Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Fishing for Hackers: Analysis of a Linux Server Attack

draios.com

Post reply on HN
Print view View original

11–20 of 53 posts

Re: Fishing for Hackers: Analysis of a Linux Server Attack

#11

Post by gighi »

fragmede wrote: post #8

So a DO/Rackspace/AWS VPS with a guessable root password can expect to be cracked in ~4 hours? That's terrible! AFAIK, AWS defaults to ssh-key logins with password logins disabled. Can someone comment about Rackspace/DO?

Absolutely not, as I said in the article, I went out of the "wise" way and manually enabled:

1) Password authentication 2) Root authentication 3) Changed root password to "password"

All the providers offer fairly safe defaults, either using very random passwords or just enabling SSH keys.

Re: Fishing for Hackers: Analysis of a Linux Server Attack

#12

Post by jwcrux »

OP may also benefit from the use of an SSH honeypot. I use kippo (https://code.google.com/p/kippo/) with great success. It tracks all commands run, as well as keeps copies of all downloaded files.

In addition, it limits available commands to a certain predefined subset, allowing the host to prevent damage caused (e.g. a DoS attack in this case) by the system being compromised.

Re: Fishing for Hackers: Analysis of a Linux Server Attack

#13

Post by gighi »

Gepser wrote: post #9

¿But how did they enter? ¿Force attack?

Yes, I didn't put it in the article because it was getting too long otherwise, but the attacker immediately tried brute-forcing the root account, and after a handful of common passwords ("qwerty", "qwerty123", "pizza" among those) he found "password".

I was able to find all the attempts by looking at the I/O activity of the sshd process, and also the syslog activity recorded every attempt.

Re: Fishing for Hackers: Analysis of a Linux Server Attack

#14

Post by gighi »

jwcrux wrote: post #12

OP may also benefit from the use of an SSH honeypot. I use kippo ( https://code.google.com/p/kippo/ ) with great success. It tracks all commands run, as well as keeps copies of all downloaded files. In addition, it limits available commands to a certain predefined subset, allowing the host to prevent damage caused (e.g. a DoS attack in this case) by the system being compromised.

That's an interesting project.

Would it have recorded also statistics like the connection activity?

Seeing all the UDP traffic, and being able to trace its origin to the "@udp1 39.115.244.150 800 300" command, received not via shell but via a TCP connection, was pretty cool.

Re: Fishing for Hackers: Analysis of a Linux Server Attack

#17

Post by mbreedlove »

jwcrux wrote: post #12

OP may also benefit from the use of an SSH honeypot. I use kippo ( https://code.google.com/p/kippo/ ) with great success. It tracks all commands run, as well as keeps copies of all downloaded files. In addition, it limits available commands to a certain predefined subset, allowing the host to prevent damage caused (e.g. a DoS attack in this case) by the system being compromised.

How much success have you had?

I ran kippo for a while and it seemed that all attackers were trying to upload files over SCP, which kippo does not support. A few attackers resorted to logging in and downloading with wget. However, the vast majority of attacks ended with a failed SCP session.

Re: Fishing for Hackers: Analysis of a Linux Server Attack

#18

Post by fragmede »

gighi wrote: post #11
fragmede wrote: post #8

So a DO/Rackspace/AWS VPS with a guessable root password can expect to be cracked in ~4 hours? That's terrible! AFAIK, AWS defaults to ssh-key logins with password logins disabled. Can someone comment about Rackspace/DO?

Absolutely not, as I said in the article, I went out of the "wise" way and manually enabled: 1) Password authentication 2) Root authentication 3) Changed root password to "password" All the providers offer fairly safe defaults, either using very random passwords or just enabling SSH keys.

I covered that with 'guessable root password'

It is good to know that all providers have safe defaults, I only have experience with AWS in that regard.

Re: Fishing for Hackers: Analysis of a Linux Server Attack

#20

Post by fduran »

fragmede wrote: post #8

So a DO/Rackspace/AWS VPS with a guessable root password can expect to be cracked in ~4 hours? That's terrible! AFAIK, AWS defaults to ssh-key logins with password logins disabled. Can someone comment about Rackspace/DO?

In my case it was 5 hours http://www.fduran.com/blog/honeypots/ so although that's just another anecdote if you put up a server with an obvious dictionary ssh password, expect it to be compromised within hours.
Post reply on HN