RE: SSH attacks?

["M Shirk" <shirkdog_linux () hotmail com>]

There are couple things that come to mind about this activity:

1. This is incredibly noisy and sloppy. http://isc.incidents.org has already 
posted an analysis of a root comprised box in which it appeared to be 
someone with not alot of skill due to typos and the commands used to install 
the rootkit. Also, the only reason it was exploited was because someone had 
a BLANK ROOT PASSWORD (grins).

2. Do these attackers even know that this activity has been discovered, and 
that admins are on the alert? This ssh activity has been discussed for a 
number of days now. If they are really l33t, they will also be reading this 
very mailing list. (however, the evidence presented here and at the ISC 
points to the fact that they are more then likely script kiddies)

3. Just as one of the postings here said, the admin was upset they did not 
try to logon as root. I can not ever remember having a default guest or test 
account on a unix system. It would be interesting if these attacks were 
profiled against a single compromised host, and that profile used as an 
attack signature for everyone else on the Internet.

If possible, change your SSHD port as discussed in which you will avoid any 
of these types of scans.

Shirkdog
http://www.shirkdog.us

-----Original Message-----
From: jyri.hovila () iki fi [mailto:jyri.hovila () iki fi]
Sent: Wednesday, July 28, 2004 2:43 PM
To: incidents () securityfocus com
Subject: Re: SSH attacks?
Importance: Low


Hi!

I collect logs from a bunch of OpenBSD hosts. Below is what I found
(sorry about the messy format).

Most of the hosts doing the scans seem to be running sshd. I'm afraid
this could mean there is a new SSH exploit out in the wild. I think
admins would do wisely restricting SSH logins to known IP addresses (or
subnets) when possible.

- Jyri

_________________________________________________________________
Is your PC infected? Get a FREE online computer virus scan from McAfee® 
Security. http://clinic.mcafee.com/clinic/ibuy/campaign.asp?cid=3963