Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Anonymous person sent proof of SSH access to our production server

news.ycombinator.com

Post reply on HN
Print view View original

81–90 of 246 posts

Re: Ask HN: Anonymous person sent proof of SSH access to our production server

#81

Post by laumars »

calgoo wrote: post #75
laumars wrote: post #43

In terms of hardening against SSH attacks, the principles are quite simple. Your business case might mean that some of the following cannot be applied, but there's plenty of measures below that you can use to harden SSH. 1. firewall - only allow SSH connections from trusted static IPs 2. Use SSH keys then disable password logins. Lots of guides online to create keys, so I'll just cover the 2nd point: as root or sudo,…

Also, to get rid of 60% of the script kiddies, change the port to something high 1000+ (or even better 10000+). Its not a great option, but it does lower the amount of automated attacks that you get.

I'm not a fan of that option because it's causes an inconvenience for legitimate usage without offering any real security benefits. If you've hardened sshd then the biggest benefit you get from changing the port number is reducing the size of your log files. If you've not hardened sshd then you're just one nmap (et al) scan away from being in the same boat as you were previously.

If you really want to hide SSH from script kiddies then you're better off setting up firewall rules to whitelist trusted IPs. Heck, even port knocking[1] would be a better option than changing the port number.

[1] https://en.wikipedia.org/wiki/Port_knocking

Re: Ask HN: Anonymous person sent proof of SSH access to our production server

#82

Post by Mahn »

NTripleOne wrote: post #77
dleslie wrote: post #73

Earlier quoted context omitted.

Ask for a BTC address and send a tip.

Alternatively, ask them for their preferred payment method and don't force your FOTMcoin on them.

I assume he suggested Bitcoin because it's still a good way to handle money anonymously. If the person that breached the server wants to remain anonymous but get paid, that's pretty much the only way to go.

Re: Ask HN: Anonymous person sent proof of SSH access to our production server

#83

Post by JasuM »

calgoo wrote: post #75
laumars wrote: post #43

In terms of hardening against SSH attacks, the principles are quite simple. Your business case might mean that some of the following cannot be applied, but there's plenty of measures below that you can use to harden SSH. 1. firewall - only allow SSH connections from trusted static IPs 2. Use SSH keys then disable password logins. Lots of guides online to create keys, so I'll just cover the 2nd point: as root or sudo,…

Also, to get rid of 60% of the script kiddies, change the port to something high 1000+ (or even better 10000+). Its not a great option, but it does lower the amount of automated attacks that you get.

I'd be very cautious before moving SSH to a non-privileged port (over 1024). Any user on the server might start their own SSH server on the port assuming the real SSH server is dead. While this is hard to exploit (needs access to normal user, needs to kill real SSH server, need to get around SSH server key checking), it still is at least a theoretical reduction in security.

Re: Ask HN: Anonymous person sent proof of SSH access to our production server

#85

Post by ChristianBundy »

Mahn wrote: post #82
NTripleOne wrote: post #77

Earlier quoted context omitted.

Alternatively, ask them for their preferred payment method and don't force your FOTMcoin on them.

I assume he suggested Bitcoin because it's still a good way to handle money anonymously. If the person that breached the server wants to remain anonymous but get paid, that's pretty much the only way to go.

I assume he suggested asking them because Bitcoin isn't the only cryptocurrency.

Re: Ask HN: Anonymous person sent proof of SSH access to our production server

#86

Post by lucb1e »

eeZah7Ux wrote: post #53

Do not trust random HN or serverfault answers. Cleanly shutting down the server can trigger rootkits that might wipe evidence: talk to a professional. Pulling the plug can still remove the ability to observe the behavior of the attacker: talk to a professional. Touching the disks can expose you to the risk of being accused of tampering evidence : talk to a professional.

Rely on a single answer? That sounds like a bad idea. Considering advice from a bunch of accounts that are active, not 3 days old, and many of them overlap or say the same thing? Or an answer with many upvotes and no odd comments on serverfault/security.stackexchange.com? I think that's as good advice as you're going to get from any security firm.

Re: Ask HN: Anonymous person sent proof of SSH access to our production server

#87

Post by dustingetz »

Since this is most likely a script kiddie assuming nobody cares enough about you to deliberately target you, If it was my company I would 1) lawyer and 2) Ask him how he did it, most script kiddies would love to tell you how awesome they are, 3) fix the problem 4) give him a couple BTC under the condition that he blog anonymously

Re: Ask HN: Anonymous person sent proof of SSH access to our production server

#89

Post by lucb1e »

calebm wrote: post #57

Call an Incident Response company like Mandiant.

Many comments say "find & hire an expert" which is kind of vague and would take a few days probably. This comment is actually really good I think, way too low in the thread. An incident response team (of which there are plenty, and kudos for naming one, that makes it even quicker and more concrete) will know what step number one is to do right now (e.g. "make an image and bring it down"), before even officially hiring them to do further incident response and analysis.

Re: Ask HN: Anonymous person sent proof of SSH access to our production server

#90

Post by cgriswald »

dozzie wrote: post #65
dimino wrote: post #55

Earlier quoted context omitted.

Hire someone because they exploited a single vulnerability?

I've heard of much worse hiring practices than to base on a single display of competence.

In the late nineties/early aughts, I worked for a company that hired a pair of guys after those guys showed up holding basically all the data from one of the company's services. The company started using these guys' custom software instead.

The server running this software was in our main server room although it was technically not our department. So one day, when a fairly serious bug was found, I had to chaperone the non-technical person into the service room. She was on the phone with these guys. For political reasons within the company, all I could do was watch. They instructed her, over the phone, symbol-and-letter by symbol-and-letter to add to live production code. What they added? A giant "if false" block around the buggy code.

Post reply on HN