Strange scanning on my server?

Imagen de gwolf
Submitted by gwolf on Jue, 10/01/2009 - 18:04

Humm... Has anybody else seen a pattern like this?

I am getting a flurry of root login attempts at my main server at the University since yesterday 7:30AM (GMT-5). Now, from the machines I run in the 132.248.0.0/16 network (UNAM), only two listen to the world with ssh at port 22 — And yes, it is a very large network, but I am only getting this pattern on one of them (they are on different subnets, quite far apart). They are all attempting to log in as root, with a frequency that varies wildly, but is consistently over three times a minute right now. This is a sample of what I get in my logs:

[update] Logs omitted from blog post, as it is too wide and breaks displays for most users. You can download the log file instead.

Anyway… This comes from all over the world, and all the attempts are made as root (no attempts from unprivileged users). Of course, I have PermitRootLogin to no in /etc/ssh/sshd_config, but… I want to understand this as much as possible.

Initially it struck me that most of the attempts appeared to come from Europe (quite atypical for the usual botnet distribution), so I passed my logs through:

  1. #!/usr/bin/perl
  2. use Geo::IP;
  3. use IO::File;
  4. use strict;
  5. my ($geoip, $fh, %by_ip, %by_ctry);
  6.  
  7. $fh = IO::File->new('/tmp/sshd_log');
  8. $geoip=Geo::IP->new(GEOIP_STANDARD); 
  9. while (my $lin = $fh>) { next unless $lin =~ /rhost=(\S+)/; $by_ip{$1}++}; 
  10.  
  11. print "        Incidence by IP:\n", "Num  Ctry   IP\n", ('='x60),"\n";
  12.  
  13. for my $ip ( sort {$by_ip{$a} => $by_ip{$b}} keys %by_ip) {
  14.     my $ctry = ($ip =~ /^[\d\.]+$/) ? 
  15. 	$geoip->country_code_by_addr($ip) : 
  16. 	$geoip->country_code_by_name($ip);
  17.  
  18.     $by_ctry{$ctry}++;
  19.     printf "%3d  %3s  %s\n", $by_ip{$ip}, $ctry, $ip;
  20. } 
  21.  
  22. print "        Incidence by country:\n", "Num  Country\n", "============\n";
  23. map {printf "%3d  %s\n", $by_ctry{$_}, $_}
  24.     sort {$by_ctry{$b} => $by_ctry{$a}} 
  25.     keys(%by_ctry);

The top countries (where the number of attempts ≥ 5) are:

  1. 104  CN
  2.  78  US
  3.  58  BR
  4.  49  DE
  5.  43  PL
  6.  20  ES
  7.  20  IN
  8.  19  RU
  9.  17  CO
  10.  17  UA
  11.  16  IT
  12.  13  AR
  13.  12  ZA
  14.  10  CA
  15.  10  CH
  16.   8  GB
  17.   8  AT
  18.   8  JP
  19.   8  FR
  20.   7  KR
  21.   7  HK
  22.   7  PE
  23.   7  ID
  24.   6  PT
  25.   5  CZ
  26.   5  AU
  27.   5  BE
  28.   5  SE
  29.   5  RO
  30.   5  MX

I am attaching to this post the relevant log (filtering out all the information I could regarding legitimate users) as well as the full output. In case somebody has seen this kind of wormish botnetish behaviour lately… please comment.

[Update] I have tried getting some data regarding the attacking machines, running a simple nmap -O -vv against a random sample (five machines, I hope I am not being too agressive in anybody's eyes). They all seem to be running some flavor of Linux (according to the OS fingerprinting), but the list of open ports varies wildly — I have seen the following:

