SSH password guessing
I've been seeing consistent alarms of "Device 192.168.1.243 appears to be guessing SSH passwords on 140.82.114.3". It's always the same internal device, and always 140.82.114.3. Firewalla reports that IP as being owned by GitHub. I host a lot of repositories on GitHub, so it seems reasonable that my device would be making a lot of SSH connections to GitHub. This is a rather alarming alarm (no pun intended) though. Can I see any more detail about these password guessing attempts to figure out what software running on my device is attempting all these connections?
-
Firewalla detects SSH password guessing by looking at the login attempts. So in your case, it might be something with 192.168.1.243 trying to talk to 140.82.114.3, and firewalla saw some failure or suspicious attempts. (as with any security detection, there will be false positives)
The best way to see is probably looking at your ssh logs on 192.168.1.243, and see all the ssh sessions or failures. The network layer may be harder to find the details
-
I was finally able to observe this behavior live and traced it to what I suspected it was. I have been using GitFox as a GUI git application, and it was spawning these git subprocesses to run fetches in the background. Whatever its doing to fetch in the background is clearly getting caught by the Firewalla SSH password guessing heuristic.
Please sign in to leave a comment.
Comments
2 comments