It's a tedious activity that can put the best of IT administrators to sleep. But as security and compliance manager for a large U.S. healthcare organization, Adam Nunn has learned to study his network activity logs religiously. He knows that when the bad guys work overtime to break his defenses, those logs can be the first sign of trouble.

He had a more relaxed approach to log checking at home. But one day he had a look and was alarmed to find that more than 1,000 brute force attacks had been targeting his personal Web server for a month.

"Unless you check your logs, you won't notice this kind of thing," Nunn said. "The fact that tons of these attacks were directed at my home Web server tells me some much larger attacks are going on and that enterprises are a target. This really worries me on the enterprise front."

David Hoelzer, owner of security research firm Cyber-Defense, said Nunn's concern is well justified. In the last few months he's seen a dramatic spike in Secure Shell [SSH] brute force authentication attacks and wordlist/username attacks. Like Nunn, he's comparing notes with other security professionals and finding that it's happening on a much broader scale. What's worse is that hackers are using a growing army of zombie machines to pull it off.

"If I were an IT admin checking my logs and seeing this for the first time, I'd be feeling a sense of dread," Hoelzer said. "This tells you that hackers are getting much better at cracking SSH. It took a long time for people to switch from Telnet to SSH, which is more secure. But if you're able to break into a network through Secure Shell, the attack is encrypted and it's a lot harder to trace."

The link for this article located at SearchSecurity is no longer available.