Multiple sources (for example: Arbor networks  blog and El Reg ) are reporting changes in SSH brute-force methodology to a distributed platform. I've seen this in my logs and monitoring since October as described by most of the sources, but I don't believe this is a entirely new concept as I saw similar events as far back as 2007.

Most sources are claiming that so far no-one has been able to obtain a copy of the attacking code for analysis. As this is banging on my front door fairly hard despite the protections in place (which are so far holding up well), if anyone gets their hands on a sample I'd appreciate a copy if possible. 'Know your enemy' etc.

My main thought though is; given the increase in DDoS and botnets, why hasn't someone implemented this sooner? And why do people seem surprised by the development?

I read through all of these articles as they've been showing up over the last few months, and as a response I started using knockd.  Check it out if you haven't seen it.  Basically you can set up a "secret knock" for your system before it will open the port in a listening mode.  It adds an extra layer of complexity on any bruteforce attack.

Would this help at all?

http://www.csc.liv.ac.uk/~greg/sshdfilter/

Edit: I realize that this is for mac osX, I didnt know if you guys were refering to Mac or PC