SSH brute force attacks still going strong - Security Bytes
Home > IT Blogs > Security Bytes > SSH brute force attacks still going strong
« House committee to hear recommendations on cybersecurity for next president
Firefox 3 security fixes released »
» VIEW ALL POSTS Sep 19 2008   1:25PM GMT

SSH brute force attacks still going strong



Posted by: Dennis Fisher
Information Security Threats

The brute-force SSH attacks that have plagued the Internet for much of this year are continuing, and experts are responding by creating tools to stop the brute-force attempts and lists of the attacking IP addresses. The SANS Internet Storm Center has a good post with some information on SSH attack mitigation tools and advice on what to do if you’re being attacked. But the most interesting information on this wave of attacks is coming from The Shadowserver Foundation, which has compiled a quick list of some IP addresses that are attacking and the domains that own those machines. The list has quite a few interesting domains on it, including a number of U.S. colleges and universities. Shadowserver also has a chart showing which countries have the most attacking IP addresses, and not surprisingly, the U.S. and China are at the top of the list, with nearly 17% in China and nearly 14% in the U.S.

It’s a small sample size, but if you’re being hit with this, it never hurts to know where it’s coming from. These attacks have been ongoing for several months, and there are a variety of attack tools out there  to make life simple for the bad guys. Stay tuned, as I’d doubt this is going to stop anytime soon.

AddThis Social Bookmark Button     Comment     RSS Feed     Email a friend

Comment on this Post


You must be logged-in to post a comment. Log-in/Register

More attacks on SSH passwords — Security Bytes  |   Oct 3 2008   4:02PM GMT

[...] It appears that SSH attacks are becoming the go-to move for lazy attackers looking to victimize lazy admins. A couple of weeks ago I wrote about some ongoing brute-force attacks against SSH implementations and now it seems that attackers are moving on to some new tactics. The INternet Storm Center has gotten a couple of reports of SSH attacks in which the attacking machines are trying to brute-force the SSH password with about 20 attempts per hour. The key here is that number of attempts falls below the threshold of the scripts usually used to detect these attempts and ban the attacking IP addresses. Usernames are being brute forced starting at “aaa” and incremented.  This is being done in a distributed manner with almost perfect synchronization between the scanning hosts.  Over the last 32 hours, his system received 216 login attempts of which 138 attempts were from unique IP addresses.  Obviously, the attacker is trying to avoid the popular SSH banning scripts by going under the banning thresholds of these programs.  At peak, there was only 20 total attempts per hour. Note that the username guessing did not actually cover all possibilities.  Perhaps it is a bug, or by design.  The last letter was not being exhaustively tested - only about 10 of 26 letters were being tested in the last position, and it seemed to be randomly picked. [...]


 

More attacks on SSH passwords | Security in Mind  |   Oct 4 2008   7:33PM GMT

[...] It appears that SSH attacks are becoming the go-to move for lazy attackers looking to victimize lazy admins. A couple of weeks ago I wrote about some ongoing brute-force attacks against SSH implementations and now it seems that attackers are moving on to some new tactics. The INternet Storm Center has gotten a couple of reports of SSH attacks in which the attacking machines are trying to brute-force the SSH password with about 20 attempts per hour. The key here is that number of attempts falls below the threshold of the scripts usually used to detect these attempts and ban the attacking IP addresses. Usernames are being brute forced starting at “aaa” and incremented.  This is being done in a distributed manner with almost perfect synchronization between the scanning hosts.  Over the last 32 hours, his system received 216 login attempts of which 138 attempts were from unique IP addresses.  Obviously, the attacker is trying to avoid the popular SSH banning scripts by going under the banning thresholds of these programs.  At peak, there was only 20 total attempts per hour. Note that the username guessing did not actually cover all possibilities.  Perhaps it is a bug, or by design.  The last letter was not being exhaustively tested - only about 10 of 26 letters were being tested in the last position, and it seemed to be randomly picked. [...]


 

More attacks on SSH passwords | Security in Mind  |   Oct 19 2008   11:53AM GMT

[...] It appears that SSH attacks are becoming the go-to move for lazy attackers looking to victimize lazy admins. A couple of weeks ago I wrote about some ongoing brute-force attacks against SSH implementations and now it seems that attackers are moving on to some new tactics. The INternet Storm Center has gotten a couple of reports of SSH attacks in which the attacking machines are trying to brute-force the SSH password with about 20 attempts per hour. The key here is that number of attempts falls below the threshold of the scripts usually used to detect these attempts and ban the attacking IP addresses. Usernames are being brute forced starting at “aaa” and incremented. This is being done in a distributed manner with almost perfect synchronization between the scanning hosts. Over the last 32 hours, his system received 216 login attempts of which 138 attempts were from unique IP addresses. Obviously, the attacker is trying to avoid the popular SSH banning scripts by going under the banning thresholds of these programs. At peak, there was only 20 total attempts per hour. Note that the username guessing did not actually cover all possibilities. Perhaps it is a bug, or by design. The last letter was not being exhaustively tested - only about 10 of 26 letters were being tested in the last position, and it seemed to be randomly picked. [...]


 
Visit Information Security Home |   Information Security News  |  Information Security White Papers  |  Information Security Videos  |  Information Security Resources