0

Yesterday after connecting to my company's server I noticed an information that there were 107 failed login attempts. After checking the logs it turned out that all of them were coming from my IP address and the passed passwords were either empty or just 'password'.

I suspect that I got some kind of trojan on my laptop and I'm trying to figure out what that might be. Anyone got a clue how to do that?

Also I installed Sophos Antivirus after I found out about those connect attempts but scanning takes quite a lot of time so I have no information about it.

EDIT #1 Here's part of the logs:

lip 24 15:03:38 SERVER sshd[28704]: error: PAM: Authentication failure for filip from 192.168.10.107
lip 24 15:03:38 SERVER sshd[28704]: Failed none for filip from 192.168.10.107 port 53304 ssh2
lip 24 15:03:38 SERVER sshd[28704]: Failed password for filip from 192.168.10.107 port 53304 ssh2
lip 24 15:03:38 SERVER sshd[28704]: Failed password for filip from 192.168.10.107 port 53304 ssh2
lip 24 15:03:38 SERVER sshd[28704]: error: maximum authentication attempts exceeded for filip from 192.168.10.107 port 53304 ssh2 [preauth]

OS is openSUSE Leap 15.1. I don't recall installing anything "fishy"

  • 1
    First things first - disconnect your machine from the network! After that provide us with more information to help you - what OS it is, what version, have you downloaded something fishy lately, can you check since when did these log messages about failed logins start? – Fanatique Jul 26 '19 at 11:15
4

It looks more like a misconfigured script. Why should a trojan try 107 times the same login and empty password?

If your laptop is still connected to the network, and assuming you're talking about SSH logins, use the command:

netstat -anp | grep 22

to pinpoint the process which is trying to connect.

However, you've got a much bigger security problem here.

First, you should give a heads-up to your company's SOC -- it is not acceptable they let the same IP make 107 failed logins without banning it.

Second, you wrote

the passed passwords were either empty or just 'password'

For you to be able to say this, it means that the password is sent in plaintext and stored in plaintext in the logs.

| improve this answer | |
  • I added part of the log those attempted login. Also the SOC is me, so I guess that's my bad. The first log appeared on 24th of july at about 12:18. I do not recall installing anything in about that time. Also the Sophos finished it's scanning but didn't found anything. It's also hard to say when it tries to connect to the server. On 24th it was 107 attempts, on 25th it was 3 attempts, seems like totally random hour. – FilipK Jul 26 '19 at 13:12
0

Oh my god!

It seems I got Intellij git repo misconfigured because the error appears everytime I try to update my project. When I push my changes it would throw those errors too but my repository is actually updated.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.