Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Brute.Fail: Watch brute force attacks fail in real time

brute.fail

Post reply on HN
Print view View original

241–250 of 268 posts

Re: Brute.Fail: Watch brute force attacks fail in real time

#241

Post by bigkm »

oh_sigh wrote: post #236
wkat4242 wrote: post #208

Earlier quoted context omitted.

That's still not really security but just a nuisance mitigation IMO :)

Security through obscurity actually is security, and is perfectly valid to use with a defense in depth strategy. The problem is when obscurity is the only defense.

I agree, these attacks are looking for systems that have pretty default security, and by running on a different port you avoid all this automated chaos because you're non default now. Like scam emails with typos, a way to filter out the naïve people.

Re: Brute.Fail: Watch brute force attacks fail in real time

#242

Post by myself248 »

heyoni wrote: post #237
ChuckMcM wrote: post #53

So funny story, for a while I worked on a 'reverse' exploit. Which is to say morphing the response from ssh to the client with large malformed packets. The idea was to crash the client making the request. In my case I found these attacks would have like 6 to 10 attempts from the same source address. By time stamping the requests, I could evaluate if the next attack from the same address came more quickly or more slow…

Details! Seriously this is both hilarious and intriguing and deserves a long form blog post or something.

Seriously, this should be standard practice. Fail2evil...

Re: Brute.Fail: Watch brute force attacks fail in real time

#243

Post by myself248 »

operator-name wrote: post #55
kenniskrag wrote: post #35

Earlier quoted context omitted.

Nice idea. From the docs: Endlessh is an SSH tarpit that very slowly sends an endless, random SSH banner. It keeps SSH clients locked up for hours or even days at a time. The purpose is to put your real SSH server on another port and then let the script kiddies get stuck in this tarpit instead of bothering a real server. Since the tarpit is in the banner before any cryptographic exchange occurs, this program doesn't…

I'd be cautious about stuff like this - if you annoy the wrong person that could paint a target on your back.

If this was default on port 22 of every cheap router sold, and if you enable ssh it has to go on some other port, it'd frustrate a lot of bad guys.

Re: Brute.Fail: Watch brute force attacks fail in real time

#244

Post by jofla_net »

runeks wrote: post #207
chlorion wrote: post #157

I setup SSHD to listen on a wireguard interface rather than listening on all interfaces. This makes SSHD only accessible to wireguard peers rather than the entire internet. A nice aspect of wireguard is that it's "steath", meaning that it does not respond to unauthenticated connections at all, so there is no way to probe and scan for wireguard listeners at all. I think setting up daemons behind wireguard offers a lot…

> A nice aspect of wireguard is that it's "steath", meaning that it does not respond to unauthenticated connections at all, so there is no way to probe and scan for wireguard listeners at all. I did not know this. That’s really cool. Is it done over a stateless protocol like UDP, or is a TCP connection opened first? Ie. is it impossible to see if there’s even a server there at all, or is it first revealed that there’…

openvpn has had an option for such behavior (over udp obviously) for a while. the option is called tls-auth, it requires you to go through and generate an aditional key which has to exist on all clients and server. Last i remember is that even if you scan the server, it is completely quiet unless the right signature is received as well for each frame.

Re: Brute.Fail: Watch brute force attacks fail in real time

#245

Post by elesiuta »

phanimahesh wrote: post #193
elesiuta wrote: post #166

Earlier quoted context omitted.

This is why I require both a private key and a password. I have fail2ban configured to block IPs with invalid private keys after a couple attempts, and if the key is valid to email me and rate limit invalid password attempts. This gives a more than sufficient warning if my key leaks which is already very unlikely, and this just makes it much more unlikely for both to be compromised, and only took an extra 5 minutes t…

How do you configure emails on successful logins? Can you share your config, sufficiently anonymized?

I created a jail for fail2ban with

  logpath = /var/log/auth.log
and for the filter I use

  failregex = .*Connection closed by authenticating user [a-z_]([a-z0-9_-]{0,31}|[a-z0-9_-]{0,30}\$)  port [0-9]* \[preauth\]
and the emails are just cron with a python script that checks /var/log/fail2ban.log for any new Found|Ban|Unban IPs and sends them using smtplib

If you like I can share the full config files but the rest isn't too interesting nor different from what is here https://www.fail2ban.org/wiki/index.php/MANUAL_0_8#Jails

Re: Brute.Fail: Watch brute force attacks fail in real time

#246

Post by mdaniel »

nubinetwork wrote: post #231
OrangeMusic wrote: post #196

Earlier quoted context omitted.

> give the caller a fake shell, and watch what they type after "breaking in." Oh YES! Do it, please! We could learn a lot!

I believe one of ISC dshield's related projects can do this.

Thanks for the reference; after some link chasing I was able to end up on the project I believe you're thinking of: https://github.com/cowrie/cowrie#features (appears to be BSD-3-Clause: https://github.com/cowrie/cowrie/blob/master/LICENSE.rst )

Re: Brute.Fail: Watch brute force attacks fail in real time

#248

Post by michaelcampbell »

bytesandbots wrote: post #240
gitgud wrote: post #239

Earlier quoted context omitted.

Is it legal to host a gzip bomb? Seems like a malicious file to serve up…

It can cause your site to end up on Google's safe Browsing black list which can be a death sentence for a business. Google has automated process for identifying malware and black list such websites. Almost all browsers use this list to warn users. This is why it is also dangerous to host anonymous uploaded files even for a short time. https://news.ycombinator.com/item?id=25802366

> It can cause your site to end up on Google's safe Browsing black list

If it's a file that nothing on your site links to, and doesn't really "exist" how would google ever index it? Especially if you put in as a deny in robots.txt, which as far as I'm aware, Google honors.

Re: Brute.Fail: Watch brute force attacks fail in real time

#249

Post by Shakahs »

mike_d wrote: post #132
satvikpendem wrote: post #117

This site is now brought down due to the collective brute forcing of HNers visiting the site, as if akin to a DDOS. How ironic.

Is it not working for you? I see over 350 active users at the moment. I did get one report that it was blocked by a corporate network because the domain was newly registered.

The Websocket connection did stop updating a few times when your site was getting the HN hug.

You could push an updated list to Cloudflare KV every few seconds and have the front end poll it from there for cheap and near unlimited scalability.

Re: Brute.Fail: Watch brute force attacks fail in real time

#250

Post by michaelcampbell »

NoZebra120vClip wrote: post #97
BrandoElFollito wrote: post #75

Earlier quoted context omitted.

This, and move the endpoint on an uninteresting port to lower the noise in the logs

I suppose it may do that, but naïvely switching to an alternate port may lull one into a false sense of security: https://utcc.utoronto.ca/~cks/space/blog/sysadmin/SSHAltPort... Shodan will find and fingerprint you easily enough.

In theory. I have a server running on a weird port, but with fail2ban just in case. I haven't had even a blip of an attempt on it.
Post reply on HN