Re: [gentoo-security] new ssh worm?

[Mark Guertin]

Yep I've seen the same thing on my machines here over the last 2-3 days 
or so, on accounts test and guest.

Unfortunately we all don't have the option to turn off interactive 
logins, so hopefully this is not something that will get out of hand :/

Mark

On 27-Jul-04, at 12:30 PM, Greg Watson wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Over the past few days I've noticed many attempts from different
> sources
> trying to login on ssh via guest/test/admin/etc accounts.  Looking
> further into the matter I found SANS is looking for information too.
>
> http://www.incidents.org/diary.php?date=2004-07-23
> http://www.incidents.org/diary.php?date=2004-07-25
>
> and more information here:
> http://www.dslreports.com/forum/remark,10854834~mode=flat~days=9999
>
> It appears as the net is getting hit with these all over.  I would
> guess
> this is a very early stage of some kind of new worm/exploit in the
> works.  What is more, it appears to have the ability to pass some NAT
> boxes by tricking them into replying back to the source.
>
> If you're not already doing so, I recommend to disable password
> interactive login and enforce key only logins.  This will prevent some
> of the ssh exploits, brute-force attacks, and general script kiddies.
>
> And as always, upgrade to the latest version of OpenSSH/OpenSSL.
> - --
> Greg Watson
> http://www.linuxlogin.com
> GnuPG Key: http://www.linuxlogin.com/gpg_key.pub
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.2.4 (GNU/Linux)
> Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org
>
> iD8DBQFBBoMk0stmTYtmfxsRAgEtAJ4xX4NUhVY1TrQ2sLVw2VOH3/02KACgiOak
> 7fJRiR57F4RbRZQflDbIVqs=
> =r4zY
> -----END PGP SIGNATURE-----
>
> --
> gentoo-security@g.o mailing list
>
>


--
gentoo-security@g.o mailing list