hufemj
January 30th, 2013, 08:02 PM
My system got compromised and I'm trying to find out how. The log files show a brute force attack on user bin. Since remote ssh login attempts are spaced 3 seconds apart, I am having difficulty understanding why an attacker would even attempt to login as bin. Since bin is not even a regular user, what password would apply to an ssh attempt? The first administrator's (me)?
I know that the system was compromised at least 10 days before because there's a record of me having logged in from the other side of the world. Since the brute force attack on bin followed later, I wonder ... why?
I suspect that the original compromise was related to Samba and poor patch maintenance on my part.
In summary, what password would apply to system user bin and how is the password established?
Thanks.
I know that the system was compromised at least 10 days before because there's a record of me having logged in from the other side of the world. Since the brute force attack on bin followed later, I wonder ... why?
I suspect that the original compromise was related to Samba and poor patch maintenance on my part.
In summary, what password would apply to system user bin and how is the password established?
Thanks.