What happened is they have gotten better at identifying worthy targets and they spray instead of bruteforce. I have dealt with compromised cloud VMs recently enough due to bad ssh password, it was a crypto mining worm, the cloud indeed is a better place to spend your resources as an attacker because most people are lazy enough to allow entire /8s of their cloud provider and because the internet can't reach it, who cares?
Large scale Internet SSH brute force attacks seem to have stopped here
91–100 of 127 posts
Re: Large scale Internet SSH brute force attacks seem to have stopped here
#92Earlier quoted context omitted.
Logging passwords for failed logins is an awful security anti-pattern; please don't do that.
Hint: you'll get quite a few of real passwords with 1-letter typo, written to disk in plan text, and probably copied to 5 different places, possibly some of them external.
I mean, you shouldn't, because you shouldn't have anything, anywhere, using password auth.
Which doesn't mean it's OK to log passwords if you do have password auth, it means it's not OK to have password auth.
Re: Large scale Internet SSH brute force attacks seem to have stopped here
#93Earlier quoted context omitted.
That's why I recommend always pointing the default virtual host in the apache or nginx configuration to an empty static site, and making the real site visible only as a named virtual host (requiring the correct Host header), even when the server will be used only for a single site. Most of these automated exploit attempts will never send the correct Host header, and therefore will only see the default virtual host.
With nginx I also set the return code to 444 on the default virtual host, this is not a real status code but instead tells nginx to kill any connections to this vhost at the TCP level.
for https, since 1.19.4 you can reject the tls handshake early https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_...
Re: Large scale Internet SSH brute force attacks seem to have stopped here
#94Since wireguard is a thing now wouldn't it be inadvisable for new deployments to put ssh on the bare internet anyway?
Why exactly is wireguard safer than ssh with keys?
Re: Large scale Internet SSH brute force attacks seem to have stopped here
#95Fail2ban blocked 1087 ip addresses in the last week, which seems normal. I reset it and it has blocked eleven ip addresses in the last hour, mainly China and Digital Ocean as usual. Just to see what happens, I'v tried sending abuse reports about ssh brute force, vnc brute force and phishing sites, by the standard method of doing a whois lookup on the ip for the abuse email address. Some server and web hosting compani…
Honestly, I don't understand why people make reporting abuse so hard/labour-intensive. It is trivial to record netflow data (and most networks do that already), and then verify incoming abuse reports against those records.
Because processing abuse tickets is hard and labor intensive. If reporting abuse to a host lead to shutdowns as swiftly as YouTube DMCA it would become a denial of service attack method. Or the abuse ticket queue would be flooded and it would take even longer to cut off bad actors. Cloud services are notorious for abuse traffic. If they were required to raise KYC requirements it might mean the end of $5/mo. VPS. Finally hosting services have an inherent conflict of interest between making money selling service and cancelling someone's account for abuse.
Re: Large scale Internet SSH brute force attacks seem to have stopped here
#96Earlier quoted context omitted.
Honestly, I don't understand why people make reporting abuse so hard/labour-intensive. It is trivial to record netflow data (and most networks do that already), and then verify incoming abuse reports against those records.
Because processing abuse tickets is hard and labor intensive. If reporting abuse to a host lead to shutdowns as swiftly as YouTube DMCA it would become a denial of service attack method. Or the abuse ticket queue would be flooded and it would take even longer to cut off bad actors. Cloud services are notorious for abuse traffic. If they were required to raise KYC requirements it might mean the end of $5/mo. VPS. Fina…
[deleted]
Re: Large scale Internet SSH brute force attacks seem to have stopped here
#97Still being attacked constantly. I gotta admit that I am a bit confused with the user names chosen:
CISCO, User, adempiere, admin1, adminstrator, alarm, alem, amanda, ansible, apache2, apc, arma3server, as, assembla, azure, azureuser, bamboo, bilbomeakine, bill, blackvoid, carlos, cds, centos, chinochan, cloud, cloudera, codeship, contributor, csgo, csgoserver, csserver, debian, default, demo, deployer, dev, device, devops, docker, dominion, ec2, ec2-user, ecs, elastic, elasticsearch, elsearch, engineer, es, esuser, eurek, for, ftp, ftp_admin, ftp_user, ftpadmin, ftpserver, ftptest, ftpuser, git, gitlab, glassfish, gmodserver, gpadmin, grav, grid, guest, hadoop, hduser, hostmetrics, jboss, jenkins, jira, john, joomla, junkbust, kafka, kevin, kibana, kubernetes, lighthouse, linkl, linkxess, localadmin, mail, marketing, mc, mcserv, mcserver, michael, mike, minecraft, momo, mongodb, netgear, netscreen, nexus, odoo, office, opc, oper, oracle, osm, osmc, pi, port, postgres, pvm, r00t, redmine, rust, rustserver, sanlang, secscan, service, spark, sphinx, squid, steam, steve, suhelper, super, support, svn, svpilot, systemd, systems, systemx, tbnet, teamspeak3, telecomadmin, test, test2, test3, test4, test6, test7, testftp, testuser, tomcat, ts3, ts3bot, ts3server, ubnt, ubuntu, uftp, upload, uploader, user, usuario, uucp, vagrant, vpn, vpnssh, web, webadmin, weblogic, wordpress, wp, wy, xbmc, xinyi, z, zabbix, zerotier-one, zyfwp
I get the basic service names, but what the heck is going on with "z" and "kevin"?
Re: Large scale Internet SSH brute force attacks seem to have stopped here
#98Earlier quoted context omitted.
Naw, advertisers are pretty good at detecting bots. Your CPM will quickly drop to 0.
Better redirect to a multi GB Linux ISO download.
Could you somehow stream an infinite stream? Like taping a circle of black paper together in a fax machine and faxing a spammer.
Re: Large scale Internet SSH brute force attacks seem to have stopped here
#99I'm still seeing the same number of attempts on my public SFTP servers. As a funny side note I found that by going through the hardening steps on ssh-audit [1], most of the bots can't even negotiate a connection. I only see them because I configured verbose logging. They seem to be using really old ssh libraries in the bot code that severely limit the ciphers available to them. Another interesting side effect is that…
I tried that tool against my Raspberry Pi which should have a reasonably-secure SSH configuration and I got a lot of warnings about: > NIST P-curves are possibly back-doored by the U.S. National Security Agency Is there any evidence of this? This seems extremely paranoid.
No smoking gun. But beyond Snowden's allegations, (a) the NSA has a history of very similar shenanigans and (b) there are readily available alternatives, so why risk it?
Re: Large scale Internet SSH brute force attacks seem to have stopped here
#100shifted port, not seeing it. Not to deny the other side benefits of speeding up the algorithm selection, and disabling simple password access.