3 ms·
What SSH brute force attackers do after they get in to your server
- ChuckMcM 11y agoone of the things you can do (and I did) is to mess with brute forcers by sending a malformed response packet to the password attempt. Basically my goal was to crash their ssh client using a buffer overflow exploit. So on my honeypot when I got an SSH attempt I sent back a response packet that I morphed each time in an attempt to genetically engineer a killer packet. In my case the clients always seemed to make 5 requests in a row. So I used the time between the previous request and the current request as a fitness function for my genetic mutations. (longer delays was a better mutation). I eventually got them to stop after one request with a response that was a bit over 9K in length. After that worked I got a giant DDoS attack sent my way so I figured it was 'message recieved' :-). These days I just put ssh on a different port and fail2ban IPs (simpler and doesn't poke the troll :-)
- dirtyaura 11y agoAwesome story! I can imagine that if you start to fight back, people running bot network take it as a challenge. By the way, what do you see as the benefit of putting ssh to a different port? To cut down noise? I used to do that, but as they are scanning ports anyway, it seems better idea to just focus on honing fail2ban rules.