Re: Uptick in SSH scanning?
Max Gribov <max-snht/[email protected]>
| Newsgroups | gmane.org.operators.internet-access |
|---|---|
| Message-ID | <[email protected]> |
Chris Adams wrote: > Has anyone else seen a significant rise in SSH scanning in the last day > or two? Rather than my usual short list of blocked hosts (usually under > 10), I've got several hundred blocked right now, and virtually all for > SSH login attempts with invalid users. > theres this: http://www.informationweek.com/news/software/linux/showArticle.jhtml?articleID=210201115 original: http://www.us-cert.gov/current/index.html#ssh_key_based_attacks > In a handful of tests, I see most running OpenSSH 3.8p1 and 3.8.1p1 > (although I've also seen newer versions, as new as 4.7). A number (but > not all) also seem to be running Debian sarge. Were there some > vulnerabilities in those versions that are being exploited, or are these > just systems with simple usernames and bad passwords? > > -- Eat sushi frequently. - Avi [email protected] is the human contact address. [email protected] is the list posting address. See below URL for subscribe/unsubscribe and list options: http://inet-access.net/mailman/listinfo/list