Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

3 months and 1M SSH attempts later

livesshattack.net

Post reply on HN
Print view View original

61–69 of 69 posts

Re: 3 months and 1M SSH attempts later

#61

Post by rmdoss »

matt_wulfeck wrote: post #45
rmdoss wrote: post #34

Earlier quoted context omitted.

Better yet, deploy OSSEC there. I would recommend it with the latest patches from here: https://dcid.me/ossec/

It's just another thing you need running on the server that must stay patched forever. In my opinion less is better. RSA/4096-bit key encryption only. I don't even care if you use the root user. The ability for someone to crack a 4096-bit key is impossible in practice, and if your SSH server has a bug then it doesn't matter what fancy things you have setup.

It is fine for a 1-man server, but if you have multiple users and you have to be on top of things, then you need a bit more than that.

Specially to look at successful logins and audit where they come from. This is a good blog post on the subject:

https://blog.sucuri.net/2016/03/server-security-anomaly-beha...

Re: 3 months and 1M SSH attempts later

#63

Post by pdkl95 »

julie1 wrote: post #60
pdkl95 wrote: post #59

Earlier quoted context omitted.

That "convenient way" has been incredibly damaging to the internet. The primary benefit of the internet was that every peer can publish without needing permission of a 3rd party. IP Masquerading / NAT removes that ability, and has cause a massive amount of centralization. These gatekeepers are necessary to workaround the limitations of every host having to share a party line . Regular use of RFC 1918 for most hosts h…

one of the benefit of NATing that it is mentally easier to recongize inbound and outbound traffic in firewall rules. It has been used as a way to centralize traffic by some rogue ISP, and then because Large Scale Nating involve to hold in memory a lot of state considered bad practices because it was costing money to ISPs. (plus FW redondancy/HA in NAT require to synchronize states with CARP or CISCO techs). But NATin…

> NATing that it is mentally easier

"Because it's easier" is a terrible reason to break the internet and limit the development of networking software such that proper direct-connections (in either peer-or-peer or client-server style) are useless and a centralized 3rd party is required to negotiate the connection and/or manage the NAT hole-punching.

You're talking about convenience for a specific set of tools, when the problem is about freedom to publish without middlemen.

> a way to centralize traffic by some rogue ISP

ISPs have little[1] to do with this. I'm not talking about centralization by the ISPs; I'm talking about how network software such as VOIP should be making direct connections once the address is known, which is impossible due to NAT. Instead, we have Skype with Microsoft in a de facto position of control over a lot of the "voice chat" ecosystem.

> enables templates to be easily shared and understood

I'm sure the file-format for those templates can be extended to support a placeholder/variable/macro for local addresses.

> NATing behind the POP of the customer

That's my entire point. This is how the internet was turned into a "two tier" system, where some hosts can use listen(2)/accept(2) usefully, but everyone else has to ask permission of the incumbent feudal lord for permission if they want to accept a connection.

You seem to prefer trading that ability for an internet that resembles the "cable tv" model instead of a network of equal peers (in the protocol). I hope having convenient firewall templates was worth it.

[1] other than dragging their feet on IPv6 for the last ~15 years, which removes the need for any type fo NAT

Re: 3 months and 1M SSH attempts later

#64

Post by Godel_unicode »

im3w1l wrote: post #55
Godel_unicode wrote: post #16

> "Hahahahahaha, a successful login" Congratulations, you just violated the computer fraud and abuse act. Also, bravo for laying out for every reader of this post where they can find the vulnerable router and the credentials they can use to join you in breaking the law. This is the exact opposite of responsible disclosure; people like the author are why we will never get a less draconian cfaa. Thanks for that.

On a tangent, how will the next generation of hackers learn the ropes? Will they be hopelessly outclassed by their foreign peers?

More or less the same way we did? Reading about vulnerabilities, reviewing metasploit modules, fuzzing applications on your local box, reading hack post-mortems (all of which is SOOO much easier than it used to be).

They will also have the huge leg-up of being able to download vm images like Kali and DamnVulnerable{Linux, WebApp} to practice with/on. When I think about how much time I spent early in my career hand-rolling a vulnerable machine so I could try out some new msf module, only to crash my laptop when it executed and have to start over...

