Date: Wed, 02 Dec 2009 08:25:08 -0500 From: Mike Tancsa <mike@sentex.net> To: Mohd Fazli Azran <mfazliazran@gmail.com> Cc: freebsd-security@freebsd.org Subject: Re: Increase in SSH attacks as of announcement of rtld bug Message-ID: <200912021324.nB2DOc58001138@lava.sentex.ca> In-Reply-To: <4B1662BB.8000908@gmail.com> References: <200912010120.nB11Kjm9087476@freefall.freebsd.org> <200912010522.WAA03022@lariat.net> <200912011724.KAA10851@lariat.net> <200912011909.nB1J9JRM070879@lava.sentex.ca> <200912020145.SAA17523@lariat.net> <200912020150.nB21ossm072930@lava.sentex.ca> <4B1662BB.8000908@gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
At 07:51 AM 12/2/2009, Mohd Fazli Azran wrote: > > >Seem they use multi host and brute force. My network are every day >increasing the activity of attempt ssh login with multiple host + >multiple login with multiple password. seem i got many of this messages > Yes, thats the latest pattern I have been seeing-- distributed, slow and coordinated. Here is a sample from one of my honeypots. The only way to deal with them I found is to have multiple sensors throughout my network and aggregate the data. Otherwise, each IP only appears every few hrs in the logs. In the snippet below, 195.135.140.107 hit the one box 5hrs later, but I had a dozen hits total in that short period elsewhere in my network Nov 24 05:19:09 server sshd[99051]: Invalid user daily from 195.135.140.107 Nov 24 05:21:43 server sshd[19081]: Invalid user daily from 78.36.196.2 Nov 24 05:23:40 server sshd[33746]: Invalid user daily from 62.123.229.20 Nov 24 05:31:18 server sshd[88003]: Invalid user neomail from 212.57.104.168 Nov 24 05:33:26 server sshd[11552]: Invalid user packages from 217.70.139.42 Nov 24 05:41:54 server sshd[2430]: Invalid user packages from 94.82.179.33 Nov 24 05:46:39 server sshd[30961]: Invalid user raqbackup from 99.63.133.121 Nov 24 05:51:27 server sshd[53631]: Invalid user raqbackup from 58.68.30.14 Nov 24 05:54:11 server sshd[72915]: Invalid user spool from 193.85.165.141 Nov 24 05:56:39 server sshd[93869]: Invalid user spool from 88.79.68.190 Nov 24 06:05:33 server sshd[53698]: Invalid user support from 91.144.140.84 Nov 24 06:09:12 server sshd[99870]: Invalid user techsupport from 190.96.169.145 Nov 24 06:12:41 server sshd[14339]: Invalid user techsupport from 221.6.14.108 Nov 24 06:14:53 server sshd[25984]: Invalid user techsupport from 89.97.228.190 Nov 24 06:16:37 server sshd[35437]: Invalid user techsupport from 62.23.130.173 Nov 24 06:20:04 server sshd[45740]: Invalid user customer from 221.148.90.73 Nov 24 06:30:24 server sshd[22798]: Invalid user michael from 200.6.208.158 Nov 24 06:32:57 server sshd[50955]: Invalid user michael from 82.212.49.128 Nov 24 06:38:13 server sshd[78472]: Invalid user michael from 80.32.236.113 Nov 24 14:15:58 server sshd[53503]: Invalid user folder from 194.78.138.227 Nov 24 14:18:29 server sshd[71545]: Invalid user rpcuser from 116.55.226.131 Nov 24 14:21:12 server sshd[99996]: Invalid user rpcuser from 190.67.23.122 Nov 24 14:26:21 server sshd[19058]: Invalid user rpcuser from 212.243.41.9 Nov 24 14:34:11 server sshd[79740]: Invalid user rpcuser from 217.70.139.42 Nov 24 14:19:32 server sshd[35166]: Invalid user rpcuser from 213.140.19.143 Nov 24 14:32:14 server sshd[47004]: Invalid user rpcuser from 212.0.127.98 Nov 24 14:34:46 server sshd[55993]: Invalid user rpcuser from 212.0.127.98 Nov 24 14:47:30 server sshd[80927]: Invalid user rpcuser from 95.91.122.220 Nov 24 14:50:02 server sshd[99146]: Invalid user rpcuser from 213.140.19.143 Nov 24 14:52:42 server sshd[17685]: Invalid user rpcuser from 218.69.27.138 Nov 24 15:01:39 server sshd[78630]: Invalid user rpcuser from 90.182.107.194 Nov 24 15:03:15 server sshd[94459]: Invalid user rpcuser from 212.0.127.98 Nov 24 15:06:56 server sshd[25865]: Invalid user security from 85.126.145.125 Nov 24 15:08:18 server sshd[39544]: Invalid user security from 58.68.30.14 Nov 24 15:12:18 server sshd[59293]: Invalid user security from 217.220.124.90 >Did not receive identification from X.X.X.X > >Mohd Fazli Azran >System Analysis >KL Malaysia > > >-----BEGIN PGP SIGNATURE----- >Version: GnuPG/MacGPG2 v2.0.12 (Darwin) >Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ > >iEYEARECAAYFAksWYrsACgkQNF5f3mz2bZm2QwCfTZhxaAu586n66tGoAoX2DzjH >Wd0AmgMQyxsmJ+eoeDEgJOdXMk2SxiaB >=Ymfg >-----END PGP SIGNATURE----- -------------------------------------------------------------------- Mike Tancsa, tel +1 519 651 3400 Sentex Communications, mike@sentex.net Providing Internet since 1994 www.sentex.net Cambridge, Ontario Canada www.sentex.net/mike
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200912021324.nB2DOc58001138>