Feeds

Relay server attack tactic dupes auto-reporting

Nap-of-the-earth strikes on the horizon

Seven Steps to Software Security

Sysadmins have begun noticing a coordinated attack on servers with open SSH ports that tries to stay under the radar by only attempting to guess a password three times from any compromised machine. Instead of mounting an attack form a single compromised host, hackers have worked out a means to relay a brute force attack between multiple assault machines.

IT consultant and developer Nazar Aziz picked up on the attack, which started around the beginning of July, when he noticed a pattern of assaults on a small bank of dedicated Linux servers he manages. After falling victim to a hacking attack a few months back, Aziz is unusually paranoid diligent about going through system logs generated by DenyHosts, a security tool for SSH servers. This diligence allowed Aziz to detect a pattern in the attacks that most would miss.

Sysadmins often run monitoring software or intrusion detection systems that detect brute force SSH break-in attempts. But by running only three queries from each machine, that attack may go unrecorded because it falls below the detection thresholds of security software. Attempts to make more guesses would result in actions such as the blocking of an IP address and record of the attack being made.

The assault is aimed at breaking into Linux systems with easily-guessable passwords rather than exploiting any particular security vulnerability, Aziz added. It's not clear who's behind the assault, which appears to originate from a botnet network of compromised Linux boxes. Aziz explained that the assault is different from other brute force hacking attacks he's seen before.

Over time the assault has switched from SSH ports to targeting the "root" account on servers. Aziz reckons a database is being used to coordinate the attack between a relay of bots.

"This attack is different in that there appears to be a single list of usernames/passwords and a list of SSH servers to attack. Bots pick a user name and only attempt a brute force attack three times before the same server is passed along to the next bot," Aziz explained. "Since the attack is relayed to the next bot (with a different IP address) the attack in effect is continued without being detected by this method."

Aziz has written a small script that notifies the sysadmins of systems originating attack that their system may have been compromised. Sysadmins might need to get more aggressive in blocking machines in response to this change in hacker tactics, which is likely to be replicated in future attacks, he added.

More background on the attacks, and links to Aziz's tool for automatically reporting all SSH Brute Force attacks to ISPs, can be found here. ®

Mobile application security vulnerability report

More from The Register

next story
Yorkshire cops fail to grasp principle behind BT Fon Wi-Fi network
'Prevent people that are passing by to hook up to your network', pleads plod
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
NEW, SINISTER web tracking tech fingerprints your computer by making it draw
Have you been on YouPorn lately, perhaps? White House website?
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Black Hat anti-Tor talk smashed by lawyers' wrecking ball
Unmasking hidden users is too hot for Carnegie-Mellon
Attackers raid SWISS BANKS with DNS and malware bombs
'Retefe' trojan uses clever spin on old attacks to grant total control of bank accounts
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
prev story

Whitepapers

Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Reducing security risks from open source software
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.