Incidents
Weird SSH attack last night and this morning (still ongoing) May 07 2008 12:27PM
Gary Baribault (gary baribault net) (6 replies)
Re: Weird SSH attack last night and this morning (still ongoing) May 14 2008 08:25AM
Mick Pollard (lists lunix com au) (1 replies)
Re: Weird SSH attack last night and this morning (still ongoing) May 14 2008 11:05PM
Gary Baribault (gary baribault net) (1 replies)
Re: Weird SSH attack last night and this morning (still ongoing) May 15 2008 09:41PM
Valdis Kletnieks vt edu
Re: Weird SSH attack last night and this morning (still ongoing) May 07 2008 06:01PM
Brent Kearney (brentk birs ca)
RE: Weird SSH attack last night and this morning (still ongoing) May 07 2008 05:53PM
Erin Carroll (amoeba amoebazone com) (1 replies)
Re: Weird SSH attack last night and this morning (still ongoing) May 07 2008 06:17PM
Valdis Kletnieks vt edu
On Wed, 07 May 2008 10:53:35 PDT, Erin Carroll said:

> When I saw this hitting my servers last night I thought it an odd attack
> pattern but surmised it was either a targeted slow attack with spoofed IP's

Unless your operating system is *very* broken and doesn't do RFC1948 randomization
of the TCP Initial Sequence Number, using a spoofed ID just gets you a bunch
of sockets stuck in half-open state (SYN received, SYN/ACK send to the spoofed
source, no ACK back). If it's gotten through the 3-packet handshake, you may
as well assume that it's a real IP address (or the attacker has already pwned
enough infrastructure that they can see the SYN/ACK you send, in which case
they control the horizontal and vertical and you're now in an Outer Limits
episode... ;)

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Exmh version 2.5 07/13/2001

iD8DBQFIIfIvcC3lWbTT17ARAiGIAJ9T8+/TLla7X45kCKafVcbY5hZm7wCbBdHR
IQscNCH4I92ZGW76pa7ioUU=
=VGJV
-----END PGP SIGNATURE-----

[ reply ]
Re: Weird SSH attack last night and this morning (still ongoing) May 07 2008 05:36PM
Blaine Fleming (groups digital-z com)
Re: Weird SSH attack last night and this morning (still ongoing) May 07 2008 05:04PM
Robert Taylor (rjamestaylor gmail com) (1 replies)
RE: Weird SSH attack last night and this morning (still ongoing) May 07 2008 06:15PM
Erin Carroll (amoeba amoebazone com) (1 replies)
Re: Weird SSH attack last night and this morning (still ongoing) May 07 2008 06:23PM
Robert Taylor (rjamestaylor gmail com) (1 replies)
RE: Weird SSH attack last night and this morning (still ongoing) May 07 2008 06:27PM
Erin Carroll (amoeba amoebazone com)


 

Privacy Statement
Copyright 2010, SecurityFocus