RE: Unknown Account: 5202 Time(s), Anyone notice an increase in Illegal user attempts - GoFuckYourself.com

monaro · 07-04-2005, 03:21 AM

G'day Ladies and Gents,

Wondering if anyone is noticing an increase in login attempts a day on your servers?

Thanks

Mark

Rui · 07-04-2005, 04:01 AM

affirmative.... :S

Relish XXX · 07-04-2005, 04:04 AM

It is just kids with brute force attack sripts.

They have been doing it for years and will continue to do it even when everyone ends up with Proxy Pass installed.

HairToStay · 07-04-2005, 04:16 AM

School is out. Kids are bored. You'll notice an increase now for a few weeks, then it will die out, then pick up in the middle of September as they get into computer classes and learn how to "h4ck".

IceMaster · 07-04-2005, 04:56 AM

I had two bruteforce attempts today.

Rui · 07-04-2005, 05:02 AM

Quote:

Originally Posted by HairToStay

School is out. Kids are bored. You'll notice an increase now for a few weeks, then it will die out, then pick up in the middle of September as they get into computer classes and learn how to "h4ck".

Makes 110% sense

The Ghost · 07-04-2005, 05:07 AM

The Ghost · 07-04-2005, 05:08 AM

Quote:

Originally Posted by HairToStay

School is out. Kids are bored. You'll notice an increase now for a few weeks, then it will die out, then pick up in the middle of September as they get into computer classes and learn how to "h4ck".

Agreed... boredom is generally the cause of most destruction, where as drive and creativity can make something amazing. Except maybe the A bomb.

Kids + Boredom = Attempted Hacked Servers

chadglni · 07-04-2005, 05:10 AM

Quote:

Originally Posted by HairToStay

School is out. Kids are bored. You'll notice an increase now for a few weeks, then it will die out, then pick up in the middle of September as they get into computer classes and learn how to "h4ck".

Agreed... boredom is generally the cause of most destruction, where as drive and creativity can make something amazing. Except maybe the A bomb.

Kids + Boredom = Attempted Hacked Servers

Antonio · 07-04-2005, 07:56 AM

Quote:

Originally Posted by HairToStay

School is out. Kids are bored. You'll notice an increase now for a few weeks, then it will die out, then pick up in the middle of September as they get into computer classes and learn how to "h4ck".

Agreed... boredom is generally the cause of most destruction, where as drive and creativity can make something amazing. Except maybe the A bomb.

Kids + Boredom = Attempted Hacked Servers

TheDoc · 07-04-2005, 08:37 AM

They often hit on weekends and holidays a ton more.. They know most programs aren't watching for leaks.

Either way, yeah, we are getting attacked non stop the last few days.

justsexxx · 07-04-2005, 08:38 AM

It sucks big time. They do not get in, and we block them, but it still takes resources. Thousands of attempt a day :S

monaro · 07-11-2005, 03:09 AM

Thank you for your reply on the topic, I notice that on weekends there are more access attempts than on weekdays. I'll have to take some further measures to eliminate the potential of a server take over.

Here is a look at latest log watch;

sshd:
Invalid Users:
Unknown Account: 14975 Time(s)
Authentication Failures:
root ( blanked out ): 156 Time(s)

Thanks for your input.
Mark

hotstuff · 07-11-2005, 03:49 AM

Quote:

Originally Posted by monaro

Thank you for your reply on the topic, I notice that on weekends there are more access attempts than on weekdays. I'll have to take some further measures to eliminate the potential of a server take over.

Here is a look at latest log watch;

sshd:
Invalid Users:
Unknown Account: 14975 Time(s)
Authentication Failures:
root ( blanked out ): 156 Time(s)

Thanks for your input.
Mark

why is your ssh available for connections from random addresses? it should be acl'ed down to your mgmt ips only. it should also run on a high non-standard port, like 16283 or something similar. get a clueful server admin.

monaro · 07-13-2005, 04:10 AM

I changed the ssh & sshd thanks for your input hotstuff!
Today was good with no attempts. Looks like they are not port scanning.
I know it still dosn't make me a clueful server admin, I love the learning curve im putting myself through.