This myth that everyone learned by hacking actual websites etc, and therefore this is the only (or even the best) way to learn needs to die in fire. Lots of elite practitioners learned their craft without doing anything that would be considered remotely illegal.

Re: 3 months and 1M SSH attempts later

#65

Post by simoncion »

viraptor wrote: post #39
WillieStevenson wrote: post #32

Earlier quoted context omitted.

Look. Malicious boxes are attacking me. Although I must be politically correct in this situation to probably please everyone, while I probably shouldn't have logged into the router in question, I would prefer to publish such IPs because they have the potential to harm other machines. Actually that particular IP attacked me more than 170 times. It may be useful to others to keep this address on their "naughty" list of…

I don't think there's a need to publish those addresses. There are already lists with those IPs available ( https://www.openbl.org/ ). Telling people that the IP had default password on the router will only cause the problem to the owner who may not even be aware of the attack. Proxies / worms for ssh scanning are very common, so maybe you just helped people break some Joe Random's home network.

> I don't think there's a need to publish those addresses. There are already lists with those IPs available...

Interestingly, the IP address of that router is _not_ present in either the base (attacks within the past 360 days) list or the delisted (manually removed from the base list by the person in question) list.

It's almost like no single list is terribly likely to be complete, and that publishing collation of a master list is required for completeness. :)

Re: 3 months and 1M SSH attempts later

#66

Post by simoncion »

Godel_unicode wrote: post #27
WillieStevenson wrote: post #14

Earlier quoted context omitted.

Damn it. I should of. I don't know how I would do that now though. He probably got pwned of the internet by now. lol.

Pretty clear that he'd been popped already, you realize that's what all of those ptr records that are IP.ISP are, right? Some random person who clicked on something they shouldn't have and is now part of a botnet which is continuously trying to brute force other boxes.

> Some random person who clicked on something they shouldn't have and is now part of a botnet which is continuously trying to brute force other boxes.

No. Some random sysadmin stood up some business-tier gear and failed to change the factory default, static username and password. He then also failed to restrict access to the built-in web server and SSH server to only a trusted set of machines.

Re: 3 months and 1M SSH attempts later

#67

Post by sneak »

muppetman wrote: post #18
sneak wrote: post #3

Earlier quoted context omitted.

SSH key based auth does not use certificates. In the case of key-based-auth only, fail2ban is pointless.

I disagree. I run it because I drop all traffic from the /24 the scan comes from. Harsh, yes, but tough luck. It cuts down on unwanted network traffic.

That's a pretty significant denial of service you open yourself up to. If someone shows up bruteforcing you from randomly allocated AWS or Digital Ocean cloud instance public IPs that happen to land in the same /24 as other AWS- or DO-hosted services (Heroku comes to mind, but also any other monitoring, log aggregation, analytics, data processing, et c) your machine depends on, they've convinced your system to cut connectivity to them. Not the best setup...

Re: 3 months and 1M SSH attempts later

#68

Post by achillean »

voltagex_ wrote: post #44
achillean wrote: post #38

Earlier quoted context omitted.

Please don't rely on that alone: https://blog.shodan.io/hiding-in-plain-sight/

strangely, searching Shodan for product:ssh port:443 finds nothing - when I know there are boxes around running sslh or similar to run both SSH and HTTPS on the same port. Seems like you can hide in plain sight when the scanner has no idea you're there.

https://www.shodan.io/search?query=port%3A80+openssh

It's really just a matter of time. There are many things you can do to protect yourself and changing the port is one of them, but if you rely on it you're going to have a bad time.

Re: 3 months and 1M SSH attempts later

#69

Post by achillean »

voltagex_ wrote: post #44
achillean wrote: post #38

Earlier quoted context omitted.

Please don't rely on that alone: https://blog.shodan.io/hiding-in-plain-sight/

strangely, searching Shodan for product:ssh port:443 finds nothing - when I know there are boxes around running sslh or similar to run both SSH and HTTPS on the same port. Seems like you can hide in plain sight when the scanner has no idea you're there.

Try this: https://www.shodan.io/search?query=port%3A443+product%3A%22O...
Post reply on HN