Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

3 months and 1M SSH attempts later

livesshattack.net

Post reply on HN
Print view View original

51–60 of 69 posts

Re: 3 months and 1M SSH attempts later

#51

Post by tlrobinson »

pdkl95 wrote: post #47

> He's still going at it 100,000 ssh attempts later. I got hit with >100,000 on my main desktop a few years ago when I was procrastinating fixing my heavy-handed fail2ban config. I noticed what was happening first from the lag it was causing. It turns out >10 SSH password attempts/second can eat up a significant portion of my 3GHz "Yorkfield"[1] CPU. It wasn't hard to discover the problem: the logfile was rapidly fil…

Out of curiosity, why is your desktop exposed directly to the internet (no NAT/firewall) at all?

Re: 3 months and 1M SSH attempts later

#52

Post by pdkl95 »

tlrobinson wrote: post #51
pdkl95 wrote: post #47

> He's still going at it 100,000 ssh attempts later. I got hit with >100,000 on my main desktop a few years ago when I was procrastinating fixing my heavy-handed fail2ban config. I noticed what was happening first from the lag it was causing. It turns out >10 SSH password attempts/second can eat up a significant portion of my 3GHz "Yorkfield"[1] CPU. It wasn't hard to discover the problem: the logfile was rapidly fil…

Out of curiosity, why is your desktop exposed directly to the internet (no NAT/firewall) at all?

NAT doesn't provide security, and a ssh server isn't useful if you filter that port at the firewall.

Re: 3 months and 1M SSH attempts later

#53

Post by tlrobinson »

ChuckMcM wrote: post #10

Just for fun I ran an SSH server on a RasPi to basically allow any login and to simulate a Linux shell. And then captured the various things that people tried. If you're wondering what the "standard set" of script kiddy tricks are, I highly recommend it.

"World's worst hacker" is pretty amusing: https://www.youtube.com/watch?v=oJagxe-Gvpw

Re: 3 months and 1M SSH attempts later

#54

Post by x0 »

ambiate wrote: post #23
ChuckMcM wrote: post #10

Just for fun I ran an SSH server on a RasPi to basically allow any login and to simulate a Linux shell. And then captured the various things that people tried. If you're wondering what the "standard set" of script kiddy tricks are, I highly recommend it.

15 years ago, that standard set used to be wget something from packetstormsecurity.org. If no wget: curl it. If no curl: just lynx it. else: move on to the next vulnerable server. Script kiddies were quite lazy back then. I feel old at thirty.

Hasn't changed for the most part. Though it's either exploit db, some creepy looking .pw site you've never heard of, and once or twice, the zips that github provides. And sometimes they'll just scp their stuff onto the box.

Re: 3 months and 1M SSH attempts later

#55

Post by im3w1l »

Godel_unicode wrote: post #16

> "Hahahahahaha, a successful login" Congratulations, you just violated the computer fraud and abuse act. Also, bravo for laying out for every reader of this post where they can find the vulnerable router and the credentials they can use to join you in breaking the law. This is the exact opposite of responsible disclosure; people like the author are why we will never get a less draconian cfaa. Thanks for that.

On a tangent, how will the next generation of hackers learn the ropes? Will they be hopelessly outclassed by their foreign peers?

Re: 3 months and 1M SSH attempts later

#56

Post by julie1 »

pdkl95 wrote: post #52
tlrobinson wrote: post #51

Earlier quoted context omitted.

Out of curiosity, why is your desktop exposed directly to the internet (no NAT/firewall) at all?

NAT doesn't provide security, and a ssh server isn't useful if you filter that port at the firewall.

Masquerading private address with you GW public address and limit connection to outhoing one when ingress filtering is correctly done on your firewall/ISP side is quite efficient.

Using private address is just a convenient way to set up easy invariant templates for FW rules. No more, no less.

If you add the fact that ISP used to not route RFC 1918, it used to work quite efficiently.