  1. Not shown: 979 closed ports
  2. PORT      STATE    SERVICE
  3. 21/tcp    open     ftp
  4. 22/tcp    open     ssh
  5. 23/tcp    open     telnet
  6. 111/tcp   open     rpcbind
  7. 135/tcp   filtered msrpc
  8. 139/tcp   filtered netbios-ssn
  9. 445/tcp   filtered microsoft-ds
  10. 593/tcp   filtered http-rpc-epmap
  11. 992/tcp   open     telnets
  12. 1025/tcp  filtered NFS-or-IIS
  13. 1080/tcp  filtered socks
  14. 1433/tcp  filtered ms-sql-s
  15. 1434/tcp  filtered ms-sql-m
  16. 2049/tcp  open     nfs
  17. 4242/tcp  filtered unknown
  18. 4444/tcp  filtered krb524
  19. 6346/tcp  filtered gnutella
  20. 6881/tcp  filtered bittorrent-tracker
  21. 8888/tcp  filtered sun-answerbook
  22. 10000/tcp open     snet-sensor-mgmt
  23. 45100/tcp filtered unknown
  24. Device type: general purpose|WAP|PBX
  25. Running (JUST GUESSING) : Linux 2.6.X|2.4.X (96%), (…)
  26.  
  27.  
  28. Not shown: 993 filtered ports
  29. PORT     STATE  SERVICE
  30. 22/tcp   open   ssh
  31. 25/tcp   open   smtp
  32. 80/tcp   open   http
  33. 443/tcp  open   https
  34. 444/tcp  open   snpp
  35. 3389/tcp open   ms-term-serv
  36. 4125/tcp closed rww
  37. Device type: general purpose|phone|WAP|router
  38. Running (JUST GUESSING) : Linux 2.6.X (91%), (…)
  39.  
  40. Not shown: 994 filtered ports
  41. PORT    STATE  SERVICE
  42. 22/tcp  open   ssh
  43. 25/tcp  closed smtp
  44. 53/tcp  closed domain
  45. 80/tcp  open   http
  46. 113/tcp closed auth
  47. 443/tcp closed https
  48. Device type: general purpose
  49. Running (JUST GUESSING) : Linux 2.6.X (90%)
  50. OS fingerprint not ideal because: Didn't receive UDP response. Please try again with -sSU
  51. Aggressive OS guesses: Linux 2.6.15 - 2.6.26 (90%), Linux 2.6.23 (89%), (…)
  52.  
  53. Not shown: 982 closed ports
  54. PORT      STATE    SERVICE
  55. 21/tcp    open     ftp
  56. 22/tcp    open     ssh
  57. 37/tcp    open     time
  58. 80/tcp    open     http
  59. 113/tcp   open     auth
  60. 135/tcp   filtered msrpc
  61. 139/tcp   filtered netbios-ssn
  62. 445/tcp   filtered microsoft-ds
  63. 1025/tcp  filtered NFS-or-IIS
  64. 1080/tcp  filtered socks
  65. 1433/tcp  filtered ms-sql-s
  66. 1434/tcp  filtered ms-sql-m
  67. 4242/tcp  filtered unknown
  68. 4444/tcp  filtered krb524
  69. 6346/tcp  filtered gnutella
  70. 6881/tcp  filtered bittorrent-tracker
  71. 8888/tcp  filtered sun-answerbook
  72. 45100/tcp filtered unknown
  73. Device type: general purpose|WAP|broadband router
  74. Running (JUST GUESSING) : Linux 2.6.X|2.4.X (95%), (…)
  75.  
  76. Not shown: 994 filtered ports
  77. PORT     STATE SERVICE
  78. 22/tcp   open  ssh
  79. 25/tcp   open  smtp
  80. 53/tcp   open  domain
  81. 80/tcp   open  http
  82. 110/tcp  open  pop3
  83. 3389/tcp open  ms-term-serv
  84. Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
  85. Device type: firewall|general purpose
  86. Running: Linux 2.6.X
  87. OS details: Smoothwall firewall (Linux 2.6.16.53), Linux 2.6.13 - 2.6.24, Linux 2.6.16

Of course, it strikes me that several among said machines seem to be Linuxes, but (appear to) run Microsoft services. Oh, and they also have P2P clients.

Attachment Size
Results of parsing the logs 21.58 KB
Relevant portion of the logs 1.05 MB