Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Large scale Internet SSH brute force attacks seem to have stopped here

utcc.utoronto.ca

Post reply on HN
Print view View original

11–20 of 127 posts

Re: Large scale Internet SSH brute force attacks seem to have stopped here

#11

Post by cesarb »

Frotag wrote: post #9

On a related note, set up a website a few days ago. Brand new domain, newly opened port. But I've rented this VPS for a while so I guess its IP is already on a few lists. But anyways, it's interesting watching the logs for what I assume are tests of known exploits. GET /.gitconfig HTTP/1.0" 422 Unprocessable Entity GET /.git/config HTTP/1.0" 404 Not Found GET /owa/auth/x.js HTTP/1.0" 404 Not Found GET /ecp/Current/ex…

That's why I recommend always pointing the default virtual host in the apache or nginx configuration to an empty static site, and making the real site visible only as a named virtual host (requiring the correct Host header), even when the server will be used only for a single site. Most of these automated exploit attempts will never send the correct Host header, and therefore will only see the default virtual host.

Re: Large scale Internet SSH brute force attacks seem to have stopped here

#13

Post by incomingpain »

I run a honeypot network to produce a threatfeed. Over the last month I saw an increase in daily numbers from Aug 7th to 19th. About 30% increase. From the 19th until yesterday I saw a 20% decrease from the peak. Still above average right now slightly.

In fact, it's interesting. The time it takes to open a port and wait for a random attacker isn't measured in minutes. It's seconds. You can do this at home.

>For some numbers, over the past 7 days we had 24,000 attempts against 'root' and only 749 against the next most popular target, which is a login name ('admin') that doesn't even exist here. Just over 10,000 of those attempts came from a single IP address, and just four IPs made 1,000 or more attempts against anything. Besides root, only five login names had more than 100 attempts (and none of them exist here): 'admin', 'user', 'ubuntu', 'debian', and 'pi'. And only three machines saw more than 1,000 attempts (across all targeted login names).

Here's a public threatfeed. http://charles.the-haleys.org/ssh_dico_attack_with_timestamp...

He has had a fair number of attackers in the last week.

I feel like 'stopped' isn't the right word.

Re: Large scale Internet SSH brute force attacks seem to have stopped here

#14

Post by gregmac »

johnklos wrote: post #6

Funny - I had noticed something similar in the last couple of months, but hadn't though to look in to it more. I was seeing 30,000 to 50,000 attempts a day, but over the last two weeks, it's around 10,000. Perhaps it's like mining cryptocurrency - all the low hanging fruit has been found, so there's hardly much sense in continuing to waste resources looking for more.

Is it possible the majority of attempts were actually being run by a single botnet, and it either shut down or the owner changed the attack payload? Perhaps it's just been running for the last few years, with the botmaster apathetic, forgetting about it or maybe even had lost control.

I think you're right about the low-hanging fruit part: it seems unlikely anyone would bother to put serious effort or money (eg: the resources of a botnet) into this type of attack anymore, and the OP seems to support this idea:

> For some numbers, over the past 7 days we had 24,000 attempts against 'root' and only 749 against the next most popular target, which is a login name ('admin') that doesn't even exist here. Just over 10,000 of those attempts came from a single IP address, and just four IPs made 1,000 or more attempts against anything.

Re: Large scale Internet SSH brute force attacks seem to have stopped here

#15

Post by incomingpain »

moepstar wrote: post #4
vbezhenar wrote: post #3

Did someone record which username/passwords those bots try? I never bothered with that.

Hm, that's probably pretty run-of-the-mill default user/password combinations, unless someone specifically targets you?

Back when I ran cowrie and ran statistics my data was pretty similar. Root was getting blown up in the list because of the mirai botnet.

Re: Large scale Internet SSH brute force attacks seem to have stopped here

#18

Post by kgeist »

Frotag wrote: post #9

On a related note, set up a website a few days ago. Brand new domain, newly opened port. But I've rented this VPS for a while so I guess its IP is already on a few lists. But anyways, it's interesting watching the logs for what I assume are tests of known exploits. GET /.gitconfig HTTP/1.0" 422 Unprocessable Entity GET /.git/config HTTP/1.0" 404 Not Found GET /owa/auth/x.js HTTP/1.0" 404 Not Found GET /ecp/Current/ex…

I've had this, too, and it later turned out that it was the VPS provider itself scanning my new instance for vulnerabilities.

Re: Large scale Internet SSH brute force attacks seem to have stopped here

#20

Post by semi-extrinsic »

cesarb wrote: post #11
Frotag wrote: post #9

On a related note, set up a website a few days ago. Brand new domain, newly opened port. But I've rented this VPS for a while so I guess its IP is already on a few lists. But anyways, it's interesting watching the logs for what I assume are tests of known exploits. GET /.gitconfig HTTP/1.0" 422 Unprocessable Entity GET /.git/config HTTP/1.0" 404 Not Found GET /owa/auth/x.js HTTP/1.0" 404 Not Found GET /ecp/Current/ex…

That's why I recommend always pointing the default virtual host in the apache or nginx configuration to an empty static site, and making the real site visible only as a named virtual host (requiring the correct Host header), even when the server will be used only for a single site. Most of these automated exploit attempts will never send the correct Host header, and therefore will only see the default virtual host.

Could you give a pointer to more info on that? I couldn't find more details on such a setup while googling it.
Post reply on HN