CAUDIT: Continuous Auditing of SSH Servers To Mitigate Brute-Force Attacks
summary
Deployed at NCSA (UIUC), a /16 honeypot captures SSH metadata from ~405 million recorded attempts and feeds a continuous auditing pipeline that replays attacks against internal hosts and prioritizes new passwords and key fingerprints. A border Black Hole Router blocks the most aggressive IPs, averaging 57 million blocked attempts per day, yielding a 66× drop in observed SSH attempts and a 78% reduction in load on internal security monitoring; data gets shared with peers in real time.
AI-written summary · about
chapters (13)
- 0:00Intro
- 0:31National Center for Supercomputing Applications (NCSA)
- 1:15SSH brute-force attacks affect internal hosts and monitors
- 3:03Putting SSH auditing in perspective
- 4:54CAUDIT: An operational system to audit internal servers
- 6:31Decreasing security incidents at NCSA
- 7:14Where are the attacks coming from?
- 7:37What kind of SSH client libraries are brute-forcing NCSA?
- 12:17Non-interactive honeypots can scale to millions of attempts
- 14:00Continuous audits are driven by external attack attempts
- 16:06Outline
- 17:18Continuous auditing preempted potential security incidents
- 18:13Conclusion
related talks
15mWhere The Wild Things Are: Brute-Force SSH Attacks In The Wild And How To Stop Them
12mCatch-22: Uncovering Compromised Hosts using SSH Public Keys
30mPublic-private partnership unveils the full scale of a sophisticated Linux threat
47mDecisions and Revisions - The Ever Evolving Face of the Black Hat NOC
52mInvestigating DDOS - Architecture Actors and Attribution
40mYou have a security problem - your users
50mThe Anatomy of Cloud Attacks
43mHuman Involvement Behind Remote Desktop Protocol Brute-Force Attacks