Diaries by Keyword - SANS Internet Storm Center

Watch ISC TV. Great for NOCs, SOCs and Living Rooms: https://isctv.sans.edu

Handler on Duty: Jesse La Grew

Threat Level: green

Date	Author	Title
DISTRIBUTED SSH BRUTE FORCE ATTEMPTS
2010-06-18	Adrien de Beaupre	Distributed SSH Brute Force Attempts on the rise again
DISTRIBUTED
2010-06-18/a>	Adrien de Beaupre	Distributed SSH Brute Force Attempts on the rise again
2008-10-02/a>	Kyle Haugsness	Low, slow, distributed SSH username brute forcing
SSH
2024-04-01/a>	Bojan Zdrnja	The amazingly scary xz sshd backdoor
2024-01-02/a>	Johannes Ullrich	Fingerprinting SSH Identification Strings
2022-12-03/a>	Guy Bruneau	Linux LOLBins Applications Available in Windows
2022-07-23/a>	Guy Bruneau	Analysis of SSH Honeypot Data with PowerBI
2022-02-01/a>	Xavier Mertens	Automation is Nice But Don't Replace Your Knowledge
2022-01-16/a>	Guy Bruneau	10 Most Popular Targeted Ports in the Past 3 Weeks
2021-11-08/a>	Xavier Mertens	(Ab)Using Security Tools & Controls for the Bad
2021-10-14/a>	Xavier Mertens	Port-Forwarding with Windows for the Win
2020-07-21/a>	Jan Kopriva	Couple of interesting Covid-19 related stats
2020-03-02/a>	Jan Kopriva	Secure vs. cleartext protocols - couple of interesting stats
2019-03-09/a>	Guy Bruneau	A Comparison Study of SSH Port Activity - TCP 22 & 2222
2018-11-07/a>	Bojan Zdrnja	Tunneling scanners (or really anything) over SSH
2018-08-20/a>	Didier Stevens	OpenSSH user enumeration (CVE-2018-15473)
2018-01-07/a>	Guy Bruneau	SSH Scans by Clients Types
2017-11-01/a>	Rob VandenBrink	Securing SSH Services - Go Blue Team!!
2016-03-15/a>	Xavier Mertens	Dockerized DShield SSH Honeypot
2016-03-13/a>	Xavier Mertens	SSH Honeypots (Ab)used as Proxy
2016-01-21/a>	Jim Clausing	Scanning for Fortinet ssh backdoor
2015-06-23/a>	Kevin Shortt	XOR DDOS Mitigation and Analysis
2015-04-03/a>	Didier Stevens	SSH Fingerprints Are Important
2014-07-23/a>	Johannes Ullrich	New Feature: "Live" SSH Brute Force Logs and New Kippo Client
2014-07-02/a>	Johannes Ullrich	Cisco Unified Communications Domain Manager Update
2014-06-11/a>	Daniel Wesemann	Gimme your keys!
2014-01-20/a>	Rob VandenBrink	You Can Run, but You Can't Hide (SSH and other open services)
2013-12-20/a>	Daniel Wesemann	authorized key lime pie
2013-12-02/a>	Richard Porter	Reports of higher than normal SSH Attacks
2013-11-11/a>	Johannes Ullrich	OpenSSH Vulnerability
2013-10-10/a>	Mark Hofman	CSAM Some more unusual scans
2013-06-23/a>	Kevin Liston	Is SSH no more secure than telnet?
2013-02-21/a>	Bojan Zdrnja	SSHD rootkit in the wild
2013-01-26/a>	Scott Fendley	Blocking SSH to Limit Security Exposures
2012-12-27/a>	John Bambenek	It's 3pm 2 days after Christmas, do you know where your unmanaged SSH keys are?
2012-12-16/a>	Tony Carothers	SSH Brute Force on Non-Standard Ports
2012-12-03/a>	Kevin Liston	Recent SSH vulnerabilities
2012-06-12/a>	Swa Frantzen	F5 ssh configuration goof
2011-12-04/a>	Guy Bruneau	SSH Password Brute Forcing may be on the Rise
2011-11-06/a>	Tom Liston	New, odd SSH brute force behavior
