Re: [Full-Disclosure] Automated SSH login attempts?

[Juan Carlos Navea <loconet@xxxxxxxxx>]

One of the boxes at work actually got rooted through a successful
attempt at the account test. They later proceeded to get root through
a local exploit. This box was badly unpdated.

log entries..

Jul 12 22:26:51 server sshd[12868]: Accepted password for test from
130.15.15.239 port 1954 ssh2
Jul 12 22:42:35 server sshd[13998]: Accepted password for test from
216.55.164.10 port 56454 ssh2

...

These were followed by more attempts at users test/guest/admin/root

Our ISP shut us down as some other admins reported that this box was
now attempting brute force logins on other boxes within the same
network space. This actually included one of our other boxes which
luckly was not rooted.

Anyways, once we managed to bring our box back up we noticed that
after the successful login, it proceeded to install a rootkit. In this
case we detected SuckIt.

After various attempts, we were able to remove SuckIt:

[root@server .sk12]# ./sk u
/dev/null
Detected version: 1.3b
Suckit uninstalled sucesfully!

As usual for this rootkit, it had installed an exploited sshd , a
password sniffer and infected initd and telinetd.

More info on sk:
»www.phrack.org/show.php?p=58&a=7

Up to this day, we get atleast 10 brute force attempts a day on most
of our boxes.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html