Re: SSH brute forcers

On 10/06/05, C.J. Steele, CISSP <[email protected]> wrote:
> I'm actually thinking about that.  I was thinking of doing a web-based
> feed-back option to report hosts and the number of attacks they have
> been responsible for and then doing ranking based on IP and/or netblock
> and/or domain name.

Thoughts here from my comments on the bugtraq thread...

Take a look at the way dshield do this; logically perhaps they already
have a significant database of port 22 ssh scanning?

A good idea to
1) Base automated email reporting on something like
the "standard" they use already. Then other projects reporting to
dshield could be more easily reworked to integrate with (say)
personal firewalls. If you want to obtain data contributions from
ordinary users too. Recommended.

A countermeasure already adopted on some sites is to deliberately
use an alternative, IANA unallocated high port to ssh. That brings
in a whole world of additional complexity. But maybe the database
and tool design can allow for this? Is it worth the effort?

2. dshield only offers port 22 data presumably as correlated against
ssh. So - rather than re-invent a duplicate, generalized dshield
system... Allow for two extensions to the concept:

2.1
ALL site "risk" data - target domain name/IP, ID, is obfuscated
using cryptographic quality hashes for the submit fields. Then only
the owner of that data can map internal stuff from their site when
browsing your database records. General stats are unaffected, and
offer minimal intelligence value to an attacker accessing the data
legitimately, or penetrating the central database for full access.

2.2
It isnt necessary that your central database knows the obfuscated ssh
port numbers either. Just collects "non port 22" submissions
and accounts for them separately. Then we might see if going to the
trouble of security by obscurity changing ssh ports for a site is worth
the effort...

Have a word with the good folks doing dshield. Perhaps they can
"kickstart" your idea so that you just build the extensions, and they
can take some of the credit for any collaboration with you? Perhaps
your work might also have value to their project development too.

_______________________________________________
Intrusions mailing list
[email protected]
http://www.dshield.org/mailman/listinfo/intrusions