Full Disclosure mailing list archives
RE: Automated SSH login attempts?
From: "Todd Towles" <toddtowles () brookshires com>
Date: Fri, 30 Jul 2004 07:53:18 -0500
Jan is right - looking at the code might be the only way to know what is really happening. We all await your disassembled, debugged and traced code analysis, Jan. =) -----Original Message----- From: full-disclosure-admin () lists netsys com [mailto:full-disclosure-admin () lists netsys com] On Behalf Of Jan Muenther Sent: Friday, July 30, 2004 6:52 AM To: Andrew Farmer Cc: Ali Campbell; full-disclosure () lists netsys com Subject: Re: [Full-disclosure] Automated SSH login attempts? Now, if anybody could jump through the hoop and send me the thing or make it publicly available... all these things are musings, 'it looks as if...' and 'it seems like...' are not exactly results of an analysis. Just tracing tcpdump's output is definitely insufficient. If the tool just sends normal TCP packets, then why does it need root rights, which you typically only require for raw sockets to build packets which can't be constructed with SOCK_STREAM or SOCK_DGRAM? I hope you don't run it on your production boxes in the normal userland - ever considered the fact it might contain an ELF infector or something? Now, if I wanted to deploy malware on a Linux box, I'd just come up with a mysterious looking tool and let that infect the machines of people who just run anything they can get a hold of. It's Linux, after all, right? No viruses, right?
Do I take it that these things are just trying to log in using some guessed password(s) ? Out of interest, do we have any idea what these opportunistic passwords might be ?At least two of them are guest:guest and test:test. I'd guess that root:root and admin@admin are on the list too :-)
This things needs to be disassembled, debugged and traced. All else is just whistling in the dark. Meh. Cheers, J. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Re: Automated SSH login attempts?, (continued)
- Re: Automated SSH login attempts? Andrei Galca-Vasiliu (Jul 25)
- Re: Automated SSH login attempts? Shafik Yaghmour (Jul 26)
- Re: Automated SSH login attempts? Alain Crespo (Jul 28)
- Re: Automated SSH login attempts? syrrus (Jul 25)
- Re: Automated SSH login attempts? Joe Hickory (Jul 27)
- Re: Automated SSH login attempts? Juan Carlos Navea (Jul 29)
- RE: Automated SSH login attempts? Todd Towles (Jul 29)
- Re: Automated SSH login attempts? Ali Campbell (Jul 29)
- Re: Automated SSH login attempts? Andrew Farmer (Jul 29)
- Re: Automated SSH login attempts? Jan Muenther (Jul 30)
- RE: Automated SSH login attempts? Todd Towles (Jul 30)
- Re: Automated SSH login attempts? Stefan Janecek (Jul 30)
- Re: Automated SSH login attempts? Jan Muenther (Jul 31)
- Re: Automated SSH login attempts? Andrew Farmer (Jul 30)
- Re: Automated SSH login attempts? Christian Fromme (Jul 30)
- Re: Re: Automated SSH login attempts? Valdis . Kletnieks (Jul 29)
- Re: Re: Automated SSH login attempts? Jan Muenther (Jul 30)
- Re: Re: Automated SSH login attempts? Andrei Galca-Vasiliu (Jul 29)
- Re: Re: Automated SSH login attempts? Max Valdez (Jul 29)
- Re: Re: Automated SSH login attempts? dmargoli (Jul 29)