1 |
After digging a little more closely in my logs, it really seems like |
2 |
this is some sort of script kiddie/warez scanner kind of deal than |
3 |
anything else. All the IP's showing in my logs are machines that have |
4 |
wide open proxies running (big surprise) ... so I would tend to think |
5 |
that some warez type script kiddie decided it would be cool to include |
6 |
ssh scanning as part of their scripts (fishing for open hosts)... |
7 |
|
8 |
Since every single IP it came from is an open proxy and the fact that |
9 |
it's trying to get into accounts that don't exist on any of my machines |
10 |
(and most other *nix boxen out there) it really fits the description of |
11 |
warez phishing types to a 'T' . . . unless of course it is a |
12 |
worm/trojan that also installs an proxy on affected hosts. |
13 |
|
14 |
Mark |
15 |
|
16 |
On 27-Jul-04, at 12:30 PM, Greg Watson wrote: |
17 |
|
18 |
> -----BEGIN PGP SIGNED MESSAGE----- |
19 |
> Hash: SHA1 |
20 |
> |
21 |
> Over the past few days I've noticed many attempts from different |
22 |
> sources |
23 |
> trying to login on ssh via guest/test/admin/etc accounts. Looking |
24 |
> further into the matter I found SANS is looking for information too. |
25 |
> |
26 |
> http://www.incidents.org/diary.php?date=2004-07-23 |
27 |
> http://www.incidents.org/diary.php?date=2004-07-25 |
28 |
> |
29 |
> and more information here: |
30 |
> http://www.dslreports.com/forum/remark,10854834~mode=flat~days=9999 |
31 |
> |
32 |
> It appears as the net is getting hit with these all over. I would |
33 |
> guess |
34 |
> this is a very early stage of some kind of new worm/exploit in the |
35 |
> works. What is more, it appears to have the ability to pass some NAT |
36 |
> boxes by tricking them into replying back to the source. |
37 |
> |
38 |
> If you're not already doing so, I recommend to disable password |
39 |
> interactive login and enforce key only logins. This will prevent some |
40 |
> of the ssh exploits, brute-force attacks, and general script kiddies. |
41 |
> |
42 |
> And as always, upgrade to the latest version of OpenSSH/OpenSSL. |
43 |
> - -- |
44 |
> Greg Watson |
45 |
> http://www.linuxlogin.com |
46 |
> GnuPG Key: http://www.linuxlogin.com/gpg_key.pub |
47 |
> -----BEGIN PGP SIGNATURE----- |
48 |
> Version: GnuPG v1.2.4 (GNU/Linux) |
49 |
> Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org |
50 |
> |
51 |
> iD8DBQFBBoMk0stmTYtmfxsRAgEtAJ4xX4NUhVY1TrQ2sLVw2VOH3/02KACgiOak |
52 |
> 7fJRiR57F4RbRZQflDbIVqs= |
53 |
> =r4zY |
54 |
> -----END PGP SIGNATURE----- |
55 |
> |
56 |
> -- |
57 |
> gentoo-security@g.o mailing list |
58 |
> |
59 |
> |
60 |
|
61 |
|
62 |
|
63 |
|
64 |
-- |
65 |
gentoo-security@g.o mailing list |