Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

3 months and 1M SSH attempts later

livesshattack.net

Post reply on HN
Print view View original

31–40 of 69 posts

Re: 3 months and 1M SSH attempts later

#31

Post by xupybd »

ambiate wrote: post #28
xupybd wrote: post #25

Earlier quoted context omitted.

>Congratulations, you just violated the computer fraud and abuse act. How can that be illegal? Granted publishing it should be, but simply testing if someone has left the default password?

CFAA is very broad. "intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains— C) information from any protected computer;" A court could see "ambiate was authorized to use the work printer for printing -- ambiate hacked the printer to find out the fax machine number and sent a fax" in an absurd world. This random internet person was never authorized to access this pub…

Thanks for the info. Interesting, I can see the merit in having broad legal protection to stop people from malicious activity. But that does seem a little too broad.

Re: 3 months and 1M SSH attempts later

#32

Post by WillieStevenson »

abrookewood wrote: post #21
WillieStevenson wrote: post #14

Earlier quoted context omitted.

Damn it. I should of. I don't know how I would do that now though. He probably got pwned of the internet by now. lol.

Dude, it's not funny. You're coming across like a script kiddie and it's not welcome here. You've just posted the credentials to someone's site that has probably been compromised and you're treating it like a joke. Go back and redact the IP addresses of those sites & devices before you get yourself into trouble.

Look. Malicious boxes are attacking me. Although I must be politically correct in this situation to probably please everyone, while I probably shouldn't have logged into the router in question, I would prefer to publish such IPs because they have the potential to harm other machines.

Actually that particular IP attacked me more than 170 times. It may be useful to others to keep this address on their "naughty" list of hosts to ban.

Re: 3 months and 1M SSH attempts later

#35

Post by Godel_unicode »

ambiate wrote: post #19
noobermin wrote: post #17

Earlier quoted context omitted.

>From my past experience I'm curious how you know this for sure.

I plead the fifth. CFAA/RICO/Patriot Act. My hint would be: before decentralized worms, there were IRC hubs. The 'owners' would typically use their native language for the various commands (I know English is used in more than the US, but..). Most of the time, they wouldn't even hide their host name on the IRC server. I guess from a 'being legal' POV: anyone could infect themselves with the same root kit that's on a h…

Or just read any botnet takedown report, this is exactly what botnets do. Why bother looking for 0day when root:toor or cisco:cisco works?

Re: 3 months and 1M SSH attempts later

#36

Post by est »

Godel_unicode wrote: post #33
est wrote: post #29

I changed my SSH login banner text to > Permission denied, please try again. To confuse people. No matter failed or successful login, the prompt text will always be like that.

You deny them permission, then grant them permission to try again?

No matter failed or successful login, the prompt text will always be

> Permission denied, please try again

Re: 3 months and 1M SSH attempts later

#37

Post by yeukhon »

Showing off stuff like this is considered stupid, childish and idiotic. Based on the cache version of his publication, I am extremely tempted to report this to the proper authority. Not only you should stop publishing this kind of information, you should stop your project.

Re: 3 months and 1M SSH attempts later

#39

Post by viraptor »

WillieStevenson wrote: post #32
abrookewood wrote: post #21

Earlier quoted context omitted.

Dude, it's not funny. You're coming across like a script kiddie and it's not welcome here. You've just posted the credentials to someone's site that has probably been compromised and you're treating it like a joke. Go back and redact the IP addresses of those sites & devices before you get yourself into trouble.

Look. Malicious boxes are attacking me. Although I must be politically correct in this situation to probably please everyone, while I probably shouldn't have logged into the router in question, I would prefer to publish such IPs because they have the potential to harm other machines. Actually that particular IP attacked me more than 170 times. It may be useful to others to keep this address on their "naughty" list of…

I don't think there's a need to publish those addresses. There are already lists with those IPs available (https://www.openbl.org/). Telling people that the IP had default password on the router will only cause the problem to the owner who may not even be aware of the attack. Proxies / worms for ssh scanning are very common, so maybe you just helped people break some Joe Random's home network.

Re: 3 months and 1M SSH attempts later

#40

Post by viraptor »

sneak wrote: post #3
tdicola wrote: post #2

If you haven't already, get fail2ban setup on the box to slow down all the attacks. And disable password login and switch to certs instead.

SSH key based auth does not use certificates. In the case of key-based-auth only, fail2ban is pointless.

Actually it can use certificates. Not X509, but still simplified ones.
Post reply on HN