2

First to begin my OS is Arch Linux(a base install mostly). I have project in the making and I have opened SSH. Yesterday I had left my computer for a few hours(3/4). When I was back in my log file I've seen someone has tried to break in trough my ssh and he has failed to break my root password. So my question is : The IP the hacker was using is supposed to be owned by Microsoft, so I was wondering if the hacker could've somehow faked their IP address with that of Microsoft(from their azure server)

2
  • 1
    The attacker could have been using an azure virtual machine they purchased, or a compromised one owned by someone else. – IsAGuest Feb 7 '16 at 11:47
  • That is also a possibility. If you wish you can submit an answer and I would accept it as the answer. Also for some reason the idea of using an azure VM totally went out of my mind when that happened. – Radoslav Trump Feb 7 '16 at 11:55
3

This post has some useful information regarding IP spoofing. To put it shortly, it is not a trivial thing to do. For bi-directional connections, like SSH (which uses TCP), this would be even more difficult if not impossible.

Most likely, the source IP was legitimate and the attack came from an azure VM either purchased or compromised by the attacker.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.