Fishing for Hackers: Analysis of a Linux Server Attack • Hacker News Board

Re: Fishing for Hackers: Analysis of a Linux Server Attack

#21

Post by leaveyou » Tue, May 06, 2014, 6:46 PM UTC

gighi wrote: post #13

Gepser wrote: post #9

¿But how did they enter? ¿Force attack?

Yes, I didn't put it in the article because it was getting too long otherwise, but the attacker immediately tried brute-forcing the root account, and after a handful of common passwords ("qwerty", "qwerty123", "pizza" among those) he found "password". I was able to find all the attempts by looking at the I/O activity of the sshd process, and also the syslog activity recorded every attempt.

Doesn't your system refuse root login by ssh by default ? If I remember correctly, on ubuntu server, sshd is configured by default to not allow root login from remote addresses.

Re: Fishing for Hackers: Analysis of a Linux Server Attack

#22

Post by breakall » Tue, May 06, 2014, 6:47 PM UTC

collingreene wrote: post #15

Cool article! A friend and I once did this but then recorded the commands attackers ran and replayed them on a big tv in our office. We called it hacker fishtank.

That sounds cool! Did you post the presentation anywhere?

Re: Fishing for Hackers: Analysis of a Linux Server Attack

#23

Post by gighi » Tue, May 06, 2014, 6:49 PM UTC

leaveyou wrote: post #21

gighi wrote: post #13

Earlier quoted context omitted.

Yes, I didn't put it in the article because it was getting too long otherwise, but the attacker immediately tried brute-forcing the root account, and after a handful of common passwords ("qwerty", "qwerty123", "pizza" among those) he found "password". I was able to find all the attempts by looking at the I/O activity of the sshd process, and also the syslog activity recorded every attempt.

Doesn't your system refuse root login by ssh by default ? If I remember correctly, on ubuntu server, sshd is configured by default to not allow root login from remote addresses.

On some providers yes, in fact I explicitly enabled root SSH login for those.

Other providers (such as Digital Ocean) use the root account by default even for Ubuntu, although the password is set to a really secure and random one.

Re: Fishing for Hackers: Analysis of a Linux Server Attack

#24

Post by infruset » Tue, May 06, 2014, 6:57 PM UTC

gighi wrote: post #14

jwcrux wrote: post #12

OP may also benefit from the use of an SSH honeypot. I use kippo ( https://code.google.com/p/kippo/ ) with great success. It tracks all commands run, as well as keeps copies of all downloaded files. In addition, it limits available commands to a certain predefined subset, allowing the host to prevent damage caused (e.g. a DoS attack in this case) by the system being compromised.

That's an interesting project. Would it have recorded also statistics like the connection activity? Seeing all the UDP traffic, and being able to trace its origin to the "@udp1 39.115.244.150 800 300" command, received not via shell but via a TCP connection, was pretty cool.

Ironic that the IP may now suffer another DOS attack because of HN trying to access it after reading the article.

Re: Fishing for Hackers: Analysis of a Linux Server Attack

#25

Post by gighi » Tue, May 06, 2014, 6:59 PM UTC

infruset wrote: post #24

gighi wrote: post #14

Earlier quoted context omitted.

That's an interesting project. Would it have recorded also statistics like the connection activity? Seeing all the UDP traffic, and being able to trace its origin to the "@udp1 39.115.244.150 800 300" command, received not via shell but via a TCP connection, was pretty cool.

Ironic that the IP may now suffer another DOS attack because of HN trying to access it after reading the article.

I anonymized the IP addresses in a consistent way before publishing the blog post, so in the very worst case the DoS attack will go towards a completely new host :)

Re: Fishing for Hackers: Analysis of a Linux Server Attack

#26

Post by jwcrux » Tue, May 06, 2014, 7:10 PM UTC

mbreedlove wrote: post #17

jwcrux wrote: post #12

OP may also benefit from the use of an SSH honeypot. I use kippo ( https://code.google.com/p/kippo/ ) with great success. It tracks all commands run, as well as keeps copies of all downloaded files. In addition, it limits available commands to a certain predefined subset, allowing the host to prevent damage caused (e.g. a DoS attack in this case) by the system being compromised.

How much success have you had? I ran kippo for a while and it seemed that all attackers were trying to upload files over SCP, which kippo does not support. A few attackers resorted to logging in and downloading with wget. However, the vast majority of attacks ended with a failed SCP session.

Great question. I had this exact same problem before I came across/contributed to a fork of kippo by micheloosterhof that implemented SCP (and more).

Check it out here: https://github.com/micheloosterhof/kippo

Re: Fishing for Hackers: Analysis of a Linux Server Attack

#27

Post by DodgyEggplant » Tue, May 06, 2014, 7:16 PM UTC

Great article, thanks. Does sysdig ready for production servers? tested so it does not introduce new issues?

Re: Fishing for Hackers: Analysis of a Linux Server Attack

#28

Post by ltorresv » Tue, May 06, 2014, 7:20 PM UTC

mbreedlove wrote: post #17

jwcrux wrote: post #12

OP may also benefit from the use of an SSH honeypot. I use kippo ( https://code.google.com/p/kippo/ ) with great success. It tracks all commands run, as well as keeps copies of all downloaded files. In addition, it limits available commands to a certain predefined subset, allowing the host to prevent damage caused (e.g. a DoS attack in this case) by the system being compromised.

How much success have you had? I ran kippo for a while and it seemed that all attackers were trying to upload files over SCP, which kippo does not support. A few attackers resorted to logging in and downloading with wget. However, the vast majority of attacks ended with a failed SCP session.

Massive success for me using kippo.

The typical intruder in our case uses wget to pull down files and that works w/o a hitch.

If you have the time to run it AND check on it you'll learn a lot.

Re: Fishing for Hackers: Analysis of a Linux Server Attack

#29

Post by degio » Tue, May 06, 2014, 7:23 PM UTC

DodgyEggplant wrote: post #27

Great article, thanks. Does sysdig ready for production servers? tested so it does not introduce new issues?

I'm one of of the sysdig creators. Sysdig is a pretty young project (we released it around a month ago), so I can't promise it will be flawless in a production environment. However, we've had many installations under several different environments, and during the month after the release we had extremely few crash reports, which we've worked to fix right away.

Re: Fishing for Hackers: Analysis of a Linux Server Attack

#30

Post by jwcrux » Tue, May 06, 2014, 7:46 PM UTC

gighi wrote: post #14

jwcrux wrote: post #12

OP may also benefit from the use of an SSH honeypot. I use kippo ( https://code.google.com/p/kippo/ ) with great success. It tracks all commands run, as well as keeps copies of all downloaded files. In addition, it limits available commands to a certain predefined subset, allowing the host to prevent damage caused (e.g. a DoS attack in this case) by the system being compromised.

That's an interesting project. Would it have recorded also statistics like the connection activity? Seeing all the UDP traffic, and being able to trace its origin to the "@udp1 39.115.244.150 800 300" command, received not via shell but via a TCP connection, was pretty cool.

I don't think it measures the inbound/outbound bandwidth - especially over UDP. It's more of an SSH emulator (so to speak) with everything being logged (commands, files, etc.).

In addition, there are quite a few good visualization tools to show the logs made by kippo. You can save them to a db, plot them nicely, etc.