Dumb brute force attacks slowing down, dying off

Powered by SC Magazine
 

Hail Mary, it’s happening again.

The number of “lame” brute force Secure Shell (SSH) attacks are in decline as honeypots over the weekend detected fewer attempts against them.

SANS Institute analyst Tom Liston noticed the strange activity when a string of IP addresses tried to access his SSH box with the username 'root' and password 'ihatehackers'.

The attacks are typically slow between bouts.

The strange attacks were similarly detected by Norwegian system administrator Peter Hansteen in 2008. The traffic was composed of Linux machines compromised by the dt_ssh5_malware bug and joined together in what he dubbed a “Hail Mary Cloud”.

In 2009, Hansteen received 6000 attack attempts from 770 IP addresses over four days.

More recently, his machines received 4773 failed intrusion attempts using 944 usernames from 338 separate addresses at the time.

But known brute force attacks of the same style over the last three years had been sent from thousands of IP addresses, indicating the number of infected machines in the cloud may be dwindling, Hansteen said.

Hansteen published a list of offending IP addresses and urged administrators to check and compare their traffic logs.

Liston publishes attacks against his honepot under the Twitter account @netmenaces and will soon update the feed to include the SSH attacks.

Copyright © SC Magazine, Australia


Dumb brute force attacks slowing down, dying off
 
 
 
Top Stories
ATO shaves $4m off IT contractor panel
Reform cuts admin burden, introduces KPIs.
 
Turnbull introduces data retention legislation
Still no definition of metadata to be stored.
 
Crime Commission prepares core systems overhaul
Will replace 30 year-old national criminal database.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
In which area is your IT shop hiring the most staff?




   |   View results
IT security and risk
  27%
 
Sourcing and strategy
  13%
 
IT infrastructure (servers, storage, networking)
  21%
 
End user computing (desktops, mobiles, apps)
  14%
 
Software development
  25%
TOTAL VOTES: 435

Vote
Would your InfoSec team be prepared to share threat data with the Australian Government?

   |   View results
Yes
  54%
 
No
  46%
TOTAL VOTES: 209

Vote