Threat Level: green Handler on Duty: Brad Duncan

SANS ISC: Increase in ssh root access attempts SANS ISC InfoSec Forums

Watch ISC TV. Great for NOCs, SOCs and Living Rooms: https://isctv.sans.edu

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Increase in ssh root access attempts

We've received a few notes today about a recent increase in attempts to log in as root via ssh.

The activity graph confirms this activity as well as another spike toward the end of last month.

If you allow remote root logins (bad!), you'll want to check your systems.

I'm sure we'll here more on this topic when port 22 is discussed for Cyber Security Awareness Month

 

Christopher Carboni - Handler On Duty

Chris

140 Posts
I've noticed this also, and it's pretty odd. Looking at my logs, I've averaged 0 ssh root access attempts per day for the past two months. On Wed there were 875, on Thurs 1789, and 456 so far today. 722 unique sources.
Anonymous

Sign Up for Free or Log In to start participating in the conversation!