[Dshield] ssh attacks

Ryan McConigley ryan at csse.uwa.edu.au
Wed Oct 13 00:18:28 GMT 2004


At 08:30 AM 12/10/2004 -0700, you wrote:
>In the last several days I have seen an increase in attempts to log into 
>my server via SSH. Previously I was only seeing the "test" and "guest" 
>attempts previously mentioned on this list. Here is an example of what I 
>saw yesterday:
><snip>
>Has anyone else been seeing this?

         Yeap.  All our machines with external ssh access have had it 
appear at one time or another.  Interestingly it seems to come in 
waves.  We seem to be in a quiet part of the cycle at the moment, I expect 
it to liven up again towards the end of the week.  I have noticed that the 
list of usernames they're trying to connect with is slowly getting 
larger.  I've been wondering if thats a progression from finding accounts 
on compromised machines.

         Cheers,
                 Ryan.

--
           Ryan McConigley - Systems Administrator                  _.-,
      Computer Science   University of Western Australia        .--'  '-._
        Tel: (+61 8) 6488 7082 - Fax: (+61 8) 6488 1089       _/`-  _      '.
Ryan[@]csse.uwa.edu.au - http://www.csse.uwa.edu.au/~ryan  '----'._`.----. \
                                                                      `     \;
  "You're just jealous because the voices are talking to me"                ;_\






More information about the list mailing list