Re: Uptick in SSH scanning?
Bill Campbell <[email protected]>
| Newsgroups | gmane.org.operators.internet-access |
|---|---|
| Message-ID | <[email protected]> |
On Wed, Sep 03, 2008, Chris Adams wrote: >Has anyone else seen a significant rise in SSH scanning in the last day >or two? Rather than my usual short list of blocked hosts (usually under >10), I've got several hundred blocked right now, and virtually all for >SSH login attempts with invalid users. > >In a handful of tests, I see most running OpenSSH 3.8p1 and 3.8.1p1 >(although I've also seen newer versions, as new as 4.7). A number (but >not all) also seem to be running Debian sarge. Were there some >vulnerabilities in those versions that are being exploited, or are these >just systems with simple usernames and bad passwords? I normally see about 15,000 ssh probes monthly from systems we monitor. The total for the last 30 days is up over 22,000 messages, but a large chunk of that came from two or three hosts which hit thousands of times in a short period of time. By and large, the overall rate of probes seems fairly normal, with a few hosts hitting far more than others. Surges from a few hosts are not unusual. Bill -- INTERNET: [email protected] Bill Campbell; Celestial Software LLC URL: http://www.celestial.com/ PO Box 820; 6641 E. Mercer Way Voice: (206) 236-1676 Mercer Island, WA 98040-0820 Fax: (206) 232-9186 A good politician is quite as unthinkable as an honest burglar. -- H. L. Mencken -- Eat sushi frequently. - Avi [email protected] is the human contact address. [email protected] is the list posting address. See below URL for subscribe/unsubscribe and list options: http://inet-access.net/mailman/listinfo/list