Brute Force Attacks on SSH

Computer researchers at Clarkson University have provided a little more light into an adaptation of the classic brute-force attack on authentication. Many UNIX systems are considered secure because previously accessible ports and weaknesses are now hidden behind SSH tunnels. As the prevalence of SSH servers has risen, they have become more lucrative than ever for hackers to penetrate. The classic brute-force attack was relatively easy for a prudent administrator to counter, however, BOTnets allow a new technique called "slow-motion brute-force" whereupon the attack is spread across time and IP space making the attack much harder to detect. Owens' research shows the BOTnets still employ the typical popular username/password combinations in addition to what seemed to be a common dictionary list. Their conclusions include the typical good user policies and strong password enforcement but do raise the issue that many IDS configurations would miss the distributed attack.

Star This to Save in Your Profile