I wanted to follow up on this after putting a little more thought into it. Honestly, I'm quite impressed by the intelligence the botnet is exhibiting. Based on the testing I've done, it's clear that the entire botnet is collectively sharing its position in the dictionary on a per-target basis. Fairly slick, IMO.

> -----Original Message-----
> From: Gary Baribault [mailto:gary (at) baribault (dot) net [email concealed]]
> Sent: Monday, May 12, 2008 11:28 AM
> To: incidents (at) securityfocus (dot) com [email concealed]
> Subject: Distributed Bruteforce against SSH
>
>
> I guess what I reported last week was the warmup round ..
> Where now getting thousands of attemped logins with the
> standars dictionary of potential login names.
>

[ reply ]