Observations from two weeks of SSH brute force attacks
lightbluetouchpaper.org
Observations from two weeks of SSH brute force attacks
1–10 of 55 posts
Re: Observations from two weeks of SSH brute force attacks
#2I've been running a similar experiment. And noticed similar things as the author.
However, I decided to run an additional experiment to contact Amazon since the IP was originating from an EC2 instance. Amazon contacted me after I filed an abuse report and said they were investigating.
A week goes by and I'm still getting hammered. So I email Amazon and asked when it will be resolved. No response. So I email again, again, and again. I finally get a response saying they have resolved it, but I'm still getting hammered from the same IP address.
So I email them once more asking - what is it exactly you have resolved?
No response.
I presume it is not in Amazon's best interest to resolve such issues as long as people are paying for their instances....
Re: Observations from two weeks of SSH brute force attacks
#3I've been running a similar experiment. And noticed similar things as the author. However, I decided to run an additional experiment to contact Amazon since the IP was originating from an EC2 instance. Amazon contacted me after I filed an abuse report and said they were investigating. A week goes by and I'm still getting hammered. So I email Amazon and asked when it will be resolved. No response. So I email again, ag…
while that might be true, what's happening I'm quite sure can be proven to be malicious in court.
I don't like the idea that companies can turn a blind eye to illegal activity just cause they're getting a cut of the resulting profits.
Re: Observations from two weeks of SSH brute force attacks
#4I've been running a similar experiment. And noticed similar things as the author. However, I decided to run an additional experiment to contact Amazon since the IP was originating from an EC2 instance. Amazon contacted me after I filed an abuse report and said they were investigating. A week goes by and I'm still getting hammered. So I email Amazon and asked when it will be resolved. No response. So I email again, ag…
It upsets me to hear this. I always wondered how Amazon handled abuse on EC2 as it's an insanely large service. At some point it has to become an issue? Does anyone have any experience with other types of abuse on EC2?
Re: Observations from two weeks of SSH brute force attacks
#5Just move your SSH off the port 22, hide it behind another instance and/or use fail2ban. 99% of problems with SSH scans/attacks sorted
Re: Observations from two weeks of SSH brute force attacks
#6Just move your SSH off the port 22, hide it behind another instance and/or use fail2ban. 99% of problems with SSH scans/attacks sorted
Or just disable password-based authentication. These "attacks" are little more than log spam and are meant to prey on systems that host novice users with weakpasswords. Require PKI and the log spam goes away.
Re: Observations from two weeks of SSH brute force attacks
#7Just move your SSH off the port 22, hide it behind another instance and/or use fail2ban. 99% of problems with SSH scans/attacks sorted
Or just disable password-based authentication. These "attacks" are little more than log spam and are meant to prey on systems that host novice users with weakpasswords. Require PKI and the log spam goes away.
sure, I hope nobody is using password based authentication for SSH anyway :)
Re: Observations from two weeks of SSH brute force attacks
#8I think that a more reasonable explanation could be that the attackers were careless about building the dictionary. If it's built by parsing files and you feed the wrong file or the parser does not work correctly you end up with a dictionary with lots of bogus entries. That seems a simpler explanation than:
"The best guess is that these passwords were collected from an unhashed password database, or from a trojaned SSH server or client."
or
"This might be due to the brute force tool not properly interpreting comments in the dictionary file, or the attacker not understanding the comment notation"
Re: Observations from two weeks of SSH brute force attacks
#9Earlier quoted context omitted.
Or just disable password-based authentication. These "attacks" are little more than log spam and are meant to prey on systems that host novice users with weakpasswords. Require PKI and the log spam goes away.
sure, I hope nobody is using password based authentication for SSH anyway :)
Is there an active exploit? Or are you just saying that this is the weakest form of auth for SSH?
Re: Observations from two weeks of SSH brute force attacks
#10Earlier quoted context omitted.
Or just disable password-based authentication. These "attacks" are little more than log spam and are meant to prey on systems that host novice users with weakpasswords. Require PKI and the log spam goes away.
sure, I hope nobody is using password based authentication for SSH anyway :)
And I hope nobody is using key based authentication for SSH without storing the private part of their SSH key on an external smart card only, which is unlocked by an external hardware pin pad.
I was being pedantic of course. Password based SSH authentication is fine for 99% of the cases, as long as they use a "secure" password and don't leak it by writing it down or reusing it elsewhere.