Dumb brute force attacks slowing down, dying off

By

Hail Mary, it’s happening again.

The number of “lame” brute force Secure Shell (SSH) attacks are in decline as honeypots over the weekend detected fewer attempts against them.

Dumb brute force attacks slowing down, dying off

SANS Institute analyst Tom Liston noticed the strange activity when a string of IP addresses tried to access his SSH box with the username 'root' and password 'ihatehackers'.

The attacks are typically slow between bouts.

The strange attacks were similarly detected by Norwegian system administrator Peter Hansteen in 2008. The traffic was composed of Linux machines compromised by the dt_ssh5_malware bug and joined together in what he dubbed a “Hail Mary Cloud”.

In 2009, Hansteen received 6000 attack attempts from 770 IP addresses over four days.

More recently, his machines received 4773 failed intrusion attempts using 944 usernames from 338 separate addresses at the time.

But known brute force attacks of the same style over the last three years had been sent from thousands of IP addresses, indicating the number of infected machines in the cloud may be dwindling, Hansteen said.

Hansteen published a list of offending IP addresses and urged administrators to check and compare their traffic logs.

Liston publishes attacks against his honepot under the Twitter account @netmenaces and will soon update the feed to include the SSH attacks.

Got a news tip for our journalists? Share it with us anonymously here.

Copyright © SC Magazine, Australia

Tags:

Most Read Articles

Qantas facing 'significant' data theft after cyber attack

Qantas facing 'significant' data theft after cyber attack

Home Affairs officer accessed data on "friends and associates"

Home Affairs officer accessed data on "friends and associates"

Ex-student charged over Western Sydney University cyberattacks

Ex-student charged over Western Sydney University cyberattacks

International Criminal Court hit by cyber attack

International Criminal Court hit by cyber attack

Log In

  |  Forgot your password?