Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AS13335 doing SSH scanning

encryp.ch

Post reply on HN
Print view View original

21–30 of 110 posts

Re: AS13335 doing SSH scanning

#21

Post by r1ch »

jimsi wrote: post #17
brohee wrote: post #8

What is the issue exactly? Is there any kind of exploitation attempts or is someone fishing for banners to do statistics upon? The second case is research, and legitimate...

I have asked Cloudflare about this traffic, but support says "Cloudflare helps protect sites, and accelerate them. We do not attack sites, and our network can't be used to generate attack traffic." They deny any malicious outgoing traffic, but after I have provided pcap dump they just ignoring me and do not reply anything. Very odd behaviour for researchers.

Cloudflare likes to use the "We're just a proxy" defense when it suits them, but with the rapid release of other products they are very capable of generating arbitrary traffic and hosting content without an origin.

Re: AS13335 doing SSH scanning

#22

Post by tux3 »

jimsi wrote: post #12
brohee wrote: post #9

Earlier quoted context omitted.

What kind of answer would you expect, in all seriousness? The thing you are reporting is not illegal or even dodgy.

I expect to hear who (and why) generates that kind of traffic from cloudflare owned subnets.

I can understand your frustration with background internet noise, but please note Cloudflare is not known for broadcasting their customers' names to the first abuse report with a pcap of a TCP handshake.

There may be more realistic ways to go about protecting people's SSH servers that trying to dox Cloudflare VPN users.

Re: AS13335 doing SSH scanning

#23

Post by [deleted] »

jimsi wrote: post #12
brohee wrote: post #9

Earlier quoted context omitted.

What kind of answer would you expect, in all seriousness? The thing you are reporting is not illegal or even dodgy.

I expect to hear who (and why) generates that kind of traffic from cloudflare owned subnets.

[deleted]

Re: AS13335 doing SSH scanning

#24

Post by zinekeller »

jimsi wrote: post #20
miyuru wrote: post #15

Earlier quoted context omitted.

If your ISP and the server support IPv6, just disable SSH on IPv4. Some of my servers don't even have any IPv4 connectivity and there haven't been any failed SSH logins over IPv6.

My OpenSSH is located on a non standard port, 22/tcp is going to the endlessh honeypot.

Not to disappoint you, but except for logging SSH honeypots are becoming useless (most bots automatically disconnect when they detect a long login banner).

Re: AS13335 doing SSH scanning

#25

Post by Hrundi »

tux3 wrote: post #22
jimsi wrote: post #12

Earlier quoted context omitted.

I expect to hear who (and why) generates that kind of traffic from cloudflare owned subnets.

I can understand your frustration with background internet noise, but please note Cloudflare is not known for broadcasting their customers' names to the first abuse report with a pcap of a TCP handshake. There may be more realistic ways to go about protecting people's SSH servers that trying to dox Cloudflare VPN users.

Who's trying to dox those users?

Re: AS13335 doing SSH scanning

#26

Post by evgen »

cuu508 wrote: post #2

In case Cloudflare monitors the keyword "Cloudflare" in HN comments, I'll mention it here – Cloudflare.

Cloudflare is all over HN and their CTO, jgrahamc, will frequently appear to answer questions. California is just waking up so I expect a few ho it a before we get some solid answers to this issue.

Re: AS13335 doing SSH scanning

#27

Post by tux3 »

Hrundi wrote: post #25
tux3 wrote: post #22

Earlier quoted context omitted.

I can understand your frustration with background internet noise, but please note Cloudflare is not known for broadcasting their customers' names to the first abuse report with a pcap of a TCP handshake. There may be more realistic ways to go about protecting people's SSH servers that trying to dox Cloudflare VPN users.

Who's trying to dox those users?

I assumed OP wants to know the identity of the Cloudflare users scanning their SSH ports.

I think OP guessed it was probably not Cloudflare themselves scanning their ports, so I think that's what they meant by "hear who and why".

Maybe dox is too strong a word. My point is, from what I've heard, the general sentiment is that you're unlikely to get any information about customers just by sending abuse reports to Cloudflare.

Re: AS13335 doing SSH scanning

#28

Post by benjojo12 »

jimsi wrote: post #18
benjojo12 wrote: post #16

To the best of my knowledge, the IP blocks in the 8.0.0.0/8 range announced by cloudflare are their VPN exit blocks. I had similar issues with them in the past spewing weird traffic. Didn't really ever reach a conclusion on it, other than just reducing logging for that error condition a scanner was triggering.

How did you discover this? Anyway thanks for additional information

via support ticket with cloudflare. They didn't explicitly confirm it, but my experience is that they would have corrected me if that was wrong :)

Re: AS13335 doing SSH scanning

#29

Post by [deleted] »

mcwhy wrote: post #10
vadfa wrote: post #4

Cloudflare has a VPN product, WARP. It's possible that they are clients of theirs doing the scanning. In any case I wouldn't think much of it. If you obsess over any garbage traffic you get you will go insane.

It could also be used for IP reputation, running ssh can be a sign of a proxy or other server/service that website owners might want to block.

[deleted]
Post reply on HN