Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

3 months and 1M SSH attempts later

livesshattack.net

Post reply on HN
Print view View original

21–30 of 69 posts

Re: 3 months and 1M SSH attempts later

#21

Post by abrookewood »

WillieStevenson wrote: post #14
simoncion wrote: post #11

Earlier quoted context omitted.

Did you attempt to notify that poor schmuck who stood up that AirRouter with the default username and password?

Damn it. I should of. I don't know how I would do that now though. He probably got pwned of the internet by now. lol.

Dude, it's not funny. You're coming across like a script kiddie and it's not welcome here. You've just posted the credentials to someone's site that has probably been compromised and you're treating it like a joke. Go back and redact the IP addresses of those sites & devices before you get yourself into trouble.

Re: 3 months and 1M SSH attempts later

#22

Post by abrookewood »

WillieStevenson wrote: post #9
cddotdotslash wrote: post #6

Just FYI, I wouldn't log into any systems using credentials you find through this. A lot of people are obviously using credentials stolen from previous dumps, so there might be valid ones in there. Logging into a public facing router using stolen credentials is definitely a crime.

Just like it's a crime trying to ssh into a box that is not yours right? And besides I didn't do anything to the router. I was simply pointing out that you should change your default credentials and hide your router. ... should be a crime to not change the default credentials.

You ever hear the saying "Two wrongs don't make a right"?

Re: 3 months and 1M SSH attempts later

#23

Post by ambiate »

ChuckMcM wrote: post #10

Just for fun I ran an SSH server on a RasPi to basically allow any login and to simulate a Linux shell. And then captured the various things that people tried. If you're wondering what the "standard set" of script kiddy tricks are, I highly recommend it.

15 years ago, that standard set used to be wget something from packetstormsecurity.org. If no wget: curl it. If no curl: just lynx it. else: move on to the next vulnerable server. Script kiddies were quite lazy back then. I feel old at thirty.

Re: 3 months and 1M SSH attempts later

#24

Post by simoncion »

abrookewood wrote: post #21
WillieStevenson wrote: post #14

Earlier quoted context omitted.

Damn it. I should of. I don't know how I would do that now though. He probably got pwned of the internet by now. lol.

Dude, it's not funny. You're coming across like a script kiddie and it's not welcome here. You've just posted the credentials to someone's site that has probably been compromised and you're treating it like a joke. Go back and redact the IP addresses of those sites & devices before you get yourself into trouble.

Um. I guaran-damn-tee you that the router in question was compromised within a day or seven of it being stood up.

The default credentials on every bit of UBNT hardware that I've used grant access to both the web UI and admin SSH access. So, the access attempts that WillieStevenson has noticed coming from that IP are most likely coming from the router itself.

I can't see any reasonable reason for redacting the IPs that are making those access attempts, and I see no reason at all for redacting static, factory default usernames and passwords.

Re: 3 months and 1M SSH attempts later

#25

Post by xupybd »

Godel_unicode wrote: post #16

> "Hahahahahaha, a successful login" Congratulations, you just violated the computer fraud and abuse act. Also, bravo for laying out for every reader of this post where they can find the vulnerable router and the credentials they can use to join you in breaking the law. This is the exact opposite of responsible disclosure; people like the author are why we will never get a less draconian cfaa. Thanks for that.

>Congratulations, you just violated the computer fraud and abuse act. How can that be illegal?

Granted publishing it should be, but simply testing if someone has left the default password?

Re: 3 months and 1M SSH attempts later

#26

Post by WillieStevenson »

Godel_unicode wrote: post #16

> "Hahahahahaha, a successful login" Congratulations, you just violated the computer fraud and abuse act. Also, bravo for laying out for every reader of this post where they can find the vulnerable router and the credentials they can use to join you in breaking the law. This is the exact opposite of responsible disclosure; people like the author are why we will never get a less draconian cfaa. Thanks for that.

My apologies. I have blocked out the content to prevent any further harm.

Re: 3 months and 1M SSH attempts later

#27

Post by Godel_unicode »

WillieStevenson wrote: post #14
simoncion wrote: post #11

Earlier quoted context omitted.

Did you attempt to notify that poor schmuck who stood up that AirRouter with the default username and password?

Damn it. I should of. I don't know how I would do that now though. He probably got pwned of the internet by now. lol.

Pretty clear that he'd been popped already, you realize that's what all of those ptr records that are IP.ISP are, right? Some random person who clicked on something they shouldn't have and is now part of a botnet which is continuously trying to brute force other boxes.

Re: 3 months and 1M SSH attempts later

#28

Post by ambiate »

xupybd wrote: post #25
Godel_unicode wrote: post #16

> "Hahahahahaha, a successful login" Congratulations, you just violated the computer fraud and abuse act. Also, bravo for laying out for every reader of this post where they can find the vulnerable router and the credentials they can use to join you in breaking the law. This is the exact opposite of responsible disclosure; people like the author are why we will never get a less draconian cfaa. Thanks for that.

>Congratulations, you just violated the computer fraud and abuse act. How can that be illegal? Granted publishing it should be, but simply testing if someone has left the default password?

CFAA is very broad. "intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains— C) information from any protected computer;"

A court could see "ambiate was authorized to use the work printer for printing -- ambiate hacked the printer to find out the fax machine number and sent a fax" in an absurd world.

This random internet person was never authorized to access this public router. Even if its set to a default username/password. That's the broadness the CFAA.

Just because you set your password to 'password99', doesn't mean you get more protections than the person who leaves their Cisco router set to 'cisco'.

Re: 3 months and 1M SSH attempts later

#30

Post by Godel_unicode »

xupybd wrote: post #25
Godel_unicode wrote: post #16

> "Hahahahahaha, a successful login" Congratulations, you just violated the computer fraud and abuse act. Also, bravo for laying out for every reader of this post where they can find the vulnerable router and the credentials they can use to join you in breaking the law. This is the exact opposite of responsible disclosure; people like the author are why we will never get a less draconian cfaa. Thanks for that.

>Congratulations, you just violated the computer fraud and abuse act. How can that be illegal? Granted publishing it should be, but simply testing if someone has left the default password?

Oh yeah. The "default password==consent" argument has not worked well.

This is one of the big differences between many professional penetration testers, and enthusiastic amateurs/blue team types. The professional red teamer has typically received long lectures about scope and RoE, and knows exactly how far you can legally go. Check the webpage that corresponds to some suspicious sshd log entries and note that it's a router? Totally fine. Attempt to notify the owner? Equally fine (pro-tip, you might not know who they are, but their ISP sure does). Brute-force their admin credentials (I recognize the hyperbole; the judge won't)? Hand-cuffs.

https://ilt.eff.org/index.php/Computer_Fraud_and_Abuse_Act_(...

Post reply on HN