Dumb brute force attacks slowing down, dying off

By

Hail Mary, it’s happening again.

The number of “lame” brute force Secure Shell (SSH) attacks are in decline as honeypots over the weekend detected fewer attempts against them.

Dumb brute force attacks slowing down, dying off

SANS Institute analyst Tom Liston noticed the strange activity when a string of IP addresses tried to access his SSH box with the username 'root' and password 'ihatehackers'.

The attacks are typically slow between bouts.

The strange attacks were similarly detected by Norwegian system administrator Peter Hansteen in 2008. The traffic was composed of Linux machines compromised by the dt_ssh5_malware bug and joined together in what he dubbed a “Hail Mary Cloud”.

In 2009, Hansteen received 6000 attack attempts from 770 IP addresses over four days.

More recently, his machines received 4773 failed intrusion attempts using 944 usernames from 338 separate addresses at the time.

But known brute force attacks of the same style over the last three years had been sent from thousands of IP addresses, indicating the number of infected machines in the cloud may be dwindling, Hansteen said.

Hansteen published a list of offending IP addresses and urged administrators to check and compare their traffic logs.

Liston publishes attacks against his honepot under the Twitter account @netmenaces and will soon update the feed to include the SSH attacks.

Got a news tip for our journalists? Share it with us anonymously here.

Copyright © SC Magazine, Australia

Tags:

Most Read Articles

Travel eSIMs secretly route traffic over Chinese and undisclosed networks: study

Travel eSIMs secretly route traffic over Chinese and undisclosed networks: study

Accenture to buy Australian cyber security firm CyberCX

Accenture to buy Australian cyber security firm CyberCX

TPG Telecom reveals iiNet order management system breached

TPG Telecom reveals iiNet order management system breached

"Shade BIOS" stealth malware hides below operating system

"Shade BIOS" stealth malware hides below operating system

Log In

  |  Forgot your password?