Re: Netscreen 5XT SSH Traffic

[Michael Peppard <mpeppard () impole com>]

Dante Mercurio wrote:

> I can't tell from your email what indications you currently have 
> thatthis came through the firewall and was not spoofed from the inside 
> in some manner. I've always found the Netscreen to be a pretty secure 
> device and this would be a serious flaw. Are there any other methods 
> onto the network such as dial-in, VPN, or vendor connections? Attacks 
> can originate from any of these without a flaw in the firewall software.
>
> M. Dante Mercurio, CISSP, CWNA, Security+, SCSP


Or much more likely, he has a compromised server. SSH traffic in a 
restricted area is the single biggest give-a-way that you've been 
compromised.

-Mike