News for hackers. Stuff that matters.
Re:What SSH Hacking Attempts Look Like by sophacles on Saturday May 05, 2018 @09:28AM (#17001710)
Keys, like passwords, can be leaked, so it's possible there are databases of leaked keys out in the world, because unlike PGP or SSL certs, ssh keys don't have a revocation mechanism built in. So they could just try all the known leaked keys - like they try known leaked or default passwords.

Then there was this: https://jblevins.org/log/ssh-vulnkey (tl;dr - there was a bug in debian that caused ssh-keygen to only produce a very small number of keys rather than keys distributed across the whole keyspace). After that became public the bots were all about trying those keys for a few years after. To this day it's recommended to not used keys from that set.

Point being - the bots will try because it the tiny marginal cost is not high enough to stop the attempt.

There are no comments on this comment yet.