Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Observations from two weeks of SSH brute force attacks

lightbluetouchpaper.org

Post reply on HN
Print view View original

11–20 of 55 posts

Re: Observations from two weeks of SSH brute force attacks

#11

Post by khafra »

flpmor wrote: post #8

I think that a more reasonable explanation could be that the attackers were careless about building the dictionary. If it's built by parsing files and you feed the wrong file or the parser does not work correctly you end up with a dictionary with lots of bogus entries. That seems a simpler explanation than: "The best guess is that these passwords were collected from an unhashed password database, or from a trojaned S…

Interesting idea. Assuming competence on the part of your attacker isn't as dangerous as assuming incompetence, but it can be just as mistaken.

Re: Observations from two weeks of SSH brute force attacks

#12

Post by flpmor »

khafra wrote: post #11
flpmor wrote: post #8

I think that a more reasonable explanation could be that the attackers were careless about building the dictionary. If it's built by parsing files and you feed the wrong file or the parser does not work correctly you end up with a dictionary with lots of bogus entries. That seems a simpler explanation than: "The best guess is that these passwords were collected from an unhashed password database, or from a trojaned S…

Interesting idea. Assuming competence on the part of your attacker isn't as dangerous as assuming incompetence, but it can be just as mistaken.

It could be more haste than incompetence. Anyway, if you think about massive brute force attacks like this, they are 'silly' easy no-brain attacks more likely to come from script kiddies who downloaded a tool someone else wrote than real attackers.

Re: Observations from two weeks of SSH brute force attacks

#13

Post by bwarp »

pbhjpbhj wrote: post #9
radimm wrote: post #7

Earlier quoted context omitted.

sure, I hope nobody is using password based authentication for SSH anyway :)

Is there an active exploit? Or are you just saying that this is the weakest form of auth for SSH?

password is the weakest form of authentication on open systems i.e. ones which you have to hand over to monkey grade users.

If you have a reasonable password policy yourself, I very much doubt it will cause you any problems.

I've been attacked by these for 10 years, probably totalling millions of attempts and I have a user name in their databases but due to a sensible password, nothing has got in.

I tend to use PKI and keyboard interactive logins though.

Re: Observations from two weeks of SSH brute force attacks

#15

Post by roqetman »

radimm wrote: post #5

Just move your SSH off the port 22, hide it behind another instance and/or use fail2ban. 99% of problems with SSH scans/attacks sorted

I agree - I did this a long time ago; while it's fun to go through logs sometimes, I prefer to weed-out the general bombardment. My hits dropped from about 90 a day to 0 (after 6 months).

Re: Observations from two weeks of SSH brute force attacks

#16

Post by rwmj »

mike-cardwell wrote: post #10
radimm wrote: post #7

Earlier quoted context omitted.

sure, I hope nobody is using password based authentication for SSH anyway :)

And I hope nobody is using key based authentication for SSH without storing the private part of their SSH key on an external smart card only, which is unlocked by an external hardware pin pad. I was being pedantic of course. Password based SSH authentication is fine for 99% of the cases, as long as they use a "secure" password and don't leak it by writing it down or reusing it elsewhere.

No .. but it would damn cool if such hardware existed. Does it?

Re: Observations from two weeks of SSH brute force attacks

#17

Post by seabee »

rwmj wrote: post #16
mike-cardwell wrote: post #10

Earlier quoted context omitted.

And I hope nobody is using key based authentication for SSH without storing the private part of their SSH key on an external smart card only, which is unlocked by an external hardware pin pad. I was being pedantic of course. Password based SSH authentication is fine for 99% of the cases, as long as they use a "secure" password and don't leak it by writing it down or reusing it elsewhere.

No .. but it would damn cool if such hardware existed. Does it?

Not to my knowledge, but similar approaches have existed for a long time now e.g. RSA SecurID [0]. One day I'm going to set up my Yubikey to perform a similar purpose, but my motivation levels correlate with my paranoia :)

[0] http://www.rsa.com/node.aspx?id=1156

Re: Observations from two weeks of SSH brute force attacks

#18

Post by bradleyland »

mike-cardwell wrote: post #10
radimm wrote: post #7

Earlier quoted context omitted.

sure, I hope nobody is using password based authentication for SSH anyway :)

And I hope nobody is using key based authentication for SSH without storing the private part of their SSH key on an external smart card only, which is unlocked by an external hardware pin pad. I was being pedantic of course. Password based SSH authentication is fine for 99% of the cases, as long as they use a "secure" password and don't leak it by writing it down or reusing it elsewhere.

"as long as they..."

See, that's exactly why we don't allow password based authentication. While you can enforce strong passwords, you can't enforce that the user choose a password that is unique to your system, because you cannot know where else they may use this password.

The recent Dreamhost security disclosure is a great example. What are the chances that a contractor is using the same password for a Dreamhost shell account as they are my server? Pretty high, in my experience.

By disallowing password authentication, and requiring SSH-key auth, and requiring that contractors use a passphrase with their SSH-key, I have decreased the chances of a random break-in significantly.

Re: Observations from two weeks of SSH brute force attacks

#19

Post by munin »

rlvesco7 wrote: post #2

I've been running a similar experiment. And noticed similar things as the author. However, I decided to run an additional experiment to contact Amazon since the IP was originating from an EC2 instance. Amazon contacted me after I filed an abuse report and said they were investigating. A week goes by and I'm still getting hammered. So I email Amazon and asked when it will be resolved. No response. So I email again, ag…

this has been a problem with AWS/EC2 for the last four/five years (since its creation): http://www.gossamer-threads.com/lists/nanog/users/105399

Re: Observations from two weeks of SSH brute force attacks

#20

Post by mike-cardwell »

rwmj wrote: post #16
mike-cardwell wrote: post #10

Earlier quoted context omitted.

And I hope nobody is using key based authentication for SSH without storing the private part of their SSH key on an external smart card only, which is unlocked by an external hardware pin pad. I was being pedantic of course. Password based SSH authentication is fine for 99% of the cases, as long as they use a "secure" password and don't leak it by writing it down or reusing it elsewhere.

No .. but it would damn cool if such hardware existed. Does it?

Yes it does. And it's pretty cheap too. I have an OpenPGP v2 smart card and an SPR-532 smart card reader. I will be writing up how I did it on my blog at https://grepular.com/blog/ probably next week. Need to find an hour or two to write the thing up.
Post reply on HN