Incidents
Weird SSH attack last night and this morning (still ongoing) May 07 2008 12:27PM
Gary Baribault (gary baribault net) (6 replies)
Re: Weird SSH attack last night and this morning (still ongoing) May 14 2008 08:25AM
Mick Pollard (lists lunix com au) (1 replies)
Re: Weird SSH attack last night and this morning (still ongoing) May 14 2008 11:05PM
Gary Baribault (gary baribault net) (1 replies)
I doubt it, that's a man in the middle attack if I understood, this is a
kind of distributed brute force and as I said in a more recent post,
they are no longer only trying Root, but are using a list of alphabetic
logins so it has evolved.

Gary B

Mick Pollard wrote:
> On Wed, 07 May 2008 08:27:15 -0400
> Gary Baribault <gary (at) baribault (dot) net [email concealed]> wrote:
>
> > I don't know what is going on last night and this morning ... I have
> > three Linux servers facing the Internet, two on cable modems and another
> > on a static IP/commercial connection and this last one is a gateway to a
> > Web/FTP/SMTP/Pop3/NTP Linux based system.
> >
>
> > Of the three machines, one of them only had about 10 attempts, but the
> > other two had about 200 attempts .. all of them with only 1 try with the
> > user Root ..
> >
> > Is any one else seing this? or am I being targeted? This is still going
> > on now .. and it started arround 10:00 last night GMT+4
> These aren't related to the recent openssh advisory for debian based
> distros ? [USN-612-2] OpenSSH vulnerability
> A bot looking for debian based servers with weak ssh keys ?
> Just a thought.
>
> -
> Regards
> Mick Pollard ( lunix )
> ------------------------------------------------
> BOFH Excuse of the day:
> Extraneous Parity Interrupt
>
>

[ reply ]
Re: Weird SSH attack last night and this morning (still ongoing) May 15 2008 09:41PM
Valdis Kletnieks vt edu
Re: Weird SSH attack last night and this morning (still ongoing) May 07 2008 06:01PM
Brent Kearney (brentk birs ca)
RE: Weird SSH attack last night and this morning (still ongoing) May 07 2008 05:53PM
Erin Carroll (amoeba amoebazone com) (1 replies)
Re: Weird SSH attack last night and this morning (still ongoing) May 07 2008 06:17PM
Valdis Kletnieks vt edu
Re: Weird SSH attack last night and this morning (still ongoing) May 07 2008 05:36PM
Blaine Fleming (groups digital-z com)
Re: Weird SSH attack last night and this morning (still ongoing) May 07 2008 05:04PM
Robert Taylor (rjamestaylor gmail com) (1 replies)
RE: Weird SSH attack last night and this morning (still ongoing) May 07 2008 06:15PM
Erin Carroll (amoeba amoebazone com) (1 replies)
Re: Weird SSH attack last night and this morning (still ongoing) May 07 2008 06:23PM
Robert Taylor (rjamestaylor gmail com) (1 replies)
RE: Weird SSH attack last night and this morning (still ongoing) May 07 2008 06:27PM
Erin Carroll (amoeba amoebazone com)


 

Privacy Statement
Copyright 2010, SecurityFocus