RE: Re: FYI - SSH bruteforcing

"Ron Shuck" <[email protected]>
Newsgroups gmane.comp.security.intrusions
Message-ID <[email protected]> 
Hi,

I have observed this activity on several SMTP Relay servers that I
manage. The guesses did not appear to be based on actual users at the
site. Most originated from APNIC or LACNIC addresses, how odd.  ;-)


Ron Shuck, CISSP, GCIA, CCSE - Managing Consultant
Buchanan Associates - A Technology Company in the People Business 

-----Original Message-----
From: [email protected]
[mailto:[email protected]] On Behalf Of Tom Glaab
Sent: Friday, December 03, 2004 6:10 AM
To: Intrusions List (GCIA Practicals)
Subject: [Intrusions] Re: FYI - SSH bruteforcing

Andrew Daviel wrote:

>Recently we had a brute-force attempt to guess SSH passwords from a 
>machine in taiwan 203.95.227.177 (www.shark-tw.net)
>
>The process identifies itself as SSH-2.0-libssh-0.1 and tries to guess 
>passwords for the users root,admin, test and guest.
>

I'm seeing them several times a week. The list of "users" is growing
too. This is yesterday's collection from one box (reported by LogWatch):

Illegal users from these:

   andrew/none from 66.36.241.244: 1 Time(s)
   andrew/password from 66.36.241.244: 1 Time(s)
   angel/none from 66.36.241.244: 1 Time(s)
   angel/password from 66.36.241.244: 1 Time(s)
   barbara/none from 66.36.241.244: 1 Time(s)
   barbara/password from 66.36.241.244: 1 Time(s)
   ben/none from 66.36.241.244: 1 Time(s)
   ben/password from 66.36.241.244: 1 Time(s)
   betty/none from 66.36.241.244: 1 Time(s)
   betty/password from 66.36.241.244: 1 Time(s)
   billy/none from 66.36.241.244: 1 Time(s)
   billy/password from 66.36.241.244: 1 Time(s)
   black/none from 66.36.241.244: 1 Time(s)
   black/password from 66.36.241.244: 1 Time(s)
   blue/none from 66.36.241.244: 1 Time(s)
   blue/password from 66.36.241.244: 1 Time(s)
   brandon/none from 66.36.241.244: 1 Time(s)
   brandon/password from 66.36.241.244: 1 Time(s)
   brian/none from 66.36.241.244: 1 Time(s)
   brian/password from 66.36.241.244: 1 Time(s)
   buddy/none from 66.36.241.244: 1 Time(s)
   buddy/password from 66.36.241.244: 1 Time(s)
   carmen/none from 66.36.241.244: 1 Time(s)
   carmen/password from 66.36.241.244: 1 Time(s)
   charlie/none from 66.36.241.244: 1 Time(s)
   charlie/password from 66.36.241.244: 1 Time(s)
   cosmin/none from 211.33.175.54: 1 Time(s)
   cosmin/password from 211.33.175.54: 1 Time(s)
   cyrus/none from 211.33.175.54: 1 Time(s)
   cyrus/password from 211.33.175.54: 1 Time(s)
   daniel/none from 66.36.241.244: 1 Time(s)
   daniel/password from 66.36.241.244: 1 Time(s)
   david/none from 66.36.241.244: 1 Time(s)
   david/password from 66.36.241.244: 1 Time(s)
   dog/none from 66.36.241.244: 1 Time(s)
   dog/password from 66.36.241.244: 1 Time(s)
   emily/none from 66.36.241.244: 1 Time(s)
   emily/password from 66.36.241.244: 1 Time(s)
   eric/none from 66.36.241.244: 1 Time(s)
   eric/password from 66.36.241.244: 1 Time(s)
   god/none from 66.36.241.244: 1 Time(s)
   god/password from 66.36.241.244: 1 Time(s)
   green/none from 66.36.241.244: 1 Time(s)
   green/password from 66.36.241.244: 1 Time(s)
   henry/none from 66.36.241.244: 1 Time(s)
   henry/password from 66.36.241.244: 1 Time(s)
   horde/none from 211.33.175.54: 1 Time(s)
   horde/password from 211.33.175.54: 1 Time(s)
   iceuser/none from 211.33.175.54: 1 Time(s)
   iceuser/password from 211.33.175.54: 1 Time(s)
   irc/none from 211.33.175.54: 2 Time(s)
   irc/password from 211.33.175.54: 2 Time(s)
   jane/none from 211.33.175.54: 1 Time(s)
   jane/none from 66.36.241.244: 1 Time(s)
   jane/password from 211.33.175.54: 1 Time(s)
   jane/password from 66.36.241.244: 1 Time(s)
   jason/none from 66.36.241.244: 1 Time(s)
   jason/password from 66.36.241.244: 1 Time(s)
