Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AS13335 doing SSH scanning

encryp.ch

Post reply on HN
Print view View original

11–20 of 110 posts

Re: AS13335 doing SSH scanning

#11

Post by jimsi »

jrockway wrote: post #6

This is probably Cloudflare Workers? I don't think that demanding that every ISP inspect and censor outgoing packets is ever going to work. Every network operator has their own definition of good and bad, and it's probably up to that operator to enforce it themselves. Regarding SSH, you can basically assume that 4.2 billion IPs will concurrently try every password database that exists against your server 24/7. Passwo…

Probably yes, but hey! Why do Cloudflare Worker would need SSH connection establishment? I do not asking Cloudflare to block 22/tcp entirely, but all this situation is very odd - I am seeing anomaly, reported abuse to them, but no explanation why this is happening.

About password authentication I totally agreeing with you, but this is a bit out of scope of this thread.

The only purpose of this article is to know the truth what is really happening. I have never seen such many connections to the SSH even from researchers.

Re: AS13335 doing SSH scanning

#12

Post by jimsi »

brohee wrote: post #9
jimsi wrote: post #5

Earlier quoted context omitted.

Maybe that's a case, but their abuse team hasn't replied anything in a 2 weeks about that after I gave them all timestamps and both source/destination IP addresses

What kind of answer would you expect, in all seriousness? The thing you are reporting is not illegal or even dodgy.

I expect to hear who (and why) generates that kind of traffic from cloudflare owned subnets.

Re: AS13335 doing SSH scanning

#13

Post by jimsi »

mcwhy wrote: post #10
vadfa wrote: post #4

Cloudflare has a VPN product, WARP. It's possible that they are clients of theirs doing the scanning. In any case I wouldn't think much of it. If you obsess over any garbage traffic you get you will go insane.

It could also be used for IP reputation, running ssh can be a sign of a proxy or other server/service that website owners might want to block.

I think single SYN packet would be enough to know whether this port open or not, but they trying to gather full banner.

Re: AS13335 doing SSH scanning

#15

Post by miyuru »

jimsi wrote: post #5
vadfa wrote: post #4

Cloudflare has a VPN product, WARP. It's possible that they are clients of theirs doing the scanning. In any case I wouldn't think much of it. If you obsess over any garbage traffic you get you will go insane.

Maybe that's a case, but their abuse team hasn't replied anything in a 2 weeks about that after I gave them all timestamps and both source/destination IP addresses

If your ISP and the server support IPv6, just disable SSH on IPv4.

Some of my servers don't even have any IPv4 connectivity and there haven't been any failed SSH logins over IPv6.

Re: AS13335 doing SSH scanning

#16

Post by benjojo12 »

To the best of my knowledge, the IP blocks in the 8.0.0.0/8 range announced by cloudflare are their VPN exit blocks.

I had similar issues with them in the past spewing weird traffic. Didn't really ever reach a conclusion on it, other than just reducing logging for that error condition a scanner was triggering.

Re: AS13335 doing SSH scanning

#17

Post by jimsi »

brohee wrote: post #8

What is the issue exactly? Is there any kind of exploitation attempts or is someone fishing for banners to do statistics upon? The second case is research, and legitimate...

I have asked Cloudflare about this traffic, but support says "Cloudflare helps protect sites, and accelerate them. We do not attack sites, and our network can't be used to generate attack traffic." They deny any malicious outgoing traffic, but after I have provided pcap dump they just ignoring me and do not reply anything. Very odd behaviour for researchers.

Re: AS13335 doing SSH scanning

#18

Post by jimsi »

benjojo12 wrote: post #16

To the best of my knowledge, the IP blocks in the 8.0.0.0/8 range announced by cloudflare are their VPN exit blocks. I had similar issues with them in the past spewing weird traffic. Didn't really ever reach a conclusion on it, other than just reducing logging for that error condition a scanner was triggering.

How did you discover this? Anyway thanks for additional information

Re: AS13335 doing SSH scanning

#19

Post by zinekeller »

Update: they apparently also have a paid product called "Cloudflare for Teams", which also uses the same infrastructure and are targeted for companies. Probably the reason they don't block out SSH is that companies do want SSH access - but I'm pretty sure that RDP access would be higher on the list.

My friend working in an ISP has cleared the mystery for me - it's Cloudflare's Warp product (a semi-VPN (in the "teleport to other countries" sense, not the original definition)), which can be used for free, and I'm not shocked that it is being abused. Cloudflare has also categorically denied that their Worker product allows SSH connections - it is simply not designed for that, apparently.

So I don't know how to respond to this specifically except that I didn't know Cloudflare offers a VPN (apparently a limited knocked-down one though) and I'm pretty sure that other people in other ASes scan the default SSH port - in fact, I see more and more scans from ASes of cloud providers than residential ASes, whereas five years ago I mainly saw Chinese and Brazilian residential ISPs. This is why I often move the SSH port - it's not that it improves my security posture, just so that the noise in the logs are minimised.

Re: AS13335 doing SSH scanning

#20

Post by jimsi »

miyuru wrote: post #15
jimsi wrote: post #5

Earlier quoted context omitted.

Maybe that's a case, but their abuse team hasn't replied anything in a 2 weeks about that after I gave them all timestamps and both source/destination IP addresses

If your ISP and the server support IPv6, just disable SSH on IPv4. Some of my servers don't even have any IPv4 connectivity and there haven't been any failed SSH logins over IPv6.

My OpenSSH is located on a non standard port, 22/tcp is going to the endlessh honeypot.
Post reply on HN