TCSOTD 2007-10-23
‘They are advertising vibrating cock rings on Channel Four.’
Network Monitoring Appliance Looks Below 1 Microsecond
A fun new Quirkology video: The Prediction
Viacom puts Eight Year Daily Show archive online
Law Firm Claims Copyright on View of HTML Source
SSH attackers now using botnets

I’m used to seeing ssh dictionary attacks from single IPs, hitting my servers in a short amount of time. For the first time today, however, I have had entries like the following:
Oct 22 15:05:54 [sshd] error: PAM: Authentication failure for root from <hostname>
...fairly regularly spaced throughout the day, all from different hosts. The natural assumption is that the dictionary attacks are now being run from botnets.
Anyone else seeing these? In the past when noticing dictionary attacks I’ve blocked the source IP; that now seems a little harsh for hosts that are being used without their owners’ consent. If a lot of people did that it may encourage the owners to take more notice of their security, but such a draconian measure would require a large amount of people to take part in order for it to be effective.
A DNSBL for firewalls would be a possible solution, although there would have to be a way of notifying people the reason they can’t connect to a particular host.
TCSOTD 2007-10-22
Society of Homeopaths pulls an Usmanov
Bloodspell: a feature-length Machinima animated film
... based on the Neverwinter Nights graphics engine
TCSOTD 2007-10-19
Older posts: 1 2