Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Large scale Internet SSH brute force attacks seem to have stopped here

utcc.utoronto.ca

Post reply on HN
Print view View original

31–40 of 127 posts

Re: Large scale Internet SSH brute force attacks seem to have stopped here

#31

Post by Panino »

nousermane wrote: post #8
LinuxBender wrote: post #2

I'm still seeing the same number of attempts on my public SFTP servers. As a funny side note I found that by going through the hardening steps on ssh-audit [1], most of the bots can't even negotiate a connection. I only see them because I configured verbose logging. They seem to be using really old ssh libraries in the bot code that severely limit the ciphers available to them. Another interesting side effect is that…

> [after] hardening steps [...] most of the bots can't even negotiate a connection Yep, same here, except I'm using [tinyssh], which organically does not support password-based auth, or any ciphers other than ssh-ed25519, curve25519-sha256, and chacha20-poly1305@openssh.com. [tinyssh] https://tinyssh.org/

I agree with your post and just want to add that TinySSH also supports sntrup761x25519-sha512@openssh.com for post-quantum security.

Re: Large scale Internet SSH brute force attacks seem to have stopped here

#32

Post by password4321 »

LinuxBender wrote: post #2

I'm still seeing the same number of attempts on my public SFTP servers. As a funny side note I found that by going through the hardening steps on ssh-audit [1], most of the bots can't even negotiate a connection. I only see them because I configured verbose logging. They seem to be using really old ssh libraries in the bot code that severely limit the ciphers available to them. Another interesting side effect is that…

Filtering by client works wonders in servers that support it. Nobody recompiles libssh.

Re: Large scale Internet SSH brute force attacks seem to have stopped here

#33

Post by mro_name »

banana_giraffe wrote: post #22
Frotag wrote: post #9

On a related note, set up a website a few days ago. Brand new domain, newly opened port. But I've rented this VPS for a while so I guess its IP is already on a few lists. But anyways, it's interesting watching the logs for what I assume are tests of known exploits. GET /.gitconfig HTTP/1.0" 422 Unprocessable Entity GET /.git/config HTTP/1.0" 404 Not Found GET /owa/auth/x.js HTTP/1.0" 404 Not Found GET /ecp/Current/ex…

Yep, I run a barely popular static site, but people do love trying all the attacks on it: https://gist.github.com/Q726kbXuN/85c947a5d37cb01f72f82318d0... This is two weeks of 404s

have you thought about serving them eicar?

Re: Large scale Internet SSH brute force attacks seem to have stopped here

#34

Post by nousermane »

ajp11 wrote: post #23

Fail2ban blocked 1087 ip addresses in the last week, which seems normal. I reset it and it has blocked eleven ip addresses in the last hour, mainly China and Digital Ocean as usual. Just to see what happens, I'v tried sending abuse reports about ssh brute force, vnc brute force and phishing sites, by the standard method of doing a whois lookup on the ip for the abuse email address. Some server and web hosting compani…

Honestly, I don't understand why people make reporting abuse so hard/labour-intensive.

It is trivial to record netflow data (and most networks do that already), and then verify incoming abuse reports against those records.

Re: Large scale Internet SSH brute force attacks seem to have stopped here

#35

Post by cronix »

banana_giraffe wrote: post #22
Frotag wrote: post #9

On a related note, set up a website a few days ago. Brand new domain, newly opened port. But I've rented this VPS for a while so I guess its IP is already on a few lists. But anyways, it's interesting watching the logs for what I assume are tests of known exploits. GET /.gitconfig HTTP/1.0" 422 Unprocessable Entity GET /.git/config HTTP/1.0" 404 Not Found GET /owa/auth/x.js HTTP/1.0" 404 Not Found GET /ecp/Current/ex…

Yep, I run a barely popular static site, but people do love trying all the attacks on it: https://gist.github.com/Q726kbXuN/85c947a5d37cb01f72f82318d0... This is two weeks of 404s

Instead of 404, possibly redirect them to an ad page and retire early? Half joking...

Re: Large scale Internet SSH brute force attacks seem to have stopped here

#36

Post by cesarb »

semi-extrinsic wrote: post #20
cesarb wrote: post #11

Earlier quoted context omitted.

That's why I recommend always pointing the default virtual host in the apache or nginx configuration to an empty static site, and making the real site visible only as a named virtual host (requiring the correct Host header), even when the server will be used only for a single site. Most of these automated exploit attempts will never send the correct Host header, and therefore will only see the default virtual host.

Could you give a pointer to more info on that? I couldn't find more details on such a setup while googling it.

When configuring apache or nginx, one of the virtual hosts you configure is the "default" virtual host, used when the Host header didn't match any of the virtual hosts. IIRC, on nginx, you explicitly say on the virtual host "this is the default", while on apache, it's either the first or the last (forgot which one).

How to configure that virtual host is up to you; the simplest configuration would be to point its document root to an empty directory, and add a couple of access control directives to deny access to it from all IP addresses.

Re: Large scale Internet SSH brute force attacks seem to have stopped here

#37

Post by bestes »

Frotag wrote: post #9

On a related note, set up a website a few days ago. Brand new domain, newly opened port. But I've rented this VPS for a while so I guess its IP is already on a few lists. But anyways, it's interesting watching the logs for what I assume are tests of known exploits. GET /.gitconfig HTTP/1.0" 422 Unprocessable Entity GET /.git/config HTTP/1.0" 404 Not Found GET /owa/auth/x.js HTTP/1.0" 404 Not Found GET /ecp/Current/ex…

All of these HTTP/1.0 requests look just like a scanner that the security team would run again my internal site. Every day.

Re: Large scale Internet SSH brute force attacks seem to have stopped here

#38

Post by arjvik »

lynndotpy wrote: post #17

Just yesterday I recently exposed SSH on a machine that had never had it exposed, on a router that had port 22 closed. Over the few hours it was open, my access log had about a hundred attempts against it.

It's not hard to scan the entire IPv4 address space, I doubt there is much use for lists of accessible servers.

Re: Large scale Internet SSH brute force attacks seem to have stopped here

#39

Post by _wldu »

I still see them. They come and go, but are always present at some level.

    2022-08-29T17:35:12.617Z [DEBUG] sshlog gen 113.61.219.237 admin admin SSH-2.0-HELLOWORLD
    2022-08-29T17:48:17.879Z [DEBUG] sshlog gen 218.92.0.190 root poohbear SSH-2.0-PUTTY
    2022-08-29T17:48:18.041Z [DEBUG] sshlog gen 218.92.0.190 root p@ssw0rd3 SSH-2.0-PUTTY
    2022-08-29T17:48:18.2Z [DEBUG] sshlog gen 218.92.0.190 root p@ssword! SSH-2.0-PUTTY
    2022-08-29T17:50:13.507Z [DEBUG] sshlog gen 185.191.205.92 hl hl SSH-2.0-libssh-0.6.3
    2022-08-29T17:52:57.28Z [DEBUG] sshlog gen 138.68.91.192 victoria abc123 SSH-2.0-libssh-0.6.3

Re: Large scale Internet SSH brute force attacks seem to have stopped here

#40

Post by nousermane »

arjvik wrote: post #38
lynndotpy wrote: post #17

Just yesterday I recently exposed SSH on a machine that had never had it exposed, on a router that had port 22 closed. Over the few hours it was open, my access log had about a hundred attempts against it.

It's not hard to scan the entire IPv4 address space, I doubt there is much use for lists of accessible servers.

"Not hard", to say the least, yeah:

https://github.com/robertdavidgraham/masscan

Post reply on HN