Re: [gentoo-security] new ssh worm?

[Mark Guertin]

After digging a little more closely in my logs, it really seems like 
this is some sort of script kiddie/warez scanner kind of deal than 
anything else.  All the IP's showing in my logs are machines that have 
wide open proxies running (big surprise) ... so I would tend to think 
that some warez type script kiddie decided it would be cool to include 
ssh scanning as part of their scripts (fishing for open hosts)...

Since every single IP it came from is an open proxy and the fact that 
it's trying to get into accounts that don't exist on any of my machines 
(and most other *nix boxen out there) it really fits the description of 
warez phishing types to a 'T' . . . unless of course it is a 
worm/trojan that also installs an proxy on affected hosts.

Mark

On 27-Jul-04, at 12:30 PM, Greg Watson wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Over the past few days I've noticed many attempts from different
> sources
> trying to login on ssh via guest/test/admin/etc accounts.  Looking
> further into the matter I found SANS is looking for information too.
>
> http://www.incidents.org/diary.php?date=2004-07-23
> http://www.incidents.org/diary.php?date=2004-07-25
>
> and more information here:
> http://www.dslreports.com/forum/remark,10854834~mode=flat~days=9999
>
> It appears as the net is getting hit with these all over.  I would
> guess
> this is a very early stage of some kind of new worm/exploit in the
> works.  What is more, it appears to have the ability to pass some NAT
> boxes by tricking them into replying back to the source.
>
> If you're not already doing so, I recommend to disable password
> interactive login and enforce key only logins.  This will prevent some
> of the ssh exploits, brute-force attacks, and general script kiddies.
>
> And as always, upgrade to the latest version of OpenSSH/OpenSSL.
> - --
> Greg Watson
> http://www.linuxlogin.com
> GnuPG Key: http://www.linuxlogin.com/gpg_key.pub
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.2.4 (GNU/Linux)
> Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org
>
> iD8DBQFBBoMk0stmTYtmfxsRAgEtAJ4xX4NUhVY1TrQ2sLVw2VOH3/02KACgiOak
> 7fJRiR57F4RbRZQflDbIVqs=
> =r4zY
> -----END PGP SIGNATURE-----
>
> --
> gentoo-security@g.o mailing list
>
>




--
gentoo-security@g.o mailing list