1

What happened?

This is a live event that a friend of mine is working on, a company's systems were breached by a Threat Actor (TA), when the Cyber Sec company was called in and tried to regain access they could not, as SSH authentication would fail.

What I suggested

I suggested the use of Hydra, as he mentioned SSH authentication was performed via passwords. The server configuration is unknown to me.

The Goal

The problem is not alerting the Threat Actor who has access to the server to the brute force attempts. Generally, failed authentication attempts will pop up in access logs. Attempting to restore access to the system will/may alert the Threat Actor.

What I think

To my knowledge, there isn't a silent way of bruteforcing something while staying stealthy. Nor do I think, at this stage, trying to stay stealthy will do much, as SSH access is long gone.

6
  • I'm not sure what you are asking. You seem to start with the assumption that SSH is properly secured with various things - among them "RSA". I assume you mean key based authentication here. Still assuming that SSH is properly secured it also means that only key based authentication is allowed. This means that password based authentication isn't even allowed - which means that any attempt to use a password will fail and therefore also brute-forcing password. And they will fail no matter if other measures like monitoring logs and banning brute force attempts are in place or not. Commented Feb 10, 2021 at 4:55
  • @SteffenUllrich I'm sorry. I updated my write up. I use RSA keypairs, the said company used Password based Authentication which is a big no-no. At this stage the SSH password(s) were changed. With the knowledge I have I don't think there is a silent way of bruteforcing SSH without raising some flags. Commented Feb 10, 2021 at 20:12
  • @schroeder Yes, TA = Threat Actor. We are not Bruteforcing my server, but a server that was stolen by TA. This is not related to me but a friend who works for Cyber Sec company, and he brought this up. They are trying to regain access commando style, where I stated I don't think that's possible and only way would be Bruteforce, which will raise flags. I would never in 1000 years use Passwords for SSH and would have strict ban rules in place, like I usually do with dropping default 22 connections and using RSA keypairs. Commented Feb 10, 2021 at 20:14
  • 3
    You have a lot of assumptions here. You are assuming the attacker has root access or log access. And I'm not sure why trying to brute force the SSH is worthwhile or even important. Take the server off the network!!!
    – schroeder
    Commented Feb 10, 2021 at 20:25
  • @schroeder I agree, but for whatever reason they are trying to regain access to the system via SSH credentials that clearly no longer are valid. Reason behind being sneaky? I really don't know. Commented Feb 10, 2021 at 22:08

1 Answer 1

1

Sure, you use the techniques used by attackers: you hire a botnet to try to bruteforce the password. This doesn't mean that the attempts won't be noticed. It means that the attempts will get lost amongst all the other botnets doing the same. And if detected, you just switch bots. The attacker won't know it's you.

If the attacker has access to the logs, and is looking, then any connection, let alone login attempt, can be noticed.

One other idea: if you can determine if there is traffic to the server, then you can know when the attacker is logged in. You could try to time the bruteforce attempts when they are not active.

But, it is unlikely that you will bruteforce the password. Attackers don't use super long random passwords, but they don't use password123 either.

So, this whole thing is an academic exercise and likely futile. Gain access some other way.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .