Re: SSH probe attack afoot?

From: Jeffrey Goldberg (jeffrey_at_goldmark.org)
Date: 02/12/05

  • Next message: Stephen J. Smoogen: "Re: SSH probe attack afoot?" 
    Date: Fri, 11 Feb 2005 20:37:22 -0800
To: incidents@securityfocus.com

    On Feb 6, 2005, at 7:09 AM, Bernie Cosell wrote:

    > We're now getting hammered with the third round of ssh probes in the
    > last
    > four days [one from CA, one from Brazil and one from Virginia]. I was
    > wondering: is there some virus or the like floating around now that
    > leaves an ssh-hammering zombie in its wake? Or is it just coincidental
    > that we have gotten three floods?

    I fear that some hosts I'm responsible for are (they almost certainly
    were) such zombies. chkrootkit didn't turn up anything. Is there
    something (in addition to anomolous ssh traffic) that I should be
    looking for.

    But they don't seem to hammer much. They seem to do their stuff in
    infrequent bursts, so I don't know which machines I've cleaned, which
    are reinfected and which have been compromised and have gone unnoticed.
      Advice on eradication would be welcome.

    You'll be glad to know that I've been trying to carefully monitor
    outgoing ssh traffic so as not to a (further) nuisance to the rest of
    the net.

    With apologies,

    -j 

    -- 
Jeffrey Goldberg                        http://www.goldmark.org/jeff/
  • Next message: Stephen J. Smoogen: "Re: SSH probe attack afoot?"