An analysis of ssh bruteforce attacks

I’ve been running my home server with fail2ban for quite some time, and it works great! So well that usually, there’s no need to think about the fact that it’s constantly under attack from around the globe (the internet is weird). Occasionally it’s fun to take a peek at the logs and see what sorts of things the ssh bruteforce attackers are trying. It looks like they’ve picked up some new tricks since the last time I checked…

Weaker ciphers

Some connections are attempted using weak cyphers - specifically the “CBC” set:

Unable to negotiate with x.x.x.x: no matching cipher found. Their offer: aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,arcfour128,arcfour,3des-cbc,none [preauth]

OWASP says this in their cheat sheet:

Favor GCM over CBC regardless of the cipher size.

So, either these attackers are using a really old SSH client, or they’re trying to negotiate a weaker connection which can then be further exploited. Either way, my server is giving them a big old “nope”.

key-based logins

This one did surprise me - I haven’t seen bruteforce attacks using keys before. Apparently it’s a new tactic in the past year or so, where they scan for compromised keys then use them to try logging in to other systems.

Unable to negotiate with x.x.x.x: no matching host key type found. Their offer: ssh-dss [preauth]

Additionally, these keys tend to be using older crypto schemes:

Starting with the 7.0 release of OpenSSH, support for ssh-dss keys has been disabled by default at runtime due to their inherit weakness

Plain old password attempts

The bulk of the attacks are still plain old bruteforce login attempts. The top targets are common system accounts. This list tells me that there’s a decent number of unsecured raspberry pis out there.

 admin
 pi
 RPM
 test
 ubuntu

Service accounts

There’s a smaller number of attempts on service accounts, but they’re spread out over many different usernames.

 postgres
 mysql
 oracle
 PlcmSpIp
 cron
 ftp
 media
 nagios
 scan

And so on.

Mis-targetted?

I’m not sure what’s up with this one - it was tried repeatedly. It seems awfully specific.

  7 rjconsultores

Game servers

It’s not surprising that there would be poorly-secured game servers kicking around. Apparently enough to make these worthwhile:

  1 csgoserver
  1 minecraft

Bitcoin?

Either this is a one-off username from their lists, or some people out there are running unsecured bitcoin servers.

  1 coinery

Obscurity

This set look like some well-known “security through obscurity” usernames. I remember seeing this as actual advice, once upon a time.

  1 r00t

They didn’t try toor though - I guess that one’s still safe (/sarcasm)

Way too obvious

Seriously? That would just be baby-town frolics.

  1 guest

They may need better QA…

These look like bugs in their scripts/data. I could recommend some good testing tools. laughing

  2 mailto
  2 username
  1 account

The rest

These are mainly people’s names. I expect there would be a lot more in here, except that fail2ban prevents most of the attempts. Some of the more interesting ones:

  butter
  master
  seller
  shop
  sierra
  stacey
  tech
  techno

In Summary…

Ssh bruteforce attacks have gotten somewhat more sophisticated, but the basic pattern is still the same, and running fail2ban is still critical.