Distributed SSH scanning

[elazar]

http://isc.sans.org/diary.html?storyid=3529
FYI, you may want to pay a little more attention to your Firewall/IDS logs...

E

[imported_wyze]

I've seen a lot of this on the web servers that I manage.... is the Chinaman from what my logs tell me ..... hence China is about 75% banned on my servers

[streaker69]

I had an SSH server opened to the outside, but no where else on the inside of my network for a little while. Within minutes of it being put on the outside, I'd see brute force attacks against it.

[thorin]

Thanks for the heads up.

[beakmyn]

Good to know. I'm in the process now of setting up ssh on my wrt54gs, looks like I'll be adding srelay to move port 22 to port 1080. That should fix that.

[elazar]

I had an SSH server opened to the outside, but no where else on the inside of my network for a little while. Within minutes of it being put on the outside, I'd see brute force attacks against it.

Yea, they have been doing this for years, but apparently there is a real interest in it now, to the point that it is distributed.

Thanks for the heads up.

Good to know. I'm in the process now of setting up ssh on my wrt54gs, looks like I'll be adding srelay to move port 22 to port 1080. That should fix that.

Your welcome

If the mods don't mind a little plug(delete this if you do): you can help SANS track this by sending your firewall/IDS logs to DShield(www.DShield.org), they need logs, home users especially...