Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Visualizing malicious IP addresses

romeov.github.io

Post reply on HN
Print view View original

51–60 of 124 posts

Re: Visualizing malicious IP addresses

#51

Post by dotancohen »

abound wrote: post #18
unraveller wrote: post #17

If you're lucky enough to have a big ISP with a single big block of IP addresses that never changes you can disallow all other ranges on your VPS admin ports and only have to worry about VPNing through that ISP. I guess you could block the main country offenders but you'd have to pay an API to keep up with the IP allocations to be sure.

Or alternatively, block port 22 entirely on your firewall and use something like Tailscale to access the machine. Of course, now your attack surface includes Tailscale, which has had it's own vulns in the past, but I think blocking all public traffic ends up being much stronger than any weaknesses Tailscale may introduce.

It allow SSH on another port. There are considerations when deciding to allow SSH on unprivileged ports.

Also, it's a bit tricky to set up but port knocking is a very effective solution, and you can keep the SSH on port 22 if you like.

Re: Visualizing malicious IP addresses

#52

Post by dotancohen »

mianos wrote: post #9

I always wondered how the IPs like this 180.101.88.232 from this block: ISP ChinaNet Jiangsu Province Network Domain Name chinatelecom.com.cn Continue to be the source of thousands of ssh password login attempts for years and years on end. It's not a big deal, I use a tarpit on all ssh with 2FA on the one I use, but it seems ridiculous that some participants of the internet don't give a shit about the rest of the wor…

  > I use a tarpit on all ssh
I would love to hear more about your approach, if that's not sensitive. My Gmail username is the same as my HN username if you prefer. Thank you!

Re: Visualizing malicious IP addresses

#53

Post by tonymet »

why is ssh open to the internet to begin with?

ufw is the first thing I install, even on a "private" network and here's why.

I recently installed a router with IPv4 and IPV6. I later found out that IPv6 was globally addressed with no firewall.

Always run ufw and begin by shutting off everything to the internet, then only open up what you need.

Re: Visualizing malicious IP addresses

#54

Post by Msurrow »

tonymet wrote: post #53

why is ssh open to the internet to begin with? ufw is the first thing I install, even on a "private" network and here's why. I recently installed a router with IPv4 and IPV6. I later found out that IPv6 was globally addressed with no firewall. Always run ufw and begin by shutting off everything to the internet, then only open up what you need.

Perhaps because the VPS is hosted somewhere remote and (s)he needs to ssh into it. Why ask questions in such an arrogant manner to begin with.

Re: Visualizing malicious IP addresses

#55

Post by darkwater »

tonymet wrote: post #53

why is ssh open to the internet to begin with? ufw is the first thing I install, even on a "private" network and here's why. I recently installed a router with IPv4 and IPV6. I later found out that IPv6 was globally addressed with no firewall. Always run ufw and begin by shutting off everything to the internet, then only open up what you need.

Well, if you want to connect to your home LAN from your phone anywhere in the world you either need SSH or some VPN port opened either. Alternatively you can use some SaaS server where everything initiate the connection against the remote SaaS endpoint, but if you want to stay 100% local you need to open a port.

For ssh changing the port to something else usually takes out 99% of bots.

Re: Visualizing malicious IP addresses

#56

Post by mianos »

dotancohen wrote: post #52
mianos wrote: post #9

I always wondered how the IPs like this 180.101.88.232 from this block: ISP ChinaNet Jiangsu Province Network Domain Name chinatelecom.com.cn Continue to be the source of thousands of ssh password login attempts for years and years on end. It's not a big deal, I use a tarpit on all ssh with 2FA on the one I use, but it seems ridiculous that some participants of the internet don't give a shit about the rest of the wor…

> I use a tarpit on all ssh I would love to hear more about your approach, if that's not sensitive. My Gmail username is the same as my HN username if you prefer. Thank you!

I run an N100 with LXD so I have a container running one of the many ssh tar pits and point 22 and a bunch other ports to it. It simulates an ssh login that very slowly sends ssh banner lines in the connection protocol, endlessly, until they disconnect.

It commonly thought that they do nothing, but they seem to keep TCP connections open for quite a long time. A assume a hand written scanning client could detect and mitigate the delay but it's going to hold open the sessions on the firewall exit on the other side. If there are enough of these maybe someone might do something.

Makes me smile when I look at the logs, that's enough for me.

It's been covered quite a bit here on HN.

Re: Visualizing malicious IP addresses

#58

Post by iforgotpassword »

mianos wrote: post #9

I always wondered how the IPs like this 180.101.88.232 from this block: ISP ChinaNet Jiangsu Province Network Domain Name chinatelecom.com.cn Continue to be the source of thousands of ssh password login attempts for years and years on end. It's not a big deal, I use a tarpit on all ssh with 2FA on the one I use, but it seems ridiculous that some participants of the internet don't give a shit about the rest of the wor…

It's not illegal to try to log in to an ssh server. Or many. Apart from that I think the map from the article is mostly matching the number of internet-connected devices per country/region. So I think you can replace "some" by "almost all" in your statement. I mean, find a vulnerable iot device, use it for scanning/botnet.

Re: Visualizing malicious IP addresses

#59

Post by globular-toast »

tonymet wrote: post #53

why is ssh open to the internet to begin with? ufw is the first thing I install, even on a "private" network and here's why. I recently installed a router with IPv4 and IPV6. I later found out that IPv6 was globally addressed with no firewall. Always run ufw and begin by shutting off everything to the internet, then only open up what you need.

Erm, because he wanted to use SSH?

Using firewall rules on the hosts is like a fake firewall. Stuff on the hosts can override those rules. Like docker. After all, the host is actually receiving the traffic.

A router isn't a firewall. Lesson learnt: don't assume any "router" device is also a firewall. Last I heard about half of ISP issued routers don't run any kind of stateful firewall for IPv6. The only reason they do for IPv4 is NAT.

Re: Visualizing malicious IP addresses

#60

Post by iforgotpassword »

micw wrote: post #30

"Failed publickey" - does this make sense? What is the chance to brute-force a private key that way?

1. Scrape GitHub et al for accidentally committed private keys, maybe even get the appropriate username.

2. Run botnet that tries all these keys on the entire Internet.

3. Profit!

Post reply on HN