Re: [VulnDiscuss] Re: [Full-Disclosure] Automated SSH login attempts?

Paul Schmehl wrote:

> --On Thursday, July 22, 2004 10:47 AM -0400 Jay Libove 
> <libove@felines.org> wrote:
>
> > Here are some log entries from my system:
> >
> > Jul 15 10:01:34 panther6 sshd[8267]: Illegal user test from 62.67.45.4
> > Jul 15 10:01:34 panther6 sshd[8267]: Failed password for illegal user
>
>
> We've been seeing these as well, and in every case we've notified the 
> owners, they have mailed us back to let us know that the host had been 
> rooted.
>
> You would be doing the owners a big favor by notifying them that their 
> host is probably compromised.
This makes me feel better. I thought it odd that so many machines were 
hitting my ssh server. I even blocked it at the firewall for a day or 
so. Is anyone talking on what the bot system was that allowed them to 
automate this? It seemed that as soon as 1 got it so did a whole bunch 
more so obviously people are distributing lists of IP's for potential 
SSH access.

I'm not real sure on who to contact for these machines, but here are all 
the ones that have hit me. Mostly seem to be Asian so far.

Jul 25 19:48:40 server sshd[55910]: Failed password for illegal user 
test from 212.4.172.123 port 56843 ssh2
Jul 25 19:48:42 server sshd[55915]: Failed password for illegal user 
guest from 212.4.172.123 port 56916 ssh2
Jul 25 20:37:19 server sshd[57221]: Failed password for illegal user 
test from 210.40.224.10 port 49738 ssh2
Jul 25 20:37:22 server sshd[57223]: Failed password for illegal user 
guest from 210.40.224.10 port 49756 ssh2

Jul 24 21:37:50 server sshd[21578]: Failed password for illegal user 
test from 218.244.240.195 port 58900 ssh2
Jul 24 21:37:53 server sshd[21580]: Failed password for illegal user 
guest from 218.244.240.195 port 58928 ssh2

Jul 22 18:23:36 server sshd[38184]: Failed password for illegal user 
test from 216.86.221.113 port 58012 ssh2
Jul 22 18:23:37 server sshd[38195]: Failed password for illegal user 
guest from 216.86.221.113 port 51509 ssh2