I noticed they also attempted to gain access into my personal linux servers from several different IPs as well but failed according to the logs.

Apr 3 06:41:58 localhost sshd[13237]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=95-37-149-222.dynamic.mts-nn.ru
Apr 3 06:42:01 localhost sshd[13237]: Failed password for invalid user testuser from 95.37.149.222 port 35504 ssh2
Apr 3 06:42:01 localhost sshd[13237]: pam_unix(sshd:auth): check pass; user unknown
Apr 3 06:42:03 localhost sshd[13237]: Failed password for invalid user testuser from 95.37.149.222 port 35504 ssh2
Apr 3 06:42:03 localhost sshd[13237]: pam_unix(sshd:auth): check pass; user unknown
Apr 3 06:42:05 localhost sshd[13237]: Failed password for invalid user testuser from 95.37.149.222 port 35504 ssh2
Apr 3 06:42:05 localhost sshd[13237]: pam_unix(sshd:auth): check pass; user unknown
Apr 3 06:42:06 localhost sshd[13237]: Failed password for invalid user testuser from 95.37.149.222 port 35504 ssh2
Apr 3 06:42:06 localhost sshd[13237]: pam_unix(sshd:auth): check pass; user unknown
Apr 3 06:42:08 localhost sshd[13237]: Failed password for invalid user testuser from 95.37.149.222 port 35504 ssh2
Apr 3 06:42:09 localhost sshd[13237]: pam_unix(sshd:auth): check pass; user unknown
Apr 3 06:42:11 localhost sshd[13237]: Failed password for invalid user testuser from 95.37.149.222 port 35504 ssh2
Apr 3 06:42:11 localhost sshd[13237]: Disconnecting: Too many authentication failures for invalid user testuser from 95.37.149.222 port 35504 ssh2 [preauth]
Apr 3 06:42:11 localhost sshd[13237]: PAM 5 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=95-37-149-222.dynamic.mts-nn.ru

Apr 3 07:59:06 localhost sshd[15373]: reverse mapping checking getaddrinfo for host-77-41-104-93.qwerty.ru [77.41.104.93] failed - POSSIBLE BREAK-IN ATTEMPT!
Apr 3 07:59:06 localhost sshd[15373]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=77.41.104.93 user=root
Apr 3 07:59:08 localhost sshd[15373]: Failed password for root from 77.41.104.93 port 27391 ssh2
Apr 3 07:59:10 localhost sshd[15373]: Failed password for root from 77.41.104.93 port 27391 ssh2
Apr 3 07:59:13 localhost sshd[15373]: Failed password for root from 77.41.104.93 port 27391 ssh2
Apr 3 07:59:15 localhost sshd[15373]: Failed password for root from 77.41.104.93 port 27391 ssh2
Apr 3 07:59:17 localhost sshd[15373]: Failed password for root from 77.41.104.93 port 27391 ssh2
Apr 3 07:59:19 localhost sshd[15373]: Failed password for root from 77.41.104.93 port 27391 ssh2
Apr 3 07:59:19 localhost sshd[15373]: Disconnecting: Too many authentication failures for root from 77.41.104.93 port 27391 ssh2 [preauth]

Apr 3 08:17:05 localhost sshd[15940]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=dd5760a8f.access.telenet.be
Apr 3 08:17:08 localhost sshd[15940]: Failed password for invalid user bananapi from 213.118.10.143 port 42883 ssh2
Apr 3 08:17:08 localhost sshd[15940]: pam_unix(sshd:auth): check pass; user unknown
Apr 3 08:17:10 localhost sshd[15940]: Failed password for invalid user bananapi from 213.118.10.143 port 42883 ssh2
Apr 3 08:17:10 localhost sshd[15940]: pam_unix(sshd:auth): check pass; user unknown
Apr 3 08:17:12 localhost sshd[15940]: Failed password for invalid user bananapi from 213.118.10.143 port 42883 ssh2
Apr 3 08:17:12 localhost sshd[15940]: pam_unix(sshd:auth): check pass; user unknown
Apr 3 08:17:14 localhost sshd[15940]: Failed password for invalid user bananapi from 213.118.10.143 port 42883 ssh2
Apr 3 08:17:14 localhost sshd[15940]: pam_unix(sshd:auth): check pass; user unknown
Apr 3 08:17:16 localhost sshd[15940]: Failed password for invalid user bananapi from 213.118.10.143 port 42883 ssh2
Apr 3 08:17:16 localhost sshd[15940]: pam_unix(sshd:auth): check pass; user unknown
Apr 3 08:17:18 localhost sshd[15940]: Failed password for invalid user bananapi from 213.118.10.143 port 42883 ssh2
Apr 3 08:17:18 localhost sshd[15940]: Disconnecting: Too many authentication failures for invalid user bananapi from 213.118.10.143 port 42883 ssh2 [preauth]

