ShellBot Uses Hex IPs to Evade Detection in Attacks on Linux SSH Servers

Joe Klemmer@lemmy.myserv.one to Linux@lemmy.ml – 91 points –
ShellBot Uses Hex IPs to Evade Detection in Attacks on Linux SSH Servers
thehackernews.com

From The Hacker News

24

You are viewing a single comment

Surprised this isn't a better known / prevented vector. I remember experimenting with variant IPs like this in IE6 over 20 years ago.

Checking now with Firefox and it auto-translates on the line below as I type one in. (Tried both 0x7f000001 and 2130706433 because they're both variants of 127.0.0.1, and if there's something bad running on that address you have other problems.)

Irrelevant nerd fact: 2130706433 is a prime number.

It's not

I just plugged factor(2130706433); into Maxima and it says that it has no factors. Pretty sure that it's prime.

Sorry, i said it was a mersenne prime, then realized it wasnt, so edited it and deleted it. It was a mess