Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Large scale Internet SSH brute force attacks seem to have stopped here

utcc.utoronto.ca

Post reply on HN
Print view View original

21–30 of 127 posts

Re: Large scale Internet SSH brute force attacks seem to have stopped here

#21

Post by vlan0 »

nousermane wrote: post #8
LinuxBender wrote: post #2

I'm still seeing the same number of attempts on my public SFTP servers. As a funny side note I found that by going through the hardening steps on ssh-audit [1], most of the bots can't even negotiate a connection. I only see them because I configured verbose logging. They seem to be using really old ssh libraries in the bot code that severely limit the ciphers available to them. Another interesting side effect is that…

> [after] hardening steps [...] most of the bots can't even negotiate a connection Yep, same here, except I'm using [tinyssh], which organically does not support password-based auth, or any ciphers other than ssh-ed25519, curve25519-sha256, and chacha20-poly1305@openssh.com. [tinyssh] https://tinyssh.org/

>which organically does not support password-based auth

This is the way. Everything else is just gravy imo.

Re: Large scale Internet SSH brute force attacks seem to have stopped here

#22

Post by banana_giraffe »

Frotag wrote: post #9

On a related note, set up a website a few days ago. Brand new domain, newly opened port. But I've rented this VPS for a while so I guess its IP is already on a few lists. But anyways, it's interesting watching the logs for what I assume are tests of known exploits. GET /.gitconfig HTTP/1.0" 422 Unprocessable Entity GET /.git/config HTTP/1.0" 404 Not Found GET /owa/auth/x.js HTTP/1.0" 404 Not Found GET /ecp/Current/ex…

Yep, I run a barely popular static site, but people do love trying all the attacks on it:

https://gist.github.com/Q726kbXuN/85c947a5d37cb01f72f82318d0...

This is two weeks of 404s

Re: Large scale Internet SSH brute force attacks seem to have stopped here

#23

Post by ajp11 »

Fail2ban blocked 1087 ip addresses in the last week, which seems normal.

I reset it and it has blocked eleven ip addresses in the last hour, mainly China and Digital Ocean as usual.

Just to see what happens, I'v tried sending abuse reports about ssh brute force, vnc brute force and phishing sites, by the standard method of doing a whois lookup on the ip for the abuse email address.

Some server and web hosting companies take the inconvenient approach of having an email auto-reply that says "we ignore all emailed abuse reports, you must use this web form", sometimes requiring a captcha.

When I reported a load of boxes attempting brute force logins, most complaints disappeared into the void.

I got a few responses from virtual server providers saying "no response from the customer after two weeks so we shut down the box" and one CC:ed email that appeared to be from an end user saying "we have reinstalled the box and changed the password."

Re: Large scale Internet SSH brute force attacks seem to have stopped here

#24

Post by jbverschoor »

cesarb wrote: post #11
Frotag wrote: post #9

On a related note, set up a website a few days ago. Brand new domain, newly opened port. But I've rented this VPS for a while so I guess its IP is already on a few lists. But anyways, it's interesting watching the logs for what I assume are tests of known exploits. GET /.gitconfig HTTP/1.0" 422 Unprocessable Entity GET /.git/config HTTP/1.0" 404 Not Found GET /owa/auth/x.js HTTP/1.0" 404 Not Found GET /ecp/Current/ex…

That's why I recommend always pointing the default virtual host in the apache or nginx configuration to an empty static site, and making the real site visible only as a named virtual host (requiring the correct Host header), even when the server will be used only for a single site. Most of these automated exploit attempts will never send the correct Host header, and therefore will only see the default virtual host.

Fail2van with some good nginx filters to ban scans works really well

Re: Large scale Internet SSH brute force attacks seem to have stopped here

#26

Post by bitwrangler »

kgeist wrote: post #18
Frotag wrote: post #9

On a related note, set up a website a few days ago. Brand new domain, newly opened port. But I've rented this VPS for a while so I guess its IP is already on a few lists. But anyways, it's interesting watching the logs for what I assume are tests of known exploits. GET /.gitconfig HTTP/1.0" 422 Unprocessable Entity GET /.git/config HTTP/1.0" 404 Not Found GET /owa/auth/x.js HTTP/1.0" 404 Not Found GET /ecp/Current/ex…

I've had this, too, and it later turned out that it was the VPS provider itself scanning my new instance for vulnerabilities.

Was it actually the provider scanning, or just a compromised VPS host using that same provider?

It does seem proactive to scan customers' hosts then notify them if exploits are found.

Re: Large scale Internet SSH brute force attacks seem to have stopped here

#27

Post by [deleted] »

ajp11 wrote: post #23

Fail2ban blocked 1087 ip addresses in the last week, which seems normal. I reset it and it has blocked eleven ip addresses in the last hour, mainly China and Digital Ocean as usual. Just to see what happens, I'v tried sending abuse reports about ssh brute force, vnc brute force and phishing sites, by the standard method of doing a whois lookup on the ip for the abuse email address. Some server and web hosting compani…

[deleted]

Re: Large scale Internet SSH brute force attacks seem to have stopped here

#28

Post by orangepurple »

ajp11 wrote: post #23

Fail2ban blocked 1087 ip addresses in the last week, which seems normal. I reset it and it has blocked eleven ip addresses in the last hour, mainly China and Digital Ocean as usual. Just to see what happens, I'v tried sending abuse reports about ssh brute force, vnc brute force and phishing sites, by the standard method of doing a whois lookup on the ip for the abuse email address. Some server and web hosting compani…

I am genuinely surprised that the virtual server providers responded meaningfully to the abuse complaints and took action. Good job reporting the scum.

Re: Large scale Internet SSH brute force attacks seem to have stopped here

#29

Post by nousermane »

NovemberWhiskey wrote: post #25
vbezhenar wrote: post #3

Did someone record which username/passwords those bots try? I never bothered with that.

Logging passwords for failed logins is an awful security anti-pattern; please don't do that.

Hint: you'll get quite a few of real passwords with 1-letter typo, written to disk in plan text, and probably copied to 5 different places, possibly some of them external.

Re: Large scale Internet SSH brute force attacks seem to have stopped here

#30

Post by matoro »

cesarb wrote: post #11
Frotag wrote: post #9

On a related note, set up a website a few days ago. Brand new domain, newly opened port. But I've rented this VPS for a while so I guess its IP is already on a few lists. But anyways, it's interesting watching the logs for what I assume are tests of known exploits. GET /.gitconfig HTTP/1.0" 422 Unprocessable Entity GET /.git/config HTTP/1.0" 404 Not Found GET /owa/auth/x.js HTTP/1.0" 404 Not Found GET /ecp/Current/ex…

That's why I recommend always pointing the default virtual host in the apache or nginx configuration to an empty static site, and making the real site visible only as a named virtual host (requiring the correct Host header), even when the server will be used only for a single site. Most of these automated exploit attempts will never send the correct Host header, and therefore will only see the default virtual host.

With nginx I also set the return code to 444 on the default virtual host, this is not a real status code but instead tells nginx to kill any connections to this vhost at the TCP level.
Post reply on HN