Relay server attack tactic dupes auto-reporting

July 21, 2008 – 6:53 AM

Sysadmins have begun noticing a coordinated attack on servers with open SSH ports that tries to stay under the radar by only attempting to guess a password three times from any compromised machine. Instead of mounting an attack form a single compromised host, hackers have worked out a means to relay a brute force attack between multiple assault machines.

IT consultant and developer Nazar Aziz picked up on the attack, which started around the beginning of July, when he noticed a pattern of assaults on a small bank of dedicated Linux servers he manages. After falling victim to a hacking attack a few months back, Aziz is unusually paranoid diligent about going through system logs generated by DenyHosts, a security tool for SSH servers. This diligence allowed Aziz to detect a pattern in the attacks that most would miss.

Sysadmins often run monitoring software or intrusion detection systems that detect brute force SSH break-in attempts. But by running only three queries from each machine, that attack may go unrecorded because it falls below the detection thresholds of security software. Attempts to make more guesses would result in actions such as the blocking of an IP address and record of the attack being made.

The assault is aimed at breaking into Linux systems with easily-guessable passwords rather than exploiting any particular security vulnerability, Aziz added. It’s not clear who’s behind the assault, which appears to originate from a botnet network of compromised Linux boxes. Aziz explained that the assault is different from other brute force hacking attacks he’s seen before.

Source:
http://www.channelregister.co.uk/2008/07/14/brute_force_ssh_attack/