13 Dec
2004
13 Dec
'04
11:25 a.m.
On Tue, 2004-12-14 at 18:48 +1300, Philip D'Ath wrote:
We are getting lots of requests at the moment trying to log into one of our box's via SSH. It happens in 20 minute bursts, with a new request being tried every 6s. After the 20 minutes it goes away for 8 hours.
Yup, there are several scripts available for brute forcing ssh logins, these attacks have been prevalent for several months now. The attacking host is almost certainly compromised so if it belongs to someone with obvious contact info then drop them a note and do the rest of the 'Net a favour! -- Russell Fulton, Information Security Officer, The University of Auckland New Zealand