Re: SSH probe attack afoot?

• Previous message: xyberpix: "Re: SSH probe attack afoot?"
• In reply to: Bernie Cosell: "SSH probe attack afoot?"
• Next in thread: Joe Egloff: "Re: SSH probe attack afoot?"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

To: incidents@securityfocus.com
Date: Mon, 07 Feb 2005 20:46:32 +0000

On Sun, 2005-02-06 at 10:09 -0500, Bernie Cosell wrote:
> We're now getting hammered with the third round of ssh probes in the last
> four days [one from CA, one from Brazil and one from Virginia]. I was
> wondering: is there some virus or the like floating around now that
> leaves an ssh-hammering zombie in its wake? Or is it just coincidental
> that we have gotten three floods?
>
> [the probes are just dozens of random-seeming login attempts with a bunch
> of root-password-guesses interspersed]
>
> /Bernie\

Multiple SSH brute force tools,which has been covered on this list and
others a few times over the last year.

http://www.securityfocus.com/archive/75/200407271059.11940.robin@kallisti.net.nz/2005-02-04/2005-02-10/0
http://www.google.com/search?num=100&hl=en&safe=off&q=ssh+brute
+force&spell=1

-- 
With Regards..
Barrie Dempster (zeedo) - Fortiter et Strenue
blog: http://zeedo.blogspot.com
site: http://www.bsrf.org.uk
[ gpg --recv-keys --keyserver www.keyserver.net 0x96025FD0 ]

• application/pgp-signature attachment: This is a digitally signed message part

• Previous message: xyberpix: "Re: SSH probe attack afoot?"
• In reply to: Bernie Cosell: "SSH probe attack afoot?"
• Next in thread: Joe Egloff: "Re: SSH probe attack afoot?"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]