[tlug] SSH attacks continue; kiddies fighting over cracked hosts?

["Stephen J. Turnbull" <stephen@example.com>]

Thought I'd follow up as the pace of the ssh password-guessing attacks
continues to increase.

I'm now seeing from 3 to 6 attempts by unknown IPs to connect to the
ssh port per day, and what's more interesting, about every other day I
see two or more attempts from the same IP, separated by a few hours
(randomly distributed), which never used to happen (there has always
been an attack pattern consisting of two probes 3 seconds apart, but
this is different).

I wonder if the script kiddies are sharing suborned machines with the
same list of target IPs, or if (adding insult to injury), some
machines are getting cracked multiple times.

-- 
School of Systems and Information Engineering http://turnbull.sk.tsukuba.ac.jp
University of Tsukuba                    Tennodai 1-1-1 Tsukuba 305-8573 JAPAN
               Ask not how you can "do" free software business;
              ask what your business can "do for" free software.