Relay server attack tactic dupes auto-reporting
Nap-of-the-earth strikes on the horizon
Regcast training : Hyper-V 3.0, VM high availability and disaster recovery
Sysadmins have begun noticing a coordinated attack on servers with open SSH ports that tries to stay under the radar by only attempting to guess a password three times from any compromised machine. Instead of mounting an attack form a single compromised host, hackers have worked out a means to relay a brute force attack between multiple assault machines.
IT consultant and developer Nazar Aziz picked up on the attack, which started around the beginning of July, when he noticed a pattern of assaults on a small bank of dedicated Linux servers he manages. After falling victim to a hacking attack a few months back, Aziz is unusually paranoid diligent about going through system logs generated by DenyHosts, a security tool for SSH servers. This diligence allowed Aziz to detect a pattern in the attacks that most would miss.
Sysadmins often run monitoring software or intrusion detection systems that detect brute force SSH break-in attempts. But by running only three queries from each machine, that attack may go unrecorded because it falls below the detection thresholds of security software. Attempts to make more guesses would result in actions such as the blocking of an IP address and record of the attack being made.
The assault is aimed at breaking into Linux systems with easily-guessable passwords rather than exploiting any particular security vulnerability, Aziz added. It's not clear who's behind the assault, which appears to originate from a botnet network of compromised Linux boxes. Aziz explained that the assault is different from other brute force hacking attacks he's seen before.
Over time the assault has switched from SSH ports to targeting the "root" account on servers. Aziz reckons a database is being used to coordinate the attack between a relay of bots.
"This attack is different in that there appears to be a single list of usernames/passwords and a list of SSH servers to attack. Bots pick a user name and only attempt a brute force attack three times before the same server is passed along to the next bot," Aziz explained. "Since the attack is relayed to the next bot (with a different IP address) the attack in effect is continued without being detected by this method."
Aziz has written a small script that notifies the sysadmins of systems originating attack that their system may have been compromised. Sysadmins might need to get more aggressive in blocking machines in response to this change in hacker tactics, which is likely to be replicated in future attacks, he added.
More background on the attacks, and links to Aziz's tool for automatically reporting all SSH Brute Force attacks to ISPs, can be found here. ®
COMMENTS
Why leave the port open?
I never understood why people leave the ssh port open. Close it, and implement knock, or something stronger.
If you have NO ssh ports open, you will get NO brute force attacks.
I got tired of checking my logs for brute force attacks. Now they are zero. I can get in with a simple knock, and ssh into a non-standard port.
Much better off...
You're much better off using key based authentication, its seamless, easier to use, and much more secure.
PermitRootLogin should be off too,
IT infrastructure monitoring strategies
Agentless Backup is Not a Myth
Top 10 SIEM implementer’s checklist
Steps to Take Before Choosing a Business Continuity Partner
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
