Re: Bad protocol version identification '^V^C^A'

From: Matt Harris (mdh@unix.si.edu)
Date: 12/02/02

  • Next message: Joe Stewart: "Re: TCP:80, TCP:1433 squelda 1.0 probe" 
    Date: Mon, 02 Dec 2002 09:51:34 -0500
From: Matt Harris <mdh@unix.si.edu>
To: incidents@securityfocus.com

    I believe a known issue regarding the ssh.com SSH server was released
    within the past two or three weeks - it's probably being scanned for
    pretty heavily. Details were on bugtraq. This is probably what this
    is, if you're running OpenSSH you should be fine. There's also that
    pesky problem with OpenSSL which affected OpenSSH on a number of
    platforms compiled using the vulnerable OpenSSL, it could be a scan
    looking for that as well. I get scanned a good 10 unique times a day, I
    would assume most people get scanned quite frequently as well, so as
    long as there're no signs of a system compromise, you shouldn't lose too
    much hair over it. Go through the motions, check the box for SSHD core
    files, etc etc, and make sure the box is safe just to be sure. Never
    does hurt. :-)
    Also check to be sure that you're using the latest stable versions of
    everything, especially your SSH servers and anything else [web servers,
    etc] that may use OpenSSL and make sure that OpenSSL itself is updated,
    and any binaries linked with it are suitably recompiled to use the
    correct and safe version and all that good stuff.

    Bojan Zdrnja wrote:
    > I suppose this is plain SSHD buffer overflow attack, followed by 'id'
    > commands. Attacker tryed buffer overflow (which didn't succeed,
    > according to logs) and after that he tried to execute 'id' commands to
    > see if his attack worked (ie. If he managed to elevate his privileges).
    > IIRC, SSH expects protocol identification as first data on the channel -
    > attacker tried overflow and then 2 commands which SSHD interpreted as
    > bad protocol identification.
    > > In-Reply-To:
    > > <1395.136.159.104.19.1038501745.squirrel@webmail.enel.ucalgary.ca>
    > >
    > > I wouldn't worry too much about this. These type of log events are
    > > usually symbolic of some type of network scanner or brute
    > > force scanner.
    > > You can duplicate a similar log event by using nc or telnet
    > > and connecting
    > > to a 'ssh' server ( nc -vv hostAddress 22 ). However, I would be
    > > concerned with whatever service you have listening that are
    > > identified in
    > > you logs before the ip address of the remote connection ( ie /bin/id
    > > and /usr/bin/id ...). I would check to see what these
    > > services are and if
    > > you don't need them I would disable them as it may be possible that
    > > someone is trying to exploit that service.
    > >
    > > jm

    > > >
    > > >Had the following entries in brought to my attention by
    > > LogWatch this
    > > >morning.
    > > >
    > > >Can anyone guide me to what they might be and if I need to
    > > be concerned
    > > >about them? 

    -- 
/*
 *
 * Matt Harris - Senior UNIX Systems Engineer
 * Smithsonian Institution, OCIO
 *
 */
----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com

    Relevant Pages

    • Re: Comparison of antiVirus/antiSpyware/Firewall Software
      ... This sort of attack comes from out side the US. ... A freeware scanner with the large commercial scanner sounds like a good idea, and I used to do that on Mac, MS-DOS, BSD, Linux and Unix so I'm pretty sure it can be done on Vista, but maybe not. ... you go and make a better virus scanner & I will buy it from you. ... But when I asked them about Trend every single ...
      (microsoft.public.windows.vista.general)
    • Re: download free source programs in C
      ... Is some evil net monster going to attack? ... is some evil file type monster going to attack? ... reputable or have a history without running a virus/spyware scanner on ...
      (comp.lang.c)
    • Scanner attacks
      ... "Blackbird" on the SAL beginner hill. ... scanner examples from Anatomy of a Scanner with a coreclear example ... Transitioning to my clear efficiently now that it's not my main attack ... managed them all in a oneshot with decent efficiency, ...
      (rec.games.corewar)
    • Re: Camera Card Reader
      ... Please do more trimming of quotes. ... Your system successfully defended itself from this attack ... The independent test I have been using is the Norman malware Cleaner, ... scanner is even close to 100% -- you really should run more than one. ...
      (rec.photo.digital)