Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Visualizing malicious IP addresses

romeov.github.io

Post reply on HN
Print view View original

121–124 of 124 posts

Re: Visualizing malicious IP addresses

#121

Post by teddyh »

mr_mitm wrote: post #98
teddyh wrote: post #92

Earlier quoted context omitted.

Because port knocking is fundamentally a stupid idea: https://news.ycombinator.com/item?id=39898061 >

Two of your three points don't apply to Moxie's and some other implementations, for example Singe Packet Authentication. You can have sufficient bits, and it doesn't have to be cleartext. Maybe it's technically not port knocking anymore, but it's the same idea. And it's not about adding more bits to your authentication, it's about vulnerabilities that can be exploited without authentication, like the recent xz backdo…

> Maybe it's technically not port knocking anymore, but it's the same idea.

At that point, it’s equivalent to a point-to-point VPN, which is the same as IPSec transport mode. Which is what you ought to be using instead of port knocking, if your threat model includes 0-day vulnerabilities in public-facing services like SSH.

Re: Visualizing malicious IP addresses

#122

Post by psd1 »

jeroenhd wrote: post #81
tonymet wrote: post #53

why is ssh open to the internet to begin with? ufw is the first thing I install, even on a "private" network and here's why. I recently installed a router with IPv4 and IPV6. I later found out that IPv6 was globally addressed with no firewall. Always run ufw and begin by shutting off everything to the internet, then only open up what you need.

> I later found out that IPv6 was globally addressed with no firewall. Crazy! What brand router was this? I've never seen an IPv6 capable router configured to permit all traffic by default.

Mate. The shit that a retail ISP will send to the punters. Adjust your expectations sharply downward.

The reason this crap ends up in botnets is because it suits retail ISPs to have a common password for their own access. I've found that password on a forum and used it to get higher privileges than I had with my own login. And yeah, web management over the WAN was enabled by default.

Re: Visualizing malicious IP addresses

#124

Post by JSDevOps »

mianos wrote: post #9

I always wondered how the IPs like this 180.101.88.232 from this block: ISP ChinaNet Jiangsu Province Network Domain Name chinatelecom.com.cn Continue to be the source of thousands of ssh password login attempts for years and years on end. It's not a big deal, I use a tarpit on all ssh with 2FA on the one I use, but it seems ridiculous that some participants of the internet don't give a shit about the rest of the wor…

I see that IP range quite a bit. https://github.com/tg12/IntruderAlertPro
Post reply on HN