2011-09-15/a>	Johannes Ullrich	SSH Vandals?
2011-08-02/a>	Mark Hofman	SSH Brute Force attacks
2011-07-31/a>	Daniel Wesemann	Anatomy of a Unix breach
2011-07-17/a>	Mark Hofman	SSH Brute Force
2011-03-07/a>	Johannes Ullrich	Outbound SSH Traffic from HP Virtual Connect Blades
2011-02-05/a>	Guy Bruneau	OpenSSH Legacy Certificate Information Disclosure Vulnerability
2010-09-07/a>	Bojan Zdrnja	SSH password authentication insight and analysis by DRG
2010-08-10/a>	Daniel Wesemann	Protect your privates!
2010-08-10/a>	Daniel Wesemann	SSH - new brute force tool?
2010-06-18/a>	Adrien de Beaupre	Distributed SSH Brute Force Attempts on the rise again
2010-06-18/a>	Tom Liston	IMPORTANT INFORMATION: Distributed SSH Brute Force Attacks
2010-01-18/a>	Stephen Hall	Uplift in SSH brute forcing attacks
2010-01-01/a>	G. N. White	Dealing With Unwanted SSH Bruteforcing
2009-10-17/a>	Rick Wanner	Cyber Security Awareness Month - Day 17 - Port 22/SSH
2009-10-02/a>	Stephen Hall	New version of OpenSSH released
2009-07-09/a>	Bojan Zdrnja	OpenSSH 0day FUD
2009-07-07/a>	Marcus Sachs	OpenSSH Rumors
2009-04-17/a>	Daniel Wesemann	Guess what? SSH again!
2009-04-07/a>	Johannes Ullrich	SSH scanning from compromised mail servers
2009-03-30/a>	Daniel Wesemann	Watch your Internet routers!
2008-10-02/a>	Kyle Haugsness	Low, slow, distributed SSH username brute forcing
2008-08-26/a>	John Bambenek	Active attacks using stolen SSH keys (UPDATED)
2008-06-09/a>	Scott Fendley	So Where Are Those OpenSSH Key-based Attacks?
2008-05-16/a>	Daniel Wesemann	INFOcon back to green
2008-05-15/a>	Bojan Zdrnja	Debian and Ubuntu users: fix your keys/certificates NOW
2008-05-15/a>	Bojan Zdrnja	INFOCon yellow: update your Debian generated keys/certs ASAP
2008-05-13/a>	Swa Frantzen	OpenSSH: Predictable PRNG in debian and ubuntu Linux
2008-05-12/a>	Scott Fendley	Brute-force SSH Attacks on the Rise
2006-10-03/a>	Swa Frantzen	Detecting attacks against servers
BRUTE
2021-05-07/a>	Daniel Wesemann	Exposed Azure Storage Containers
2018-01-09/a>	Jim Clausing	Are you watching for brute force attacks on IPv6?
2017-08-07/a>	Xavier Mertens	Increase of phpMyAdmin scans
2017-04-26/a>	Johannes Ullrich	If there are some unexploited MSSQL Servers With Weak Passwords Left: They got you now (again)
2015-06-23/a>	Kevin Shortt	XOR DDOS Mitigation and Analysis
2015-06-22/a>	Johannes Ullrich	SMTP Brute Forcing
2014-09-07/a>	Johannes Ullrich	Odd Persistent Password Bruteforcing
2014-07-23/a>	Johannes Ullrich	New Feature: "Live" SSH Brute Force Logs and New Kippo Client
2014-07-22/a>	Daniel Wesemann	WordPress brute force attack via wp.getUsersBlogs
2013-12-02/a>	Richard Porter	Reports of higher than normal SSH Attacks
2013-07-31/a>	Johannes Ullrich	POP3 Server Brute Forcing Attempts Using Polycom Credentials
2013-06-23/a>	Kevin Liston	Is SSH no more secure than telnet?
2012-12-16/a>	Tony Carothers	SSH Brute Force on Non-Standard Ports
2011-12-04/a>	Guy Bruneau	SSH Password Brute Forcing may be on the Rise
2011-11-06/a>	Tom Liston	New, odd SSH brute force behavior