Apr 3 08:21:36 localhost sshd[16105]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.130.111.209
Apr 3 08:21:37 localhost sshd[16099]: Failed password for root from 186.130.111.209 port 47246 ssh2
Apr 3 08:21:38 localhost sshd[16105]: Failed password for invalid user nuucp from 186.130.111.209 port 47252 ssh2
Apr 3 08:21:38 localhost sshd[16105]: pam_unix(sshd:auth): check pass; user unknown
Apr 3 08:21:39 localhost sshd[16099]: Failed password for root from 186.130.111.209 port 47246 ssh2
Apr 3 08:21:40 localhost sshd[16105]: Failed password for invalid user nuucp from 186.130.111.209 port 47252 ssh2
Apr 3 08:21:40 localhost sshd[16105]: pam_unix(sshd:auth): check pass; user unknown
Apr 3 08:21:43 localhost sshd[16105]: Failed password for invalid user nuucp from 186.130.111.209 port 47252 ssh2
Apr 3 08:21:43 localhost sshd[16099]: Failed password for root from 186.130.111.209 port 47246 ssh2
Apr 3 08:21:43 localhost sshd[16105]: pam_unix(sshd:auth): check pass; user unknown
Apr 3 08:21:45 localhost sshd[16105]: Failed password for invalid user nuucp from 186.130.111.209 port 47252 ssh2
Apr 3 08:21:46 localhost sshd[16105]: pam_unix(sshd:auth): check pass; user unknown
Apr 3 08:21:47 localhost sshd[16099]: Failed password for root from 186.130.111.209 port 47246 ssh2
Apr 3 08:21:48 localhost sshd[16105]: Failed password for invalid user nuucp from 186.130.111.209 port 47252 ssh2
Apr 3 08:21:48 localhost sshd[16105]: pam_unix(sshd:auth): check pass; user unknown
Apr 3 08:21:50 localhost sshd[16099]: Failed password for root from 186.130.111.209 port 47246 ssh2
Apr 3 08:21:50 localhost sshd[16099]: Disconnecting: Too many authentication failures for root from 186.130.111.209 port 47246 ssh2 [preauth]

The list just goes on and on where they guess usernames and passwords to brute force their way into my systems, the above is only a few attempts I shared.

Bottom line it just looks like some script kiddies were trying to have some fun at my expensive but failed which is great on my part but just makes me that much more aware of potential pitfalls in my network and why it is important to secure them and monitoring them closely.

If you run servers or even have a home network then I suggest you closely monitor yours as well!

The data circulating online included the e-mail addresses and hashed passwords for 7 million Lifeboat accounts. The mass compromise was discovered by Troy Hunt, the security researcher behind the Have I been pwned? breach notification site. Hunt said he had acquired the data from someone actively involved in trading hacked login credentials who has provided similar data in the past.

Hunt reported that some of the plaintext passwords users had chosen were so weak that he was able to discover them simply by posting the corresponding MD5 hash into Google. As if many users’ approach to password selection weren’t lackadaisical enough, Lifeboat’s own Getting started guide recommended “short, but difficult to guess passwords” because “This is not online banking.”

Crude but effective

Short passwords are especially prone to cracking by brute force, a technique that tries all possible combinations of numbers, letters, and special characters until the specific one protecting a compromised account is tried. By counseling users to choose short passwords, Lifeboat operators made this crude cracking approach feasible. After all, a six-character password that uses letters and numbers has just 626 possible combinations. An 11-character password with letters and numbers has 6211 combinations, making it out of reach by brute-force methods.
The advice is compounded by the reliance on unsalted MD5 hashes to obscure the password plaintext. MD5 was designed to be extremely fast and require minimal computation. In years past, those were good attributes that gave a performance boost to inexpensive hardware. But as computers have grown increasingly powerful, the same qualities make MD5 a liability. The fact that the hashes were unsalted—meaning the plaintext passwords weren’t combined with a value that was unique for each account—makes the cracking process go much quicker and require less computation. Because salting ensures that each stored hash is unique even if two users choose the same passcode, each hash in a compromised table must be cracked separately, even if they mask one or more identical plaintext passwords.

Lifeboat officials told Motherboard that MD5 is no longer being used. They also said they implemented a password reset but didn’t disclose the breach because they didn’t want to notify the attackers there would be a limited shelf life to the hashes. Some Lifeboat users have disputed the claim there was a password reset. What’s known for sure is that the practices exposed in the breach are a text-book example of how not to store password data at rest.

Source:  Arstechnica