Uptick in SSH scanning?
Chris Adams <[email protected]>
| Newsgroups | gmane.org.operators.internet-access |
|---|---|
| Message-ID | <[email protected]> |
Has anyone else seen a significant rise in SSH scanning in the last day or two? Rather than my usual short list of blocked hosts (usually under 10), I've got several hundred blocked right now, and virtually all for SSH login attempts with invalid users. In a handful of tests, I see most running OpenSSH 3.8p1 and 3.8.1p1 (although I've also seen newer versions, as new as 4.7). A number (but not all) also seem to be running Debian sarge. Were there some vulnerabilities in those versions that are being exploited, or are these just systems with simple usernames and bad passwords? -- Chris Adams <[email protected]> Systems and Network Administrator - HiWAAY Internet Services I don't speak for anybody but myself - that's enough trouble. -- Eat sushi frequently. - Avi [email protected] is the human contact address. [email protected] is the list posting address. See below URL for subscribe/unsubscribe and list options: http://inet-access.net/mailman/listinfo/list