Threat Level: green Handler on Duty: Johannes Ullrich

SANS ISC: InfoSec Handlers Diary Blog - Dense Distributed SSH bruteforce attempts InfoSec Handlers Diary Blog

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

Dense Distributed SSH bruteforce attempts

Published: 2008-02-29
Last Updated: 2008-02-29 22:58:44 UTC
by donald smith (Version: 2)
4 comment(s)

A contributor (Ben) wrote in with an unusually dense distributed ssh scan.

“We noticed an interesting ssh probe attempt today.
In order to prevent iptables blocking based on the number of probes per
minute, each address in an entire Class C block generated only one or
two probes SSH each. These probes all came from”

Based on the information Ben shared with us it appeared to come from
most of the ips in a /24 cidr block. The last octet is fairly random.
There is some clustering such as a "run" of 200's but that could still
be psuedo random. So who owns that cidr block?

Whois data copyright terms
inetnum: -
netname: TTTNET
descr: Maxnet, Internet Service Provider, Bangkok
descr: under management by TT&T co,.ltd Thailand
country: TH
address: 252/30 Muang Thai Phatra Complex Tower 1, 22nd Fl., Ratchadaphisek
Rd.,Huaykwang, Bangkok 10320 Thailand
phone: +66-2-693-2100
fax-no: +66-2-693-2100
country: TH
changed: 20060410
mnt-by: MAINT-NEW
source: APNIC

 Traceroute shows them near singapore so Thailand is reasonable.

Tracing route to []
over a maximum of 30 hops:
1 2 ms 1 ms 1 ms
13 332 ms 334 ms 336 ms []
14 353 ms 356 ms 512 ms []
15 393 ms 368 ms 334 ms []
16 337 ms 339 ms 339 ms []
17 341 ms 340 ms 338 ms []
18 [] reports: Destination host
I seem to be the handler who gets the distributed ssh scan reports.
I wrote a diary about a some seen last year that appeared to be
distributed and coordinated (share a dictionary across multiple hosts)

Jim Owens and  Jeanna Matthews of Clarkson Univ. reported on a similar,
though somewhat cruder attack in a paper they recently submitted to Usenix LEET '08.

4 comment(s)
Diary Archives