Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.os.linux.networking > #4352

Re: Increased SSH breakin attempts

Show all headers | View raw

On 2019-04-05, Jorgen Grahn <grahn+nntp@snipabacken.se> wrote:
> On Wed, 2019-04-03, William Unruh wrote:
>> On 2019-04-03, Harold Johanssen <noemail@please.net> wrote:
>>> 	For a while now I have noticed a significant increase in brute-
>>> force password breaking attempts at my SSH server exposed to the 
>>> Internet. There has always been traffic like that there, but it has 
>>> recently become far more voluminous than usual: my domain is a 
>>> nondescript one, with nothing much interesting, and it is registering 
>>> such attempts to the tune of several per minute, when it used to be more 
>>> like one, maybe two, per minute. 
>>>
>>> 	The attempts are coming from lots of different IP addresses all 
>>> over the place, but I wonder if it is a single bot controlling thousands 
>>> of different PCs? Anyway, has anybody noticed a similarly recent traffic 
>>> increase in their exposed SSH interfaces? 
>>
>> Yes, I have noticed a substatial increase for about the past 2 months (
>> a difference of a factor of 10 or so). The passwords, which I capture
>> for failed attempts, are mostly "obvious" ones
>> 123456
>> 123qweasd
>> p a s s w o r d
>> Only about 1/2 of the unique ones are in the pwned password database.
>>
>> Mine are more like 400/day.
>
> Up to 900/day here.  I can't say it bothers me much, though.
>
> /Jorgen
>
No matter what the password, etc, there is always that small random
chance ( which includes some shoulder surfing, etc) that that password
to your system as user/root is guessed. And if it is one huge botnet
that is attacking you, they could also be guessing your passwords
without repetition. (independent attacks tend to come after you with the
same list of eassy passwords. With 10000 machines the attacker can go
far deeper into the password bag to try against you, since  the attacker
knows that machine 1265 has already tried the easy ones.

My guess is that the increase in number of attacks is linked to such
botnet behaviour. As I said only about half of the passwords are in the
pwned database, and over half are new passwords from day to day.

Back to comp.os.linux.networking | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Increased SSH breakin attempts Harold Johanssen <noemail@please.net> - 2019-04-03 20:17 +0000
  Re: Increased SSH breakin attempts Lew Pitcher <lew.pitcher@digitalfreehold.ca> - 2019-04-03 16:38 -0400
    Re: Increased SSH breakin attempts Harold Johanssen <noemail@please.net> - 2019-04-03 21:13 +0000
      Re: Increased SSH breakin attempts Grant Taylor <gtaylor@tnetconsulting.net> - 2019-04-03 15:23 -0600
    Re: Increased SSH breakin attempts "Carlos E.R." <robin_listas@es.invalid> - 2019-04-03 23:14 +0200
  Re: Increased SSH breakin attempts Dick <rsutton43@comcast.net> - 2019-04-03 17:33 -0400
    Re: Increased SSH breakin attempts Harold Johanssen <noemail@please.net> - 2019-04-03 22:01 +0000
      Re: Increased SSH breakin attempts William Unruh <unruh@invalid.ca> - 2019-04-04 00:27 +0000
        Re: Increased SSH breakin attempts Harold Johanssen <noemail@please.net> - 2019-04-04 14:02 +0000
          Re: Increased SSH breakin attempts William Unruh <unruh@invalid.ca> - 2019-04-04 18:22 +0000
            Re: Increased SSH breakin attempts Harold Johanssen <noemail@please.net> - 2019-04-04 19:15 +0000
  Re: Increased SSH breakin attempts William Unruh <unruh@invalid.ca> - 2019-04-03 21:51 +0000
    Re: Increased SSH breakin attempts Jorgen Grahn <grahn+nntp@snipabacken.se> - 2019-04-05 18:08 +0000
      Re: Increased SSH breakin attempts William Unruh <unruh@invalid.ca> - 2019-04-05 18:45 +0000
        Re: Increased SSH breakin attempts Jorgen Grahn <grahn+nntp@snipabacken.se> - 2019-04-05 22:24 +0000
        Re: Increased SSH breakin attempts Richard Kettlewell <invalid@invalid.invalid> - 2019-04-06 11:40 +0100
          Re: Increased SSH breakin attempts "Carlos E.R." <robin_listas@es.invalid> - 2019-04-06 12:53 +0200
          Re: Increased SSH breakin attempts William Unruh <unruh@invalid.ca> - 2019-04-06 18:13 +0000
            Re: Increased SSH breakin attempts "Carlos E.R." <robin_listas@es.invalid> - 2019-04-06 20:28 +0200
              Re: Increased SSH breakin attempts William Unruh <unruh@invalid.ca> - 2019-04-06 18:54 +0000
              Re: Increased SSH breakin attempts Richard Kettlewell <invalid@invalid.invalid> - 2019-04-07 08:08 +0100
                Re: Increased SSH breakin attempts William Unruh <unruh@invalid.ca> - 2019-04-07 15:43 +0000
                Re: Increased SSH breakin attempts Richard Kettlewell <invalid@invalid.invalid> - 2019-04-07 16:52 +0100

csiph-web