Re: [ml] worm ssh o che altro [was: worm o che altro?]

Il gio, 2004-09-16 alle 23:23, Igor Falcomata' ha scritto:
> Riconducibile   a    http://www.sikurezza.org/ml/08_04/msg00002.html   o
> simile, cosi' a naso.. chi ha migliori info, posti pure.
> 
> bye
> Koba (moderatore)
> 
> ----- Forwarded message from ml-owner(at)sikurezza.org -----
> Date: Tue, 14 Sep 2004 09:18:22 +0200
> From: Buttha <buttha(at)e-0.org>
> Subject: worm o che altro?
> 
> E' da qualche mese che, ogni giorno, ricevo stupidi tentativi di login 
> su sshd:
> 
> Failed logins from these:
>    admin/password from 203.72.xxx.xxx: 2 Time(s)
>    guest/password from 203.72.xxx.xxx: 1 Time(s)
>    root/password from 203.72.xxx.xxx: 3 Time(s)
>    test/password from 203.72.xxx.xxx: 2 Time(s)
>    user/password from 203.72.xxx.xxx: 1 Time(s)
> 
> Illegal users from these:
>    admin/none from 203.72.xxx.xxx: 2 Time(s)
>    admin/password from 203.72.xxx.xxx: 2 Time(s)
>    guest/none from 203.72.xxx.xxx: 1 Time(s)
>    guest/password from 203.72.xxx.xxx: 1 Time(s)
>    test/none from 203.72.xxx.xxx: 2 Time(s)
>    test/password from 203.72.xxx.xxx: 2 Time(s)
>    user/none from 203.72.xxx.xxx: 1 Time(s)
>    user/password from 203.72.xxx.xxx: 1 Time(s)
> 
> l'IP puo' variare:
> 
> [root@e-0 root]# grep Illegal\ user /var/log/secure | cut -d \  -f 10 | 
> sort | uniq
> 203.204.xxx.xxx
> 203.72.xxx.xxx
> 203.73.xxx.xxx
> 209.172.xxx.xxx
> 211.20.xxx.xxx
> 212.48.xxx.xxx
> 62.193.xxx.xxx
> 
E' apparsa una nota esplicatica su
http://www.securityfocus.com/archive/75/374830

-- 
saluti
Mirko