Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 1 down vote favorite
1

this forum has been brilliant so far. Just wondering if I can get a bit more help:

Can I get some info on a large amount of SSH brute force attacks originating from port 11 on the external host over the past 1 month

Now I know that port number can be faked, but if it isn't, what possibly could be causing this? I've looked for some tools that use port 11, but no joy

If you have any ideas on what it is, or how I can get more info, I'll be extremely grateful

share|improve this question
Can you be more specific about "SSH brute force attacks originating from port 11"? Do you have example log entries, are there patterns in the attacks, etc. That may help to fingerprint anything 'familiair'. – Jan Doggen Feb 11 at 14:20
Hi Jan- I will have to sanitise the log entries before posting on here. – Mehcs85 Feb 13 at 10:27

4 Answers

up vote 3 down vote accepted

Source port numbers are normally chosen at random so as not to interfere with servers listening on "well-known" ports. If machine A is a client to machine B (e.g. B is your SSH server), then the kernel on A will normally choose a random free "high" port, because if it chooses port N, then this will prevent any potential connection from B to a server running on A and bound on port N.

However it is trivial to choose a specific source port; it is a matter of a simple bind() call prior to the connect(). For port values which are lower than 1024, on Unix systems, this requires root privileges, but we can assume that the attacker is root on his own machine. Why would an attacker do that ? Probably to fool badly-written firewall rules. Some sysadmins simply allow packets with low port values on the (mistaken) assumption that a low port can only be on the server side of a connection.

For the record, port 11 is for the systat service, an old-style way for sysadmins to gather some runtime system information on their machines.

share|improve this answer
Or the attacker is on a windows machine with no such low port restriction? Now I wonder how many more of us would have had to look up which abandoned service used that port. – ewanm89 Feb 7 at 19:45
Hi thanks for the info. Luckily the client only allows certificate credentials as it is a public facing server, so it was protected Thanks for the info – Mehcs85 Feb 8 at 10:28
up vote 3 down vote

SSH clients, and most anything else, randomize their source port. However, it's usually a high-number port. The attacker's brute-force tool probably just has 11 hard-coded as the source port.

share|improve this answer
That's what I was wondering. But I have generally not seen a hard coded port lower than 1024, but maybe it's just a fact- it was just a little suspicious that 80% of different occurrences of the SSH brute force attacks used the same port. Thanks for the info – Mehcs85 Feb 8 at 10:23
Thomas made a good point that it might be an attempt to deceive stupid firewalls. – Cory J Feb 8 at 18:43
up vote 1 down vote

It can very well be that your attacker is using a home brew tool. This means he has written it himself.

If you want to protect your machine from these attacks you should try out OSSEC it automatically blocks offenders after a few tries on your SSH port.

share|improve this answer
Hi, we're recommending the client runs fail2ban, we'll see how that helps/ Thanks for the info – Mehcs85 Feb 8 at 10:29
up vote -1 down vote

The attacker is probably trying to get a list of processes running on your external facing host so that they can then start going after those.

http://www.speedguide.net/port.php?port=11

share|improve this answer
Oh no, a time-traveling attacker from 1992. Next he's going to own fingerd. – Cory J Feb 7 at 18:43
I know some machines fingerd is still running on... No, I don't own them. – ewanm89 Feb 7 at 19:46
@ZachOfAllTrades that would only apply to destination port not source port which is set to port 11. And I doubt there are enough computers running systat to even bother attempting to find one. – ewanm89 Feb 7 at 19:49
Yeah, that service and another trojan use port 11, but as a destination and not a source! Thanks all for the answers! – Mehcs85 Feb 8 at 10:30

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.