   jeremy/none from 66.36.241.244: 1 Time(s)
   jeremy/password from 66.36.241.244: 1 Time(s)
   joe/none from 66.36.241.244: 1 Time(s)
   joe/password from 66.36.241.244: 1 Time(s)
   johnny/none from 66.36.241.244: 1 Time(s)
   johnny/password from 66.36.241.244: 1 Time(s)
   jordan/none from 66.36.241.244: 1 Time(s)
   jordan/password from 66.36.241.244: 1 Time(s)
   justin/none from 66.36.241.244: 1 Time(s)
   justin/password from 66.36.241.244: 1 Time(s)
   larisa/none from 66.36.241.244: 1 Time(s)
   larisa/password from 66.36.241.244: 1 Time(s)
   lion/none from 66.36.241.244: 1 Time(s)
   lion/password from 66.36.241.244: 1 Time(s)
   lucy/none from 66.36.241.244: 1 Time(s)
   lucy/password from 66.36.241.244: 1 Time(s)
   magic/none from 66.36.241.244: 1 Time(s)
   magic/password from 66.36.241.244: 1 Time(s)
   maria/none from 66.36.241.244: 1 Time(s)
   maria/password from 66.36.241.244: 1 Time(s)
   market/none from 66.36.241.244: 1 Time(s)
   market/password from 66.36.241.244: 1 Time(s)
   matt/none from 211.33.175.54: 1 Time(s)
   matt/password from 211.33.175.54: 1 Time(s)
   matthew/none from 66.36.241.244: 1 Time(s)
   matthew/password from 66.36.241.244: 1 Time(s)
   max/none from 66.36.241.244: 1 Time(s)
   max/password from 66.36.241.244: 1 Time(s)
   michael/none from 66.36.241.244: 1 Time(s)
   michael/password from 66.36.241.244: 1 Time(s)
   nathan/none from 66.36.241.244: 1 Time(s)
   nathan/password from 66.36.241.244: 1 Time(s)
   nicholas/none from 66.36.241.244: 1 Time(s)
   nicholas/password from 66.36.241.244: 1 Time(s)
   nicole/none from 66.36.241.244: 1 Time(s)
   nicole/password from 66.36.241.244: 1 Time(s)
   pamela/none from 211.33.175.54: 1 Time(s)
   pamela/password from 211.33.175.54: 1 Time(s)
   patrick/none from 211.33.175.54: 2 Time(s)
   patrick/password from 211.33.175.54: 2 Time(s)
   pub/none from 66.36.241.244: 1 Time(s)
   pub/password from 66.36.241.244: 1 Time(s)
   red/none from 66.36.241.244: 1 Time(s)
   red/password from 66.36.241.244: 1 Time(s)
   robin/none from 66.36.241.244: 1 Time(s)
   robin/password from 66.36.241.244: 1 Time(s)
   rolo/none from 211.33.175.54: 1 Time(s)
   rolo/password from 211.33.175.54: 1 Time(s)
   rose/none from 66.36.241.244: 1 Time(s)
   rose/password from 66.36.241.244: 1 Time(s)
   shell/none from 66.36.241.244: 1 Time(s)
   shell/password from 66.36.241.244: 1 Time(s)
   stephen/none from 66.36.241.244: 1 Time(s)
   stephen/password from 66.36.241.244: 1 Time(s)
   steven/none from 66.36.241.244: 1 Time(s)
   steven/password from 66.36.241.244: 1 Time(s)
   system/none from 66.36.241.244: 1 Time(s)
   system/password from 66.36.241.244: 1 Time(s)
   test/none from 211.33.175.54: 4 Time(s)
   test/password from 211.33.175.54: 4 Time(s)
   tom/none from 66.36.241.244: 1 Time(s)
   tom/password from 66.36.241.244: 1 Time(s)
   vampire/none from 66.36.241.244: 1 Time(s)
   vampire/password from 66.36.241.244: 1 Time(s)
   william/none from 66.36.241.244: 1 Time(s)
   william/password from 66.36.241.244: 1 Time(s)
   www-data/none from 211.33.175.54: 1 Time(s)
   www-data/password from 211.33.175.54: 1 Time(s)
   www/none from 211.33.175.54: 1 Time(s)
   www/password from 211.33.175.54: 1 Time(s)
   wwwrun/none from 211.33.175.54: 1 Time(s)
   wwwrun/password from 211.33.175.54: 1 Time(s)
   yellow/none from 66.36.241.244: 1 Time(s)
   yellow/password from 66.36.241.244: 1 Time(s)

tg.


_______________________________________________
Intrusions mailing list
[email protected]
http://www.dshield.org/mailman/listinfo/intrusions

_______________________________________________
Intrusions mailing list
[email protected]
http://www.dshield.org/mailman/listinfo/intrusions
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.