Re: SSH bruteforce on its way...
| Newsgroups | gmane.comp.security.incidents |
|---|---|
| Message-ID | <[email protected]> |
Hi Volker, ive started a honey Machine for your answer on, what are they doing with captured machines ... just after some hours the Machine was up the first attempts where made, probing for useable machines, only one attempt was a *human* login with interaction. I've used sudosh for logging the bash session and first assumption is that the person which was using the shell didnt know to much about Unix as log cleaning was made with scripts downloaded from geocities and the bash_history was forgotten. I've put the session data on a website (http://www.jackal-net.at/tiki-read_article.php?articleId=20) where you can see what i've setup and what the guys where doing. (currently only one session is online but i'm sure, others will follow :) ... ) Kind regards Michael Lang