13 - David Barrera - What Lies Beneath? Analyzing Automated SSH Bruteforce
Channel: Per Thorsheim
Date: 2015-12-16

What Lies Beneath? Analyzing Automated SSH Bruteforce

Abstract:
We report on what we believe to be the largest dataset (to date) of automated secure shell (SSH) bruteforce attacks. The dataset includes plaintext password guesses in addition to timing, source, and username details, which allows us to analyze attacker behaviour and dynamics (e.g., coordinated attacks and password dictionary sharing). Our methodology involves hosting six instrumented SSH servers in six cities. Over the course of a year, we recorded a total of about 17M login attempts originating from 112 different countries and over 6K distinct source IP addresses. We shed light on attacker behaviour, and based on our findings provide recommendations for SSH users and administrators.

----

About the speaker:
David Barrera is a postdoc in the Network Security group at ETH Zürich in Switzerland. He received his PhD from Carleton University where he worked on secure software installation and updates. He is currently doing research on security and privacy of next-generation networks.