In the Internet technology world, a bot is typically a program that infects a computer and performs hundreds of thousands of additional infections or malicious actions directed at other internet connected computers. They’re in the news occasionally, most everyone has heard about them by now.
Properly configured routers and firewalls protect most folks from these kinds of activities, but analyzing log files and monitoring internet traffic from time to time is still a great idea. Many vendors now offer automatic monitoring and alerting of these types of traffic as well.
I encountered one of these ‘more typical’ bots tonight while working on a customers linux server. The bot was making connections about every second or two, to port 22 (ssh) in an attempt to break in to the server.
Interestingly, after I blocked the connections with a “iptables -A INPUT -s 202.0.0.0/255.0.0.0 -i eth0 -p tcp -m tcp –dport 22 -j DROP” command, it made 60 more connection attempts, then stopped. It’s interesting to me how these bots are created and designed. Obviously some human designed the bot to try 60 more times, then move on to another target. Maybe the 60 corresponds to 1 minute of once every second attempts? Hard to know.
Another example of why it’s important to protect ssh services by using tcp wrappers and the hosts.deny file.