this forum has been brilliant so far. Just wondering if I can get a bit more help:

Can I get some info on a large amount of SSH brute force attacks originating from port 11 on the external host over the past 1 month

Now I know that port number can be faked, but if it isn't, what possibly could be causing this? I've looked for some tools that use port 11, but no joy

If you have any ideas on what it is, or how I can get more info, I'll be extremely grateful

  • Can you be more specific about "SSH brute force attacks originating from port 11"? Do you have example log entries, are there patterns in the attacks, etc. That may help to fingerprint anything 'familiair'. – user13695 Feb 11 '13 at 14:20
  • Hi Jan- I will have to sanitise the log entries before posting on here. – Mehcs85 Feb 13 '13 at 10:27

Source port numbers are normally chosen at random so as not to interfere with servers listening on "well-known" ports. If machine A is a client to machine B (e.g. B is your SSH server), then the kernel on A will normally choose a random free "high" port, because if it chooses port N, then this will prevent any potential connection from B to a server running on A and bound on port N.

However it is trivial to choose a specific source port; it is a matter of a simple bind() call prior to the connect(). For port values which are lower than 1024, on Unix systems, this requires root privileges, but we can assume that the attacker is root on his own machine. Why would an attacker do that ? Probably to fool badly-written firewall rules. Some sysadmins simply allow packets with low port values on the (mistaken) assumption that a low port can only be on the server side of a connection.

For the record, port 11 is for the systat service, an old-style way for sysadmins to gather some runtime system information on their machines.

| improve this answer | |
  • Or the attacker is on a windows machine with no such low port restriction? Now I wonder how many more of us would have had to look up which abandoned service used that port. – ewanm89 Feb 7 '13 at 19:45
  • Hi thanks for the info. Luckily the client only allows certificate credentials as it is a public facing server, so it was protected Thanks for the info – Mehcs85 Feb 8 '13 at 10:28

SSH clients, and most anything else, randomize their source port. However, it's usually a high-number port. The attacker's brute-force tool probably just has 11 hard-coded as the source port.

| improve this answer | |
  • That's what I was wondering. But I have generally not seen a hard coded port lower than 1024, but maybe it's just a fact- it was just a little suspicious that 80% of different occurrences of the SSH brute force attacks used the same port. Thanks for the info – Mehcs85 Feb 8 '13 at 10:23
  • Thomas made a good point that it might be an attempt to deceive stupid firewalls. – Cory J Feb 8 '13 at 18:43

It can very well be that your attacker is using a home brew tool. This means he has written it himself.

If you want to protect your machine from these attacks you should try out OSSEC it automatically blocks offenders after a few tries on your SSH port.

| improve this answer | |
  • Hi, we're recommending the client runs fail2ban, we'll see how that helps/ Thanks for the info – Mehcs85 Feb 8 '13 at 10:29

The attacker is probably trying to get a list of processes running on your external facing host so that they can then start going after those.


| improve this answer | |
  • Oh no, a time-traveling attacker from 1992. Next he's going to own fingerd. – Cory J Feb 7 '13 at 18:43
  • I know some machines fingerd is still running on... No, I don't own them. – ewanm89 Feb 7 '13 at 19:46
  • @ZachOfAllTrades that would only apply to destination port not source port which is set to port 11. And I doubt there are enough computers running systat to even bother attempting to find one. – ewanm89 Feb 7 '13 at 19:49
  • Yeah, that service and another trojan use port 11, but as a destination and not a source! Thanks all for the answers! – Mehcs85 Feb 8 '13 at 10:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.