Threat Level: green Handler on Duty: Rob VandenBrink

SANS ISC: Increase in ssh root access attempts - SANS Internet Storm Center SANS ISC InfoSec Forums


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Increase in ssh root access attempts

We've received a few notes today about a recent increase in attempts to log in as root via ssh.

The activity graph confirms this activity as well as another spike toward the end of last month.

If you allow remote root logins (bad!), you'll want to check your systems.

I'm sure we'll here more on this topic when port 22 is discussed for Cyber Security Awareness Month

 

Christopher Carboni - Handler On Duty

Chris

140 Posts
I've noticed this also, and it's pretty odd. Looking at my logs, I've averaged 0 ssh root access attempts per day for the past two months. On Wed there were 875, on Thurs 1789, and 456 so far today. 722 unique sources.
Anonymous

Sign Up for Free or Log In to start participating in the conversation!