SSH Attacks Observed on the Internet

SSH Attacks

This an analysis of the output of the logwatch utility running on three systems at a large university in the midwestern U.S., on a /16 (or Class B) IP address block. It just records the attempts to break in via SSH, for an arbitrarily chosen period. It ignores the constant flood of connection attempts to other commonly attacked ports (SMTP, DNS, HTTP, Windows file and print sharing, Microsoft SQL Server, etc). See http://dshield.org/ for information on the current threat environment on the Internet, and the ports commonly used in current attacks.

The following shows SSH attacks detected against three hosts. UNIX hosts with the hostnames and IP addresses of host1 and host2 have been on the net for several years. The system host3 was put on the net 15 weeks before the below data was captured. It was not attacked at all with SSH for its first three days, and then an attacker's automated scan for SSH servers detected it. Within 15 weeks it had become at least as popular a target as the others.

The following further summarizes the logwatch output to simply give counts of SSH attempts for root and non-root accounts. Note that all the systems have been configured so that even if you knew the root password you still could not login as root, see my Linux and OpenBSD hardening page for how to configure the SSH service in this safer way on any UNIX host.

Most of these seem to be password-guessing attacks. The attacks with one to three guesses per account probably try the strings "password," the login itself, and "admin". There are a few attacks listed here as a single attack against a non-root account, although they were an incomplete SSH session and did not progress to the point of an authentication failure. I think that they were probably attempts to exploit a vulnerability in the SSH protocol itself, looking for systems with known buggy implementations of SSH. For example, the only attack on June 22, the attacks from Slovenia on June 23, and the attacks from Manchester NH and Amsterdam on June 25.

June 20

mail.utsz.edu.cn launched what I call the "Patrick Attack". It goes through all the IP addresses in a range, trying to guess passwords for these accounts in this order: patrick, rolo, iceuser, horde, cyrus, www, wwwrun, matt, test, www-data, mysql, irc, jane, pamela, cosmin, cip52, cip51, noc, webmaster, data, user, web, oracle, sybase, master, account, backup, server, adam, alan, frank, george, henry, john, test

June 21

Identical attacks on host1 and host2, a similar but less aggressive one on host3.

June 22

An unusually light day! Just one probe looking for vulnerable SSH server software.

June 23

Four nearly identical attacks, plus a probe for a vulnerable SSH version to just one host.

June 24

Three identical simple attacks from Telmex Chile: two guesses each for users admin and test, one guess each for users guest and user, and three for root. The non-root ones were tried in the order: test, guest, admin, admin, user, test. This attack is seen frequently, see all the instances of 3 against root and 6 against other accounts.

The attack from the Kantana Group in Bangkok guessed one password each for these accounts in this order: staff, sales, recruit, alias, office, samba, tomcat, webadmin, spam, virus, cyrus, oracle, michael.

June 25

The machine cdn-proxy-al1-1.opb.interbusiness.it reappears, but this time it is using an attack very different from that of two days ago. This time its attack is essentially identical to that from zenonxp.wdcb.ru and makes one password guess each for a large number of user accounts with American English names (adam, alan, alex, amanda, angel, brett, dan, danny, david, dean, divine, frank, ....) and expected system accounts (admin, administrator, admins, agent, alias, amavisd, apache, appowner, appserver, aptproxy, backup ....)

The five attacks on host1 and host2 were identical.

The attacks on host3 were identical (from 203.129.81.200) or very similar (from zenonxp.wdcb.ru and cdn-proxy-al1-1.opb.interbusiness.it).

June 26

The attack from 211.101.4.64 was what I call the "A's and Aaliyah" attack, as it guesses passwords for a bunch of accounts including aa, aaa, aaaa, aaaaa, aaaaaa, aaliyah, aaron, ab, aba, abc, abel, abuse, academy, ace, achim, ada, adabas, ...

The attack from 58.241.118.114 was the same as that from Telmex Chile two days before.

The attack from the Korean Youth League In Japan machine guessed one password each for these accounts in this order: staff, sales, recruit, alias, office, samba, tomcat, webadmin, spam, virus, cyrus, oracle. Just like the attack on June 24 from Bangkok, except it did not try the account michael.

June 27

Four identical attacks on host1 and host2.

The attacks from 221.195.33.92 were very slightly different against host3 than against host1 and host2.

The attacks from 221.10.254.205 were identical on all three hosts.

June 28

Another machine from the Development Research Center of State Council Net! This attacker is at 211.167.89.99, the from five days ago was at 211.167.66.71.

The machine from Hebei Province, China reappears for another attack on host3 only.

June 29

An unusually quiet day!

June 30

The attack from Shandong Province, China was a new one in this list. Against host1, the non-root accounts attacked were test (15 password guesses), tester (15 password guesses), and testing (7 password guesses). Plus, reasonably aggressive root password guessing.

Against host2, just 13 password guesses for test.

July 1

The attack from Prague made 1 password guess each for 27 to 2571 accounts. I don't recognize the assumed nationality of the names: adele, adelia, ademia, adena, adeola, aderes, aderyn, adesina, adhira, adiba, adie, adila, adina, adishree, aditi, adolfina, adolpha, adoncia, adriana, adriane, adrianne, adrienne, aduke, adzo, afric, africa, afton, agalia, agape, agapi, agata, agatha, aglaia, ahava, ahawi, ahmya, ahneta, aiko, ailis, aine, aisha, aisling, akasma, aki, akilah, albertine, albina, alda, aldora, aleah, alecia, aleeza, alesa, alesia, alhena, alicia ...

July 2

The attack from Japan's national research institute at Tskuba was the most aggressive seen so far. It very unusually included attacks against one numeric login and 13 mixed-case logins, something not usually found in UNIX: 00089, Aaliyah, Aaron, Aba, Abel, Access, DTM, Exit, Ionut, Jewel, ROOT, Where, Yon-Sun, Zmeu.

It then started through an alphabetical list: a, aa, aage, aaron, aartjan, abacus, abbas, abbess, abbot, abigail, ablazed, abode, ... So although Aaliyah shows up, this attack differs from what I called "A's and Aaliyah" above.