Web intrusions

Miscellaneous and Personal Stuff I Must Share
1

We have acquired two Linux servers, one maintained by an outside provider, one built by me. I also built a White Box linux to screw around with. I’m surprised upon examining the log to see the attempted logins. Thirty or so using simple user names “Bob”, “Sally”, “Dog”, etc. from the same IP address.

Are those generated by a virus or a user? Are they faking the IP address or are they really in Korea?

Yeah, I know I need a firewall.

Thanks

CP

2

I’d bet on a would-be hacker. I forget exactly who reported this - might have been Symantec’s SARC group - but on average, a computer is probed or attacked within 17 **seconds ** of being put online with a fresh IP. Credit this to the scanning tools that ping every IP in a selected range sequentially.

As for their exact location, Korea’s certainly likely, but they could just as easily be using an anonymizer and routing through Korea.