Hacker en action

Posté par Cedric, le 03/04/2008 - Technologie

Pour ceux qui se demandent à quoi ressemble concrètement une attaque de hacker, voici un exemple simple.

A la commande suivante:

tail -200 /var/log/auth.log

Votre serveur Linux vous répond:

Apr  3 05:13:30 xxxxxx sshd[18197]: Invalid user dustin from 217.199.178.44
Apr  3 05:13:30 xxxxxx sshd[18200]: Invalid user dusty from 217.199.178.44
Apr  3 05:13:31 xxxxxx sshd[18203]: Invalid user joey from 217.199.178.44
Apr  3 05:13:31 xxxxxx sshd[18207]: Invalid user hirano from 217.199.178.44
Apr  3 05:13:31 xxxxxx sshd[18209]: Invalid user piranha from 217.199.178.44
Apr  3 05:13:31 xxxxxx sshd[18211]: Invalid user kobayashi from 217.199.178.44
Apr  3 05:13:31 xxxxxx sshd[18213]: Invalid user nishimura from 217.199.178.44
Apr  3 05:13:32 xxxxxx sshd[18215]: Invalid user nishida from 217.199.178.44
Apr  3 05:13:32 xxxxxx sshd[18217]: Invalid user ishihara from 217.199.178.44
Apr  3 05:13:32 xxxxxx sshd[18219]: Invalid user watanabe from 217.199.178.44
Apr  3 05:13:32 xxxxxx sshd[18223]: Invalid user glenn from 217.199.178.44
Apr  3 05:13:32 xxxxxx sshd[18227]: Invalid user hasegawa from 217.199.178.44
Apr  3 05:13:33 xxxxxx sshd[18229]: Invalid user suzuki from 217.199.178.44
Apr  3 05:13:33 xxxxxx sshd[18233]: Invalid user shimizu from 217.199.178.44
Apr  3 05:13:33 xxxxxx sshd[18236]: Invalid user wada from 217.199.178.44
Apr  3 05:13:33 xxxxxx sshd[18238]: Invalid user miyazaki from 217.199.178.44
Apr  3 05:13:33 xxxxxx sshd[18240]: Invalid user nakao from 217.199.178.44
Apr  3 05:13:33 xxxxxx sshd[18242]: Invalid user azuma from 217.199.178.44
Apr  3 05:13:34 xxxxxx sshd[18246]: Invalid user akiyama from 217.199.178.44
Apr  3 05:13:34 xxxxxx sshd[18248]: Invalid user katayama from 217.199.178.44
Apr  3 05:13:34 xxxxxx sshd[18252]: Invalid user kn from 217.199.178.44
Apr  3 05:13:35 xxxxxx sshd[18254]: Invalid user test from 217.199.178.44
Apr  3 05:13:35 xxxxxx sshd[18256]: Invalid user serwis from 217.199.178.44
Apr  3 05:13:35 xxxxxx sshd[18258]: Invalid user crowley from 217.199.178.44
Apr  3 05:13:35 xxxxxx sshd[18260]: Invalid user tomek from 217.199.178.44
Apr  3 05:13:35 xxxxxx sshd[18262]: Invalid user gizmo from 217.199.178.44
Apr  3 05:13:36 xxxxxx sshd[18264]: Invalid user zabbix from 217.199.178.44
Apr  3 05:13:36 xxxxxx sshd[18266]: Invalid user adsl from 217.199.178.44
Apr  3 05:13:36 xxxxxx sshd[18270]: Invalid user exam from 217.199.178.44
Apr  3 05:13:36 xxxxxx sshd[18272]: Invalid user puma from 217.199.178.44

