ShellBot Uses Hex IPs to Evade Detection in Attacks on Linux SSH Servers
ShellBot Uses Hex IPs to Evade Detection in Attacks on Linux SSH Servers
Ever heard of an IP address in hexadecimal notation? It's the latest disguise hackers use to deploy DDoS malware on Linux systems.
From The Hacker News
You're viewing a single thread.
Surprised this isn't a better known / prevented vector. I remember experimenting with variant IPs like this in IE6 over 20 years ago.
Checking now with Firefox and it auto-translates on the line below as I type one in. (Tried both 0x7f000001 and 2130706433 because they're both variants of 127.0.0.1, and if there's something bad running on that address you have other problems.)
Irrelevant nerd fact: 2130706433 is a prime number.
So is 127
It's not
I just plugged
factor(2130706433);into Maxima and it says that it has no factors. Pretty sure that it's prime.Sorry, i said it was a mersenne prime, then realized it wasnt, so edited it and deleted it. It was a mess