[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: hijacked SSH sessions
- To: or-talk@xxxxxxxx
- Subject: Re: hijacked SSH sessions
- From: Taka Khumbartha <scarreigns@xxxxxxxxx>
- Date: Sat, 02 Dec 2006 22:38:55 -0700
- Delivered-to: archiver@seul.org
- Delivered-to: or-talk-outgoing@seul.org
- Delivered-to: or-talk@seul.org
- Delivery-date: Sun, 03 Dec 2006 00:36:21 -0500
- Domainkey-signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com; h=received:message-id:date:from:organization:mime-version:to:subject:references:in-reply-to:content-type:content-transfer-encoding; b=dl0lt75nQl4a7chQa7Oy28QXbdHncA5ZwDYg3cq3FzRW9ficeGFbxdZ1tA95XybLLZpke9HNg/6Ok2LCaYV1dlRTsZluCLS6dWw9xbftXoV2gtVS6dba76cbXxA9TxeG6IH5Xq/Fj2h9AadyZWejYQ3Ime7cvbZtthsRuwuMZOc=
- In-reply-to: <45331411.2020203@gmail.com>
- Organization: Scar Reigns, Inc.
- References: <45331411.2020203@gmail.com>
- Reply-to: or-talk@xxxxxxxxxxxxx
- Sender: owner-or-talk@xxxxxxxxxxxxx
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
i had another questionable MITM attack today. fortunately, i was connecting to my own server and was able to check the SSH logs. the connection came from 82.103.134.252/tor-proxy.thing2thing.com.
the interesting thing is: after waiting 2-3 minutes (hoping to get a new circuit and log in to my server securely) i logged in from the same IP/exit node without any complaints from ssh about differing fingerprints!
another interesting observation is that 82.103.134.252 is not listed in the Tor node listing (http://torstat.xenobite.eu/), however 82.103.134.253 (AKA madrid2) is, which also resolves to the same hostname. in fact, tor-proxy.thing2thing.com seems to have 13 IP addresses.
-----BEGIN PGP SIGNATURE-----
iD8DBQFFcmLAXhfCJNu98qARCJpMAKC/FjCyN5kWC1udDnf9qxrKF1U6GQCdFw/i
lUDkir2bctnxTP33F7WP9rQ=
=q+ZD
-----END PGP SIGNATURE-----