Where The Wild Things Are: Brute-Force SSH Attacks In The Wild And How To Stop Them
Talkat 21st USENIX Symposium on Networked Systems Design and Implementation (NSDI '24) · 2024-04-16..04-18·
summary
Study analyzes sshd logs from over 500 production servers across four years, recording 381 million failed attempts and peaks of 3.5 million/day. It finds 64% of attacker sources reuse username dictionaries and 94% hit at least one dictionary entry, and builds a dictionary-based blocking scheme. The defense blocks 99.5% of brute-force attacks in simulation versus ~66% for rate-based rules, cuts false positives by 83%, and when deployed on 400+ CloudLab nodes stops four-fifths of attacks missed by other defenses with no user complaints.
AI-written summary · about
chapters (6)
- 0:00Introduction to SSH attacks
- 1:01Data collection analysis
- 2:54Ingredients of SSH attacks
- 5:12Dictionary-based blocking
- 7:20Evaluating defense efficacy
- 10:19Deployment and conclusion
related talks
21mCAUDIT: Continuous Auditing of SSH Servers To Mitigate Brute-Force Attacks
12mCatch-22: Uncovering Compromised Hosts using SSH Public Keys
43mHuman Involvement Behind Remote Desktop Protocol Brute-Force Attacks
40mYou have a security problem - your users
50mThe Anatomy of Cloud Attacks
40mLive autopsy of a password: lessons learnt cracking secrets
43mHow to Defeat Brute Force and Leave Hackers with Nothing
30mCountering Persistent Threat Actors in APAC and Globally