From owner-freebsd-security@FreeBSD.ORG  Wed Dec  2 01:45:16 2009
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 264161065679
	for <freebsd-security@freebsd.org>;
	Wed,  2 Dec 2009 01:45:16 +0000 (UTC)
	(envelope-from brett@lariat.org)
Received: from lariat.net (lariat.net [66.119.58.2])
	by mx1.freebsd.org (Postfix) with ESMTP id 9CD698FC1F
	for <freebsd-security@freebsd.org>;
	Wed,  2 Dec 2009 01:45:15 +0000 (UTC)
Received: from anne-o1dpaayth1.lariat.org (IDENT:ppp1000.lariat.net@lariat.net
	[66.119.58.2]) by lariat.net (8.9.3/8.9.3) with ESMTP id SAA17523;
	Tue, 1 Dec 2009 18:45:06 -0700 (MST)
Message-Id: <200912020145.SAA17523@lariat.net>
X-Mailer: QUALCOMM Windows Eudora Version 7.1.0.9
Date: Tue, 01 Dec 2009 18:44:31 -0700
To: Mike Tancsa <mike@sentex.net>, freebsd-security@freebsd.org
From: Brett Glass <brett@lariat.org>
In-Reply-To: <200912011909.nB1J9JRM070879@lava.sentex.ca>
References: <200912010120.nB11Kjm9087476@freefall.freebsd.org>
	<200912010522.WAA03022@lariat.net>
	<200912011724.KAA10851@lariat.net>
	<200912011909.nB1J9JRM070879@lava.sentex.ca>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"; format=flowed
Cc: 
Subject: Re: Increase in SSH attacks as of announcement of rtld bug
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: "Security issues \[members-only posting\]"
	<freebsd-security.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>, 
	<mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>, 
	<mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 02 Dec 2009 01:45:16 -0000

At 12:09 PM 12/1/2009, Mike Tancsa wrote:

>http://isc.sans.org/trends.html
>and
>http://isc.sans.org/port.html
>
>Do not seem to show any increase.

Do those stats account for the fact that the attackers may first be 
fingerprinting servers to see if they're running FreeBSD?

--Brett