Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare's new DNS attracting 'gigabits per second' of rubbish

zdnet.com

Post reply on HN
Print view View original

161–170 of 206 posts

Re: Cloudflare's new DNS attracting 'gigabits per second' of rubbish

#161

Post by adrianpike »

tzs wrote: post #160
api wrote: post #119

Earlier quoted context omitted.

Even for regular IPv4s you often get upwards of 20-40k SSH probes per day trying common passwords against root. IPv6 largely makes this go away since it's too big to brute force scan.

> Even for regular IPv4s you often get upwards of 20-40k SSH probes per day trying common passwords against root So...anyone here ever set up a throwaway machine with root ssh enabled with one of those common passwords, so that some of those could get in, so you could see what they actually try to do once they are in? If so, what did you see?

Yes, this is a pretty common practice. Take a look at the Honeypot wikipedia page and enjoy the rabbit hole. :)

Re: Cloudflare's new DNS attracting 'gigabits per second' of rubbish

#162

Post by ChuckMcM »

tzs wrote: post #160
api wrote: post #119

Earlier quoted context omitted.

Even for regular IPv4s you often get upwards of 20-40k SSH probes per day trying common passwords against root. IPv6 largely makes this go away since it's too big to brute force scan.

> Even for regular IPv4s you often get upwards of 20-40k SSH probes per day trying common passwords against root So...anyone here ever set up a throwaway machine with root ssh enabled with one of those common passwords, so that some of those could get in, so you could see what they actually try to do once they are in? If so, what did you see?

Yes. And a lot of script kiddies (people who were just using easily acquired scripts to attempt to break into hosts). Looking at the sequence of password hashes you could tell some of these scripts were just fed the 'most popular password' list and were working their way down the list.

Re: Cloudflare's new DNS attracting 'gigabits per second' of rubbish

#164

Post by reaperducer »

sli wrote: post #153
ams6110 wrote: post #126

Earlier quoted context omitted.

At my work, we treat our own internal network as a hostile entity. Defense in depth.

Same here. Devs can't even mount thumbdrives. Which is fine for us, we don't need them, but it prevents some funny business should one of our laptops get stolen.

Ditto. No flash drives except for special ones distributed by the IT department, and even then it takes a few months of reviews to get one.

But we go one further — no development on the LAN. Develop on another server at a different hosting company, and only deploy on the production host when thoroughly vetted.

Re: Cloudflare's new DNS attracting 'gigabits per second' of rubbish

#165

Post by karlshea »

notzorbo3 wrote: post #137
threeseed wrote: post #129

Earlier quoted context omitted.

> Anyone who relies on SMS for any type of authentication should stop Err. That's pretty much every implementation of 2FA around the world. Why isn't this more well known ?

The beauty of it is cases like Google's. They have this bizarre 2FA security-theater Google Authenticator thing, but then nearly force everyone to have their phonenumber as a "backup device". Guess what the send you when you forget your 2FA or password? Yep, an SMS. So out the door goes the whole point of 2FA. Your three factors (account name / email address + password + Google Authenticator) have now been reduced to…

Once you add another factor you can remove SMS from your Google account. I’ve done it with all of mine.

Edit: Oh, you said that.

Re: Cloudflare's new DNS attracting 'gigabits per second' of rubbish

#166

Post by hirsin »

walrus01 wrote: post #71
jakeogh wrote: post #69

Earlier quoted context omitted.

I canceled my decade old COX account last time that happened. Even asked nicely not to "help" by editing traffic, the runaround was fun. At the end they offered to take my ~$90/mo to ~$70; re-confirming they had no idea what I was unhappy about.

A $12/hour call center customer retention worker in rural TN has no idea what you're complaining about, their job is simply to meet some retention metrics on a weekly basis. Even if you can actually reach the people who run the ASN of your ISPs, if it something big like Cox, charter, Shaw, etc, they'll be politically unable to confirm or deny anything, and won't want to talk to you. You might get a straight answer if…

Impressively (given the rest of the company), Comcast DNS is on twitter [1] and is fairly responsive/tech savvy and unrestrained. It feels like someone in the department got one over on management - "look, if you get in our way things break real fast. Trust we know what we're doing and you won't get calls about state.gov being blackholed".

1. https://twitter.com/ComcastDNS

Re: Cloudflare's new DNS attracting 'gigabits per second' of rubbish

#167

Post by ericfrederich »

tzs wrote: post #160
api wrote: post #119

Earlier quoted context omitted.

Even for regular IPv4s you often get upwards of 20-40k SSH probes per day trying common passwords against root. IPv6 largely makes this go away since it's too big to brute force scan.

> Even for regular IPv4s you often get upwards of 20-40k SSH probes per day trying common passwords against root So...anyone here ever set up a throwaway machine with root ssh enabled with one of those common passwords, so that some of those could get in, so you could see what they actually try to do once they are in? If so, what did you see?

This is called a Honeypot.

https://www.youtube.com/results?search_query=ssh+honeypot

Re: Cloudflare's new DNS attracting 'gigabits per second' of rubbish

#168

Post by hirsin »

notzorbo3 wrote: post #137
threeseed wrote: post #129

Earlier quoted context omitted.

> Anyone who relies on SMS for any type of authentication should stop Err. That's pretty much every implementation of 2FA around the world. Why isn't this more well known ?

The beauty of it is cases like Google's. They have this bizarre 2FA security-theater Google Authenticator thing, but then nearly force everyone to have their phonenumber as a "backup device". Guess what the send you when you forget your 2FA or password? Yep, an SMS. So out the door goes the whole point of 2FA. Your three factors (account name / email address + password + Google Authenticator) have now been reduced to…

I just removed my SMS from Google auth, thanks! And set up an Authenticator (Azure). I would like to see a world where we start removing SMS (and old passwords) from existing accounts.

Re: Cloudflare's new DNS attracting 'gigabits per second' of rubbish

#169

Post by acdha »

walrus01 wrote: post #155
acdha wrote: post #149

Earlier quoted context omitted.

Washington DC - my neighborhood has Comcast, RCN, and Verizon. Our neighbors report better service on all three — and when you go a couple blocks south where the FIOS rollout stopped, regression to normal sets in for Comcast. We also have municipal fiber but they’ve chosen not to make that available for residential service which is really disappointing but … politics.

So, channel bonded docsis3.0 and 3.1 on Comcast and rcn, and gpon fiber from Verizon? Or are the cable operators also doing singlemode to the house now?

Definitely for RCN. Comcast ads have claimed fiber but I don’t know whether that’s available or just planned since I won’t do business with Comcast.

Re: Cloudflare's new DNS attracting 'gigabits per second' of rubbish

#170

Post by jonny_eh »

jakobegger wrote: post #80

From a marketing point of view, I think it was a brilliant move from Cloudflare to get the 1.1.1.1 address. Clearly better than 8.8.8.8! But from a user perspective, why couldn't they have just let that address be... So many things are going to break just because Cloudflare wants a pretty IP. Sure, the things that break were using a hack, but in my opinion that doesn't automatically make it okay to break it. Now I'm…

They also provide 1.0.0.1, easy enough to set that up as your client's backup.
Post reply on HN