I sent this early, but as the wrong person :).
Yes, the hardware is old and nothing more recent than that would install and run. I use VM's that had more recent versions, but I was stuck at Fedora 13 for the host hardware. I have a new system on order from Dell. When I revive the hacked system, it will still probably be running Fedora 13, but I'll use it for something else.
-Gary
On Fri, Aug 05, 2022 at 12:53:42PM -0700, Brian E. Lavender wrote:
Gary,
You were running Fedora 13?
Brian
On Fri, Aug 05, 2022 at 09:55:57AM -0700, Gary wrote:
In thinking a little more, even if they are attacking the certificate directly, it is using the user they are logging in as .ssh certificate. If that user doesn't exist, it seems that the attack should never work.
I guess I still don't understand how they got in. But, my system was rebooted. There must be more going on. They couldn't log in as root directly since I, like most of the world, have that disabled and the logs don't show that.
-Gary
On Fri, Aug 05, 2022 at 09:42:20AM -0700, Gary wrote:
Interesting. Looks like keys are a risk. But, I still don't understand, and I don't think the article was clear about, how a brute force SSH password attack is possible over my very limited network. AT&T's cheapest plan isn't a very big pipe and I use good passwords. The attacker would have to have a great deal of luck.
Since I use ssh for personal access, I'm considering looking into a firewall rule that simply walls out any IP that tries to log in with a user that isn't my account. Another thing that makes me wonder about this vector is the successful login wasn't from an account on my system.
It seems to me that the keys/certifcates are being attacked directly. I've read other articles indicating that there are attackers in the wild doing this.
So, it seems to me that eliminating key/certificate logins from outward facing systems may buy a lot of extra security. There were keys in my .ssh directory, but whether I installed them or the attacker did, is not clear. I wouldn't need them, but it is possible I could have created them at some point over the last 15 years I've been using this system :)
-Gary
On Fri, Aug 05, 2022 at 03:54:33AM -0600, Linus Sphinx wrote:
Join the club. https://www.bleepingcomputer.com/news/security/new-linux-malware-brute-force...
On Tue, Aug 2, 2022 at 12:43 PM Gary saclug@garymcglinn.com wrote:
Hi Brian,
Open letter.
I remember years ago you did a presentation on snort.
Do you still like it?
-Gary
Lug-nuts mailing list -- lug-nuts@bigbrie.com To unsubscribe send an email to lug-nuts-leave@bigbrie.com
Lug-nuts mailing list -- lug-nuts@bigbrie.com To unsubscribe send an email to lug-nuts-leave@bigbrie.com
Lug-nuts mailing list -- lug-nuts@bigbrie.com To unsubscribe send an email to lug-nuts-leave@bigbrie.com
-- Brian Lavender http://www.brie.com/brian/
"There are two ways of constructing a software design. One way is to make it so simple that there are obviously no deficiencies. And the other way is to make it so complicated that there are no obvious deficiencies."
Professor C. A. R. Hoare The 1980 Turing award lecture _______________________________________________ Lug-nuts mailing list -- lug-nuts@bigbrie.com To unsubscribe send an email to lug-nuts-leave@bigbrie.com
----- End forwarded message -----
-
saclug＠garymcglinn.com