4 ms·
> beyond the (presumably failed) login attempt There is some evidence it's scrubbing logs so we might not even have that.
by ghostpepper 3y ago
> beyond the (presumably failed) login attempt
There is some evidence it's scrubbing logs so we might not even have that.
- Deathcrow 3y agoIs there really a failed login attempts? If it never calls the real functions of ssh in case of their own cert+payload why would sshd log anything or even register a login attempt? Or does the backdoor function hook in after sshd already logged stuff?
- numpad0 3y agoDepending on log level, isn't there going to be lines up to receiving the payload?
- skywhopper 3y agoI think it would depend on logging level, yeah. I’ve not seen one way or another whether it aborts the login process or prevents logging, but that’s possible, and would obviously be a good idea. Then the question would be if you could detect the difference between a vulnerability-aborted login attempt and just a malformed/interrupted login attempt. But in the case of this specific attack, probably the safest approach would be to watch and track what processes are being spawned by sshd. Which in retrospect is probably advisable for any network daemon. (Of course, lots of them will be sloppy and messy with how they interact with the system and it might be next to impossible to tell attacks from “legit” behavior. But sshd is probably easier to pin down to what’s “safe” or not.