[LUNI] New sshd attacks

[ed-luni at inkdroid.org]

On Fri, Nov 19, 2004 at 06:57:48AM -0600, Scott Zionic wrote:
> I've been seeing the same kind of cracking attempts in my sshd logs as
> everyone else for the past several months. Namely, a few lame attempts at
> logging in as guest/test/user/root/random. Last night I saw the first effort
> at a much larger attack, and I was wondering if anyone else got hit:

I didn't notice an upsurge recently--but I have noticed a steady stream
of attempts for the past month or so. The thing I find worrisome is the
source of the probe always seems to be some cable modem somewhere,
implying that there is a win* virus out there that is set up to probe ip
ranges for ssh. Does anyone know if such a virus has been identified?

//Ed