2011-08-02/a>	Mark Hofman	SSH Brute Force attacks
2011-07-31/a>	Daniel Wesemann	Anatomy of a Unix breach
2011-07-17/a>	Mark Hofman	SSH Brute Force
2010-09-07/a>	Bojan Zdrnja	SSH password authentication insight and analysis by DRG
2010-08-27/a>	Mark Hofman	FTP Brute Password guessing attacks
2010-06-18/a>	Adrien de Beaupre	Distributed SSH Brute Force Attempts on the rise again
2010-06-18/a>	Tom Liston	IMPORTANT INFORMATION: Distributed SSH Brute Force Attacks
2010-01-01/a>	G. N. White	Dealing With Unwanted SSH Bruteforcing
2009-11-30/a>	Bojan Zdrnja	Distributed Wordpress admin account cracking
2009-04-17/a>	Daniel Wesemann	Guess what? SSH again!
2009-03-30/a>	Daniel Wesemann	Watch your Internet routers!
2009-01-30/a>	Mark Hofman	Request for info - Scan and webmail
2008-10-02/a>	Kyle Haugsness	Low, slow, distributed SSH username brute forcing
2008-06-09/a>	Scott Fendley	So Where Are Those OpenSSH Key-based Attacks?
2008-05-12/a>	Scott Fendley	Brute-force SSH Attacks on the Rise
FORCE
2021-05-07/a>	Daniel Wesemann	Exposed Azure Storage Containers
2018-01-09/a>	Jim Clausing	Are you watching for brute force attacks on IPv6?
2017-08-07/a>	Xavier Mertens	Increase of phpMyAdmin scans
2017-04-26/a>	Johannes Ullrich	If there are some unexploited MSSQL Servers With Weak Passwords Left: They got you now (again)
2015-06-23/a>	Kevin Shortt	XOR DDOS Mitigation and Analysis
2014-09-07/a>	Johannes Ullrich	Odd Persistent Password Bruteforcing
2014-07-22/a>	Daniel Wesemann	WordPress brute force attack via wp.getUsersBlogs
2013-12-02/a>	Richard Porter	Reports of higher than normal SSH Attacks
2013-06-23/a>	Kevin Liston	Is SSH no more secure than telnet?
2012-12-16/a>	Tony Carothers	SSH Brute Force on Non-Standard Ports
2011-12-04/a>	Guy Bruneau	SSH Password Brute Forcing may be on the Rise
2011-11-06/a>	Tom Liston	New, odd SSH brute force behavior
2011-08-02/a>	Mark Hofman	SSH Brute Force attacks
2011-07-31/a>	Daniel Wesemann	Anatomy of a Unix breach
2011-07-17/a>	Mark Hofman	SSH Brute Force
2010-09-07/a>	Bojan Zdrnja	SSH password authentication insight and analysis by DRG
2010-06-18/a>	Adrien de Beaupre	Distributed SSH Brute Force Attempts on the rise again
2010-06-18/a>	Tom Liston	IMPORTANT INFORMATION: Distributed SSH Brute Force Attacks
2010-01-23/a>	Lorna Hutcheson	The necessary evils: Policies, Processes and Procedures
2010-01-01/a>	G. N. White	Dealing With Unwanted SSH Bruteforcing
2009-11-30/a>	Bojan Zdrnja	Distributed Wordpress admin account cracking
2009-04-17/a>	Daniel Wesemann	Guess what? SSH again!
2009-03-30/a>	Daniel Wesemann	Watch your Internet routers!
2009-01-30/a>	Mark Hofman	Request for info - Scan and webmail
2008-10-02/a>	Kyle Haugsness	Low, slow, distributed SSH username brute forcing
2008-06-09/a>	Scott Fendley	So Where Are Those OpenSSH Key-based Attacks?
2008-05-12/a>	Scott Fendley	Brute-force SSH Attacks on the Rise
ATTEMPTS
2010-06-18/a>	Adrien de Beaupre	Distributed SSH Brute Force Attempts on the rise again

DISTRIBUTED SSH BRUTE FORCE ATTEMPTS

DISTRIBUTED

SSH

BRUTE

FORCE

ATTEMPTS