En bon francais, ces lignes signifient qu'un programme pirate a pris possession d'un ordinateur et lance depuis cette adresse une série de tentative de connexion au serveur (en utilisant différents login, comme glen ou suzuki). Si vous êtes administrateur, il y a différents moyens de bloquer ce genre de tentatative. Comme elles se concentrent sur le port 22 (SSH), on peut utiliser un port non-conventionnel pour le SSH (c'est bête mais ca marche diablement bien), ou, plus classique, on peut logger ces tentatives infructueuses et blacklister totalement toute connection TCP avec cette IP pendant un certain temps avec Iptables. Cette série de scripts fait cela très bien.

tags: hacking, linux

A lire aussi: Comments Commentaires
Tu as fail2ban qui contre ce genre d'attaque.
http://www.fail2ban.org

Posted by [MA]Pascal on 29/04/2008

thank you! I like this news, I also have information to share, here is my message.
mbt mbt mbt 靴 mbt 靴 mbtシューズ mbt シューズ

Posted by mbt on 08/07/2010

2010 new styles A-line Wedding Dresses,Beach Wedding Dresses,Evening Dresses,Prom Dresses on sale
evening dresses
Prom dresses
wedding dresses
on best wedding dresses for 2009 and 2010. You can find latest collection of woman's dresses and casual dresses on this site
discount Prom dresses

Posted by dress on 13/07/2010

Global recession was a great blow to the famous A.Lange & Sohne replica watches producers. At that time replica Hublot watches acted under a different principle: to get into the market more aggressively. The company made a contract with the most popular star, Bvlgari watches . Ebel replica , a member of French luxury giant rolex watches replica watches made an attempt to pass through the difficult times of global recession making use of swiss valjoux 7750 replica watches , the hero of the film Titanic.
Chopard replica should be advertised widely; that is the main aim of employing Ferrari replica watches . The popularity created by Rolex Daytona watches is reflected in the Tudor replica watches also.
It was the golden age of replica Longines . Forty years Breguet replica watches , swiss watches , the famous Hollywood actress and Rolex Air-King replica , the American meg-star were ambassadors. After that the company chose the new fashion icon replica Piaget . In fact all these great names made Croum replica a great name. By a process of downward filtration the popularity is now captured by Audemars Piguet watches .
replica Franck Muller watches had lots of investments in the Formula 1 McLaren. movado replica was not a much sort after field for the American and the Japanese.Thus the BlancPain replica includes golf superstar replica Bell & Ross , Concord watches . replica Rolex Day Date II , Rolex Day Date replica watches , Croum replica , Tag Heuer replica watches , Omega replica , replica Burberry , replica Oris watches , replica Gucci , replica Breguet , Ferrari watches , Ferrari for sale , replica Audemars Piguet , Breguet replica , Jaquet droz for sale , ebel replica , replica Burberry and Piaget watches .
world wide marketing outlets made the replica Alain Silberstein a very expensive enterprise. The hard work made this company to the easy selling of the Rado for sale and also to raise its name to peak.Replica replica Tudor are available at a lower cost without much difference in quality. U-boat replica a treasure house of all varieties of luxury DeWitt for sale is waiting for you to give a warm welcome.

Posted by replica handbags on 17/08/2010

Don't Links of London miss links of london 2010 NEW ARRIVALS this priceLinks London Fashion trends links of london rings ,New things links london rings Lovers, the buddhist Links of London monastic links of london watches discipline your heart Cheap Links London tightly tied together links london sweetie Classic aggrandising links london charm wholesale combination links london bracelets Metal Links London multi-layer links of london discount and small, Links London dazzle Links of London colour glow

Posted by chenjing123 on 22/08/2010

Links Links London Friendship Bracelet of London links london store Watches links london store are so Links London wonderful that everybody wanted to get their hands on these Links London Gift watches. All links london necklace sweetie of the Links of links london sweetie ring London watches links london ring charm are made Links of london out of stainless steel and you won’t Links of London find a better Links London prices or selection of other Links of London watches than Links london at our online store. links london sale shop Here, you can links of london sale UK get the watch a lot of preferential, cheap links of london bracelets help you save 80%.

Posted by talent on 22/08/2010

Ajouter un commentaire