Der erste Hackerangriff ist überwunden

Ja, so sieht es aus – der neue Server ist noch keine 24h online, schon versucht so ein kleines chinesisches Skriptkiddie hier einzubrechen. :twisted:

Finger weg – ich weiß wer Du bist!

Hier ein Auszug aus dem Logfile:

2010-06-01 13:53:02.646887500 Failed password for root from 124.193.148.139 port 46769 ssh2
2010-06-01 13:53:03.021760500 Received disconnect from 124.193.148.139: 11: Bye Bye
2010-06-01 13:53:08.031025500 Failed password for root from 124.193.148.139 port 47209 ssh2
2010-06-01 13:53:08.417109500 Received disconnect from 124.193.148.139: 11: Bye Bye
2010-06-01 13:53:13.422098500 Failed password for root from 124.193.148.139 port 47566 ssh2
2010-06-01 13:53:13.794003500 Received disconnect from 124.193.148.139: 11: Bye Bye
2010-06-01 13:53:18.804498500 Failed password for root from 124.193.148.139 port 47925 ssh2
2010-06-01 13:53:19.161671500 Received disconnect from 124.193.148.139: 11: Bye Bye
2010-06-01 13:53:24.220493500 Failed password for root from 124.193.148.139 port 48281 ssh2
2010-06-01 13:53:24.560383500 Received disconnect from 124.193.148.139: 11: Bye Bye
2010-06-01 13:53:29.664235500 Failed password for root from 124.193.148.139 port 48642 ssh2
2010-06-01 13:53:30.043306500 Received disconnect from 124.193.148.139: 11: Bye Bye
2010-06-01 13:53:35.024576500 Failed password for root from 124.193.148.139 port 48997 ssh2
2010-06-01 13:53:35.400385500 Received disconnect from 124.193.148.139: 11: Bye Bye
2010-06-01 13:53:40.427344500 Failed password for root from 124.193.148.139 port 49359 ssh2
2010-06-01 13:53:40.783682500 Received disconnect from 124.193.148.139: 11: Bye Bye
2010-06-01 13:53:45.876441500 Failed password for root from 124.193.148.139 port 49702 ssh2
2010-06-01 13:53:46.238557500 Received disconnect from 124.193.148.139: 11: Bye Bye
2010-06-01 13:53:51.247689500 Failed password for root from 124.193.148.139 port 50029 ssh2
2010-06-01 13:53:51.627630500 Received disconnect from 124.193.148.139: 11: Bye Bye
2010-06-01 13:53:56.650081500 Failed password for root from 124.193.148.139 port 50388 ssh2
2010-06-01 13:53:57.031853500 Received disconnect from 124.193.148.139: 11: Bye Bye
2010-06-01 13:54:02.078402500 Failed password for root from 124.193.148.139 port 50740 ssh2
2010-06-01 13:54:02.463343500 Received disconnect from 124.193.148.139: 11: Bye Bye
2010-06-01 13:54:07.513184500 Failed password for root from 124.193.148.139 port 51102 ssh2
2010-06-01 13:54:07.893927500 Received disconnect from 124.193.148.139: 11: Bye Bye
2010-06-01 13:54:10.581227500 Invalid user oracle from 124.193.148.139
2010-06-01 13:54:10.581231500 input_userauth_request: invalid user oracle
2010-06-01 13:54:12.932924500 Failed password for invalid user oracle from 124.193.148.139 port 51412 ssh2
2010-06-01 13:54:13.298589500 Received disconnect from 124.193.148.139: 11: Bye Bye
2010-06-01 13:54:15.959827500 Invalid user test from 124.193.148.139
2010-06-01 13:54:15.961403500 input_userauth_request: invalid user test
2010-06-01 13:54:18.312062500 Failed password for invalid user test from 124.193.148.139 port 51688 ssh2
2010-06-01 13:54:18.682113500 Received disconnect from 124.193.148.139: 11: Bye Bye

Hier gibts keinen user root und auch keinen der oracle heisst. :lol:

Und nun schaun wir mal zu wem die IP-Adresse gehört:

inetnum:      124.192.0.0 - 124.193.255.255
netname:      DXTNET
descr:        Beijing Teletron Telecom Engineering Co., Ltd.
descr:        Jian Guo Road, Chaoyang District, Beijing, PR.China
country:      CN
admin-c:      SD256-AP
tech-c:       DL767-AP
status:       ALLOCATED PORTABLE
mnt-by:       MAINT-CNNIC-AP
mnt-lower:    MAINT-CNNIC-AP
mnt-routes:   MAINT-CNCGROUP-RR
changed:      ipas@cnnic.cn 20080911
source:       APNIC
person:       Shoulan Du
nic-hdl:      SD256-AP
e-mail:       Betsy.du@bj.datadragon.net
address:      No. 20,  Fuxing  Road,  Beijing
phone:        +86-010-65661868-236
fax-no:       +86-010-65660882
country:      CN
changed:      ipas@cnnic.cn 20060508
mnt-by:       MAINT-CNNIC-AP
source:       APNIC
person:       Donghai Liu
nic-hdl:      DL767-AP
e-mail:       liudonghai@btte.net
address:      No. 20,  Fuxing  Road,  Beijing
phone:        +86-010-65661868-230
fax-no:       +86-010-65660882
country:      CN
changed:      ipas@cnnic.cn 20090402
mnt-by:       MAINT-CNNIC-AP
source:       APNIC

Also doch die Chinesen. Bleibts mir vom Hals – hier gibts nix zu holen. Nicht für euch! :twisted:

Kommentieren