Aug 24 2004
The source of the SSH Brute Force Hacks
K-OTik : SSH Brute Force Exploit SSH Remote BruteForce Dictionary exploit
Thanks to a member of the Snort-Sigs mailing list, I finally know where all the SSH attempts I’ve been seeing lately are coming from. Or at least what tool is being used to scan my system.
The tool is looking for the users test, guest, admin, user or root. For the first four accounts it’s just looking for a few passwords, but for root, it’s trying around 1500 different passwords, all of which are passwords you shouldn’t be using for root in the first place.
If you allow root login to your SSH server, bad admin! Login as a regular user, then su to root. This is the sort of exploit that’s just looking for poorly administrated servers. If you know enough to set up SSH in the first place, you should know enough to protect yourself from this exploit.