Re: SSH probe attack afoot?
From: Jeffrey Goldberg (jeffrey_at_goldmark.org)
Date: Fri, 11 Feb 2005 20:37:22 -0800 To: firstname.lastname@example.org
On Feb 6, 2005, at 7:09 AM, Bernie Cosell wrote:
> We're now getting hammered with the third round of ssh probes in the
> four days [one from CA, one from Brazil and one from Virginia]. I was
> wondering: is there some virus or the like floating around now that
> leaves an ssh-hammering zombie in its wake? Or is it just coincidental
> that we have gotten three floods?
I fear that some hosts I'm responsible for are (they almost certainly
were) such zombies. chkrootkit didn't turn up anything. Is there
something (in addition to anomolous ssh traffic) that I should be
But they don't seem to hammer much. They seem to do their stuff in
infrequent bursts, so I don't know which machines I've cleaned, which
are reinfected and which have been compromised and have gone unnoticed.
Advice on eradication would be welcome.
You'll be glad to know that I've been trying to carefully monitor
outgoing ssh traffic so as not to a (further) nuisance to the rest of
-- Jeffrey Goldberg http://www.goldmark.org/jeff/