Re: 3 months and 1M SSH attempts later

#57

Post by simoncion »

yeukhon wrote: post #37

Showing off stuff like this is considered stupid, childish and idiotic. Based on the cache version of his publication, I am extremely tempted to report this to the proper authority. Not only you should stop publishing this kind of information, you should stop your project.

> Showing off stuff like this is considered stupid, childish and idiotic. ... Not only you should stop publishing this kind of information, you should stop your project.

I strongly disagree with both sentences.

Re: 3 months and 1M SSH attempts later

#58

Post by cddotdotslash »

WillieStevenson wrote: post #9
cddotdotslash wrote: post #6

Just FYI, I wouldn't log into any systems using credentials you find through this. A lot of people are obviously using credentials stolen from previous dumps, so there might be valid ones in there. Logging into a public facing router using stolen credentials is definitely a crime.

Just like it's a crime trying to ssh into a box that is not yours right? And besides I didn't do anything to the router. I was simply pointing out that you should change your default credentials and hide your router. ... should be a crime to not change the default credentials.

I'm not saying the machines attacking you aren't violating the law. I'm saying that publishing an IP address of someone's router, along with step by step directions of how to log into it, along with screenshots of you logging into it, is a violation of the computer fraud and abuse act. The law doesn't care where you got the address. And the reality is that that router's owner probably has no idea they are part of a botnet attacking other machines. I suggest you go back to university and take a few computer ethics courses before you wind up with a criminal record from your next project.

Re: 3 months and 1M SSH attempts later

#59

Post by pdkl95 »

julie1 wrote: post #56
pdkl95 wrote: post #52

Earlier quoted context omitted.

NAT doesn't provide security, and a ssh server isn't useful if you filter that port at the firewall.

Masquerading private address with you GW public address and limit connection to outhoing one when ingress filtering is correctly done on your firewall/ISP side is quite efficient. Using private address is just a convenient way to set up easy invariant templates for FW rules. No more, no less. If you add the fact that ISP used to not route RFC 1918, it used to work quite efficiently.

That "convenient way" has been incredibly damaging to the internet. The primary benefit of the internet was that every peer can publish without needing permission of a 3rd party. IP Masquerading / NAT removes that ability, and has cause a massive amount of centralization. These gatekeepers are necessary to workaround the limitations of every host having to share a party line. Regular use of RFC 1918 for most hosts has prevented the development of real network software.

If you want the internet to continue to degrade into something closer to cable TV, then continue requiring central gatekeepers. If, instead, you care about the future of the internet, then please use globally routable addresses instead of the imprimatur we call NAT.

Re: 3 months and 1M SSH attempts later

#60

Post by julie1 »

pdkl95 wrote: post #59
julie1 wrote: post #56

Earlier quoted context omitted.

Masquerading private address with you GW public address and limit connection to outhoing one when ingress filtering is correctly done on your firewall/ISP side is quite efficient. Using private address is just a convenient way to set up easy invariant templates for FW rules. No more, no less. If you add the fact that ISP used to not route RFC 1918, it used to work quite efficiently.

That "convenient way" has been incredibly damaging to the internet. The primary benefit of the internet was that every peer can publish without needing permission of a 3rd party. IP Masquerading / NAT removes that ability, and has cause a massive amount of centralization. These gatekeepers are necessary to workaround the limitations of every host having to share a party line . Regular use of RFC 1918 for most hosts h…

one of the benefit of NATing that it is mentally easier to recongize inbound and outbound traffic in firewall rules.

It has been used as a way to centralize traffic by some rogue ISP, and then because Large Scale Nating involve to hold in memory a lot of state considered bad practices because it was costing money to ISPs. (plus FW redondancy/HA in NAT require to synchronize states with CARP or CISCO techs).

But NATing behind the POP of the customer behind a public IP with the classical 3 ways filtering (corporate net, DMZ, internet) still enables templates to be easily shared and understood.

It is not NAT that sux. It is incompetent sysadmins the problem.

Post reply on HN