2

Aug 30 20:28:09 dropbear[6799]: Child connection from ::ffff:5.10.69.82:38463
Aug 30 20:28:11 dropbear[6799]: login attempt for nonexistent user from ::ffff:5.10.69.82:38463
Aug 30 20:28:12 dropbear[6799]: exit before auth: Disconnect received
Aug 30 20:28:12 dropbear[6800]: Child connection from ::ffff:5.10.69.82:38805

I have MAC filtering and WPA2 security in place. Is this enough to protect my network?

  • Dropbear is a SSH server/client, but in this case I think it refers to your router running a SSH server for access to it. This isn't an attack on your wifi: if the attacker is able to do this, he/she is either outside your network in your WAN (or on the Internet, if your router is directly connected to it), or already in your network. This is more likely a router hacking attempt. To protect against this, a strong password for router login, and an updated firmware, would be the best countermeasures. – Nasrus Aug 31 '14 at 11:40
  • 1
    Switching off WPS and switching off the router's wifi, before switching the WPA2 access key to a strong one and then switching the router wifi back on would also help, if the attacker is on your wifi and is trying to find a way into your router. – Nasrus Aug 31 '14 at 11:43
  • Which question are you asking? The location one it the WPA2 one? Please edit your question to clarify – Rory Alsop Sep 1 '14 at 6:58
3

The user isn't trying to attack over wifi. They're trying to attack over the Internet.

Aug 30 20:28:09 dropbear[6799]: Child connection from ::ffff:5.10.69.82:38463 
Aug 30 20:28:11 dropbear[6799]: login attempt for nonexistent user from ::ffff:5.10.69.82:38463 
Aug 30 20:28:12 dropbear[6799]: exit before auth: Disconnect received 

::ffff:5.10.69.82 is an IPv6-mapped IPv4 address, specifically 5.10.69.82. The log shows the attacker connecting to an SSH server on your router, trying an invalid username/password pair, and disconnecting.

This is probably a part of the distributed SSH brute-force attack that's been going on for years. MAC filtering and WPA2 will do nothing to stop it, since it isn't coming in over the wireless connection. Rather, you should take the appropriate precautions for dealing with an attack on SSH.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.