvd-ds11047-2.linkline.com
  ....

Current thread:

Re: succesful crack, (continued)
- - Re: succesful crack Gene Harris (Feb 16)
    - Re: succesful crack **read nine (Feb 17)
    - Re: succesful crack R. Gupta (Feb 17)
- Port Scanning (perhaps related to "A very strange port scan") Warren Belfer (Feb 15)
- MASSIVE ssh attack attempt Mark Shirley (Feb 15)
  - Re: MASSIVE ssh attack attempt Omachonu Ogali (Feb 16)
    - Re: MASSIVE ssh attack attempt Jose Nazario (Feb 17)
    - Re: MASSIVE ssh attack attempt Brendan Grieve (Feb 17)
  - Re: MASSIVE ssh attack attempt Robert Lau (Feb 16)
    - Re: MASSIVE ssh attack attempt David A. Bandel (Feb 17)
    - Re: MASSIVE ssh attack attempt Robert Lau (Feb 17)
  - Re: MASSIVE ssh attack attempt Filip M. Gieszczykiewicz (Feb 17)
    - Re: MASSIVE ssh attack attempt Robert Graham (Feb 18)
    - Undernet/telnet attempts? SecOrg (Feb 18)
    - Re: Undernet/telnet attempts? Opus (Feb 21)
    - Re: Undernet/telnet attempts? Jonathan Levy (Feb 21)
    - Re: Undernet/telnet attempts? Tibor, Mike (Feb 22)
    - Re: Undernet/telnet attempts? Brendan Grieve (Feb 22)