Access member only content, take part in discussions with comments on blogs, news and reviews and receive all the latest security industry news directly to your inbox. Join now for free.
Processing registration... Please wait.
This process can take up to a minute to complete.
A confirmation email has been sent to your email address - SUPPLIED EMAIL HERE. Please click on the link in the email to verify your email address. You need to verify your email before you can start posting.
If you do not receive your confirmation email within the next few minutes, it may be because the email has been captured by a junk mail filter. Please ensure you add the domain @scmagazine.com.au to your white-listed senders.
The number of “lame” brute force Secure Shell (SSH) attacks are in decline as honeypots over the weekend detected fewer attempts against them.
SANS Institute analyst Tom Liston noticed the strange activity when a string of IP addresses tried to access his SSH box with the username 'root' and password 'ihatehackers'.
The attacks are typically slow between bouts.
The strange attacks were similarly detected by Norwegian system administrator Peter Hansteen in 2008. The traffic was composed of Linux machines compromised by the dt_ssh5_malware bug and joined together in what he dubbed a “Hail Mary Cloud”.
In 2009, Hansteen received 6000 attack attempts from 770 IP addresses over four days.
More recently, his machines received 4773 failed intrusion attempts using 944 usernames from 338 separate addresses at the time.
But known brute force attacks of the same style over the last three years had been sent from thousands of IP addresses, indicating the number of infected machines in the cloud may be dwindling, Hansteen said.
Hansteen published a list of offending IP addresses and urged administrators to check and compare their traffic logs.
Liston publishes attacks against his honepot under the Twitter account @netmenaces and will soon update the feed to include the SSH attacks.
Copyright © SC Magazine, Australia
To begin commenting right away, you can log in below or register an account if you don't yet have one. Please read our guidelines on commenting. Offending posts will be removed and your access may be suspended. Abusive or obscene language will not be tolerated. The comments below do not necessarily reflect the views or opinions of SC Magazine, Haymarket Media or its employees.