Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

3 months and 1M SSH attempts later

livesshattack.net

Post reply on HN
Print view View original

11–20 of 69 posts

Re: 3 months and 1M SSH attempts later

#11

Post by simoncion »

WillieStevenson wrote: post #9
cddotdotslash wrote: post #6

Just FYI, I wouldn't log into any systems using credentials you find through this. A lot of people are obviously using credentials stolen from previous dumps, so there might be valid ones in there. Logging into a public facing router using stolen credentials is definitely a crime.

Just like it's a crime trying to ssh into a box that is not yours right? And besides I didn't do anything to the router. I was simply pointing out that you should change your default credentials and hide your router. ... should be a crime to not change the default credentials.

Did you attempt to notify that poor schmuck who stood up that AirRouter with the default username and password?

Re: 3 months and 1M SSH attempts later

#12

Post by Xorlev »

sneak wrote: post #3
tdicola wrote: post #2

If you haven't already, get fail2ban setup on the box to slow down all the attacks. And disable password login and switch to certs instead.

SSH key based auth does not use certificates. In the case of key-based-auth only, fail2ban is pointless.

I wouldn't say pointless. It wastes an attacker's time if nothing else, otherwise you're essentially allowing that attacker to continue interacting with your server, and perhaps SSH isn't their only target.

Re: 3 months and 1M SSH attempts later

#13

Post by ambiate »

Its interesting how many HN users seem to be missing the point of a honeypot. He set this up deliberately to understand the frequency/types of attacks on a random machine on the internet.

From my past experience, most of those CN computers are actually US zero day'd/patched running root kits/worms. It just happens to be that CN computers are more likely to be unpatched/running ancient software.

Re: 3 months and 1M SSH attempts later

#14

Post by WillieStevenson »

simoncion wrote: post #11
WillieStevenson wrote: post #9

Earlier quoted context omitted.

Just like it's a crime trying to ssh into a box that is not yours right? And besides I didn't do anything to the router. I was simply pointing out that you should change your default credentials and hide your router. ... should be a crime to not change the default credentials.

Did you attempt to notify that poor schmuck who stood up that AirRouter with the default username and password?

Damn it. I should of. I don't know how I would do that now though. He probably got pwned of the internet by now. lol.

Re: 3 months and 1M SSH attempts later

#16

Post by Godel_unicode »

> "Hahahahahaha, a successful login"

Congratulations, you just violated the computer fraud and abuse act. Also, bravo for laying out for every reader of this post where they can find the vulnerable router and the credentials they can use to join you in breaking the law.

This is the exact opposite of responsible disclosure; people like the author are why we will never get a less draconian cfaa. Thanks for that.

Re: 3 months and 1M SSH attempts later

#17

Post by noobermin »

ambiate wrote: post #13

Its interesting how many HN users seem to be missing the point of a honeypot. He set this up deliberately to understand the frequency/types of attacks on a random machine on the internet. From my past experience, most of those CN computers are actually US zero day'd/patched running root kits/worms. It just happens to be that CN computers are more likely to be unpatched/running ancient software.

>From my past experience

I'm curious how you know this for sure.

Re: 3 months and 1M SSH attempts later

#18

Post by muppetman »

sneak wrote: post #3
tdicola wrote: post #2

If you haven't already, get fail2ban setup on the box to slow down all the attacks. And disable password login and switch to certs instead.

SSH key based auth does not use certificates. In the case of key-based-auth only, fail2ban is pointless.

I disagree. I run it because I drop all traffic from the /24 the scan comes from. Harsh, yes, but tough luck. It cuts down on unwanted network traffic.

Re: 3 months and 1M SSH attempts later

#19

Post by ambiate »

noobermin wrote: post #17
ambiate wrote: post #13

Its interesting how many HN users seem to be missing the point of a honeypot. He set this up deliberately to understand the frequency/types of attacks on a random machine on the internet. From my past experience, most of those CN computers are actually US zero day'd/patched running root kits/worms. It just happens to be that CN computers are more likely to be unpatched/running ancient software.

>From my past experience I'm curious how you know this for sure.

I plead the fifth. CFAA/RICO/Patriot Act.

My hint would be: before decentralized worms, there were IRC hubs. The 'owners' would typically use their native language for the various commands (I know English is used in more than the US, but..). Most of the time, they wouldn't even hide their host name on the IRC server.

I guess from a 'being legal' POV: anyone could infect themselves with the same root kit that's on a honeypot and find out quite a bit about the organizers.

Re: 3 months and 1M SSH attempts later

#20

Post by abrookewood »

Godel_unicode wrote: post #16

> "Hahahahahaha, a successful login" Congratulations, you just violated the computer fraud and abuse act. Also, bravo for laying out for every reader of this post where they can find the vulnerable router and the credentials they can use to join you in breaking the law. This is the exact opposite of responsible disclosure; people like the author are why we will never get a less draconian cfaa. Thanks for that.

My thoughts exactly ... and he posted the IP addresses, passwords & usernames of the sites he was able to access. Stupid.
Post reply on HN