Facebook, Instagram, and WhatsApp outages • Hacker News Board

Re: Facebook, Instagram, and WhatsApp outages

#231

Post by 0lpbm » Thu, Jul 04, 2019, 2:14 PM UTC

eridius wrote: post #204

pfundstein wrote: post #167

Earlier quoted context omitted.

I highly recommend installing fail2ban to automatically firewall IPs with consecutive failed attempts, or if possible, disable password authentication altogether and use key auth.

I don't trust key-only auth; what if I need to access my machine from a new computer I haven't done this with before? Is there any way to configure SSH to use a custom high-entry password that's different from the user's local password? My local password is something reasonable for me to type regularly (e.g. for sudo prompts), but I'd love to have a super long password just for SSH that I have to copy from my passwor…

If this is a scenario that happens often, you probably should invest in a portable method to hold your ssh keys, such as a smart card. I have only used YubiKey for this purpose, but I'm sure others, like the Nitrokey, work similarly.

Re: Facebook, Instagram, and WhatsApp outages

#232

Post by Raphmedia » Thu, Jul 04, 2019, 2:20 PM UTC

samstave wrote: post #60

the-dude wrote: post #6

I find the outages of the last few days a curious coincidence : Slack, Google, Cloudflare, Azure, now FB. edit : added Slack after @kache_ mentioned it, added Azure after stevehubertron mentioned it.

So the options are: 1) a secret cyber-war is going on... 2) Some entity is installing new spying slurps 3) An (critical) IX that we werent aware of is having major issues... and we dont know who to blame on that one...

1 & 2: Could it be? https://futurism.com/russian-sub-fire-internet-cables

Re: Facebook, Instagram, and WhatsApp outages

#233

Post by rorykoehler » Thu, Jul 04, 2019, 2:24 PM UTC

pbhjpbhj wrote: post #230

rorykoehler wrote: post #211

Earlier quoted context omitted.

You can also setup a VPN and limit all port 22 activity to your VPNs IP.

I know it's just an obscurity measure but step one is surely don't expose SSH on 22? Dropped my (home) attacks/scans to zero from hundreds per day.

You could do that but if you become a target due to unexpected viral growth then it's useless.

Re: Facebook, Instagram, and WhatsApp outages

#234

Post by pbhjpbhj » Thu, Jul 04, 2019, 2:40 PM UTC

rorykoehler wrote: post #233

pbhjpbhj wrote: post #230

Earlier quoted context omitted.

I know it's just an obscurity measure but step one is surely don't expose SSH on 22? Dropped my (home) attacks/scans to zero from hundreds per day.

You could do that but if you become a target due to unexpected viral growth then it's useless.

It's more "stops you appearing on Shodan" level. But surely if you can reduce the traffic then you are more likely to notice proper attacks.

Re: Facebook, Instagram, and WhatsApp outages

#235

Post by stevendgarcia » Thu, Jul 04, 2019, 3:00 PM UTC

nickphx wrote: post #229

stevendgarcia wrote: post #223

Earlier quoted context omitted.

I'm still picking up the pieces but from my logs I can see that hundreds of successive login attempts were made from different IPs, effectively circumventing fail2ban with what I can only assume is some form of automated IP spoofing. I'm hoping that strict ipv4 settings and ssh ip range restrictions will mitigate this in the future. I also used this python script to harden my SSH security with better algorithms. http…

No, you were not seeing spoofed traffic. There are that many compromised machines actively scanning.

It's scary to admit this but you are probably right. The first thing these bots do is use server resources to scan ports and brute force their way into other machines. I don't want to think about how many machines are pwned like this. Very sobering!

Re: Facebook, Instagram, and WhatsApp outages

#236

Post by rorykoehler » Thu, Jul 04, 2019, 3:09 PM UTC

pbhjpbhj wrote: post #234

rorykoehler wrote: post #233

Earlier quoted context omitted.

You could do that but if you become a target due to unexpected viral growth then it's useless.