Talk again soon maybe?
Mark

SomeCreep · 07-13-2005, 04:21 AM

Quote:

Originally Posted by HairToStay

School is out. Kids are bored. You'll notice an increase now for a few weeks, then it will die out, then pick up in the middle of September as they get into computer classes and learn how to "h4ck".

Agreed... boredom is generally the cause of most destruction, where as drive and creativity can make something amazing. Except maybe the A bomb.

Kids + Boredom = Attempted Hacked Servers

07-04-2005, 03:21 AM	#1
monaro Confirmed User Join Date: Aug 2003 Location: Queensland. Posts: 968	RE: Unknown Account: 5202 Time(s), Anyone notice an increase in Illegal user attempts G'day Ladies and Gents, Wondering if anyone is noticing an increase in login attempts a day on your servers? Thanks Mark

07-04-2005, 04:04 AM	#3
Relish XXX Confirmed User Join Date: Dec 2004 Location: www.adultlabel.com Posts: 4,904	It is just kids with brute force attack sripts. They have been doing it for years and will continue to do it even when everyone ends up with Proxy Pass installed. __________________

07-04-2005, 04:16 AM	#4
HairToStay Confirmed User Join Date: Oct 2002 Location: Southcoast, Mass. Posts: 1,521	School is out. Kids are bored. You'll notice an increase now for a few weeks, then it will die out, then pick up in the middle of September as they get into computer classes and learn how to "h4ck". __________________ Make bank by giving your surfers free pics every day and it costs you NOTHING! Use POTD Sponsors to find adult sponsors in more than 75 niches who offer a POTD feature!

07-04-2005, 05:07 AM	#7
The Ghost IslandDollars.com Join Date: Oct 2004 Location: Icq: 176176 Posts: 12,188	__________________ ISLAND DOLLARS 1000's of Exclusive TS scenes / Constant Updates Best TS Network your surfers will ever join Last edited by Ghost Pro Sales; 07-04-2005 at 05:09 AM.. Reason: double post

07-04-2005, 08:37 AM	#11
TheDoc Too lazy to set a custom title Industry Role: Join Date: Jul 2001 Location: Currently Incognito Posts: 13,827	They often hit on weekends and holidays a ton more.. They know most programs aren't watching for leaks. Either way, yeah, we are getting attacked non stop the last few days. __________________ ~TheDoc - ICQ7765825 It's all disambiguation

07-04-2005, 04:01 AM	#2
Rui web Join Date: Dec 2001 Location: On icq: 85-483-060 Posts: 9,533	affirmative.... :S

07-04-2005, 04:56 AM	#5
IceMaster Confirmed User Join Date: Jan 2005 Posts: 8,920	I had two bruteforce attempts today.

07-04-2005, 08:38 AM	#12
justsexxx Too lazy to set a custom title Join Date: Aug 2001 Location: The Netherlands Posts: 13,723	It sucks big time. They do not get in, and we block them, but it still takes resources. Thousands of attempt a day :S __________________ Questions? ICQ: 125184542

07-11-2005, 03:09 AM	#13
monaro Confirmed User Join Date: Aug 2003 Location: Queensland. Posts: 968	Thank you for your reply on the topic, I notice that on weekends there are more access attempts than on weekdays. I'll have to take some further measures to eliminate the potential of a server take over. Here is a look at latest log watch; sshd: Invalid Users: Unknown Account: 14975 Time(s) Authentication Failures: root ( blanked out ): 156 Time(s) Thanks for your input. Mark

07-13-2005, 04:10 AM	#15
monaro Confirmed User Join Date: Aug 2003 Location: Queensland. Posts: 968	I changed the ssh & sshd thanks for your input hotstuff! Today was good with no attempts. Looks like they are not port scanning. I know it still dosn't make me a clueful server admin, I love the learning curve im putting myself through. Talk again soon maybe? Mark