Re: [gentoo-security] new ssh worm?

[Chris Ripp]

Check your mail servers' logs too... not sure if its related, but there
were entries (not included) from an attempt at user 'guest'.  The 'asdf'
seems to be new, suppose they're somehow connected? (The ssh attacks
lead to a compromised mail relay?) Or is this just a common attempt at
finding an already open/compromised relay?

>From auth.log

Jul 27 09:27:18 <machine> saslauthd[13176]: do_auth         : auth
failure: [user=asdf] [service=smtp] [realm=] [mech=pam] [reason=PAM auth
error]
Jul 27 09:27:23 <machine> saslauthd[13177]: do_auth         : auth
failure: [user=asdf] [service=smtp] [realm=] [mech=pam] [reason=PAM auth
error]
Jul 27 09:27:28 <machine> saslauthd[13173]: do_auth         : auth
failure: [user=asdf] [service=smtp] [realm=] [mech=pam] [reason=PAM auth
error]
.
.
.
Jul 27 09:28:44 <machine> smtp(pam_unix)[13174]: check pass; user
unknown
Jul 27 09:28:44 <machine> smtp(pam_unix)[13174]: authentication failure;
logname= uid=0 euid=0 tty= ruser= rhost=
Jul 27 09:28:47 <machine> saslauthd[13174]: DEBUG: auth_pam:
pam_authenticate failed: Authentication failure
Jul 27 09:28:47 <machine> saslauthd[13174]: do_auth         : auth
failure: [user=asdf] [service=smtp] [realm=] [mech=pam] [reason=PAM auth
error]
Jul 27 09:28:52 <machine> smtp(pam_unix)[13176]: check pass; user
unknown
.
.
.

The corresponding entries in mail.log:

Jul 27 09:27:23 <machine> postfix/smtpd[7547]: warning:
unknown[222.183.141.122]: SASL LOGIN authentication failed
Jul 27 09:27:28 <machine> postfix/smtpd[7547]: warning:
unknown[222.183.141.122]: SASL LOGIN authentication failed
.
.
.
Jul 27 09:27:30 <machine> postfix/smtpd[7547]: warning: 
unknown[222.183.141.122]: SASL LOGIN authentication failed
Jul 27 09:28:55 <machine> postfix/smtpd[7547]: warning:
unknown[222.183.141.122]: SASL LOGIN authentication failed



>From a whois on the IP: (surprise, surprise)

inetnum:      222.176.0.0 - 222.183.255.255
netname:      CHINANET-CQ
descr:        CHINANET Chongqing  province network
descr:        China Telecom
descr:        A12,Xin-Jie-Kou-Wai Street
descr:        Beijing 100088
country:      CN
admin-c:      CH93-AP
tech-c:       CQ235-AP
mnt-by:       APNIC-HM
mnt-lower:    MAINT-CHINANET-CQ
mnt-routes:   MAINT-CHINANET-CQ
changed:      hm-changed@×××××.net 20040203
remarks:      This object can only be changed by APNIC Hostmaster
status:       ALLOCATED PORTABLE
source:       APNIC

role:         CHINANET CQ
address:      The mainstreet 3 daping ,chongqing data communication
bureau
country:      CN
phone:        [phone]
fax-no:       [phone]
e-mail:       abuse@××××××.cn
trouble:      send spam reports to abuse@××××××.cn
trouble:      and abuse reports to abuse@××××××.cn
admin-c:      ZL235-AP
tech-c:       ZL235-AP
nic-hdl:      CQ235-AP
remarks:      http://www.cta.cq.cn
notify:       abuse@××××××.cn
mnt-by:       MAINT-CHINANET-CQ
changed:      abuse@××××××.cn 20030917
source:       APNIC

person:       Chinanet Hostmaster
address:      No.31 ,jingrong street,beijing
address:      100032
country:      CN
phone:        [phone]
fax-no:       [phone]
e-mail:       hostmaster@××××××××××××××.net
e-mail:       anti-spam@××××××××××××××.net
nic-hdl:      CH93-AP
mnt-by:       MAINT-CHINANET
changed:      hostmaster@××××××××××××××.net 20021016

>From a whois on the IP:
remarks:      hostmaster is not for spam complaint,please send spam
complaint to anti-spam@××××××××××××××.net
source:       APNIC


-- 
===================================
Chris Ripp <chris@××××××××.com>
Ripp Technical Services
Web Design and Hosting
http://ripptech.com/



--
gentoo-security@g.o mailing list