It's more "stops you appearing on Shodan" level. But surely if you can reduce the traffic then you are more likely to notice proper attacks.

Shodan is amazing. Creepy too. I used to spend hours trawling video feeds on there. Fascinating.

Re: Facebook, Instagram, and WhatsApp outages

#237

Post by dahfizz » Thu, Jul 04, 2019, 4:36 PM UTC

eridius wrote: post #220

eitland wrote: post #219

Earlier quoted context omitted.

There will be friction, but sftp and port tunneling - which are my most used fwatures besides plain ssh - should be possible ? I mean either you sftp to a shared folder that can be accessed from your regular user as well or you use a staging area with a cron job (or you load/unload the staging area manually.)

If I'm sftp'ing to my server it's because I want to access my files. Not a special shared folder that I then have to separately ssh in, su to the real user, and move into place. I'm not deploying a website so a staging area isn't applicable. This is just a VPS that I use for various purposes.

If your ssh user has the right priveleges, you can read and write your real users files as the ssh user just fine. I do get that this isn't ideal though.

Re: Facebook, Instagram, and WhatsApp outages

#238

Post by dharmab » Thu, Jul 04, 2019, 5:34 PM UTC

stevendgarcia wrote: post #165

the-dude wrote: post #6

I find the outages of the last few days a curious coincidence : Slack, Google, Cloudflare, Azure, now FB. edit : added Slack after @kache_ mentioned it, added Azure after stevehubertron mentioned it.

All of my VPS servers have been slammed in the last 5 days with bruteforce SSH attacks. I've never seen anything this aggressive. One of my servers got PWNed, which has never happened to me before. There's definitely some wild, shady shit going on.

You should disable password auth entirely and whitelist the IPs you connect from in your firewall. If you need to conenct from a large range of possible IPs, use a bastion host with 2FA and restricted to IP blocks from countries you actually connect from.

Re: Facebook, Instagram, and WhatsApp outages

#239

Post by dharmab » Thu, Jul 04, 2019, 5:35 PM UTC

samstave wrote: post #60

the-dude wrote: post #6

I find the outages of the last few days a curious coincidence : Slack, Google, Cloudflare, Azure, now FB. edit : added Slack after @kache_ mentioned it, added Azure after stevehubertron mentioned it.

So the options are: 1) a secret cyber-war is going on... 2) Some entity is installing new spying slurps 3) An (critical) IX that we werent aware of is having major issues... and we dont know who to blame on that one...

4) it's summertime in the predominantly online part of the world and general human activity is at a peak

Re: Facebook, Instagram, and WhatsApp outages

#240

Post by xorcist » Thu, Jul 04, 2019, 5:36 PM UTC

stevendgarcia wrote: post #179

pfundstein wrote: post #167

Earlier quoted context omitted.

I highly recommend installing fail2ban to automatically firewall IPs with consecutive failed attempts, or if possible, disable password authentication altogether and use key auth.

Solid advice. I had fail2ban installed and enabled. SSHD Root/password login turned off and only ssh key had access. My firewall was also airtight, or so I thought. Clearly I mucked up a config or setting somewhere because the odds of someone getting past all that are extremely low. One thing I had not prepared for was IP spoofing which I learned can be prevented with a few net.ipv4.conf tweaks. I also just purchased…

You don't generally "get past" your firewall rules and into your box unless you have accounts that are not password protected.

If you really had password logins turned off, you need to identify and isolate how they gained access before you put that box online again. Never "hope" or "cross fingers" that it doesn't happen again. Unless you are an interesting target for some reason, chances are that these attacks are automated and you are running some insecure software somewhere.

Start by taking a snapshot of the machine before you do anything else. Go through the logs. Are there any unwanted processes? How were they started? Are there any unwanted binaries in the filesystem? How were they uploaded? Try to find IP addresses that that be tied to any unwanted login, and see search your logs for any previous occurrences.

Pay special attention to any web-reachable software you have installed.