check for SSH-2.0-ROSSSH or SSH-2.0-dropbear_2013.62 in the banner

kaniini / antissh

An IRC bot which monitors for compromised embedded devices being used as proxies.

Other

126 stars 18 forks source link

Closed throwawayyeet closed 6 years ago

throwawayyeet commented 6 years ago

those appear to be the broken ssh daemons, and checking for them in the banner would be faster than actually trying to connect

kaniini commented 6 years ago

no. false positive risk too high.