Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Visualizing malicious IP addresses

romeov.github.io

Post reply on HN
Print view View original

61–70 of 124 posts

Re: Visualizing malicious IP addresses

#61

Post by tetris11 »

PhilipRoman wrote: post #46
IAmGraydon wrote: post #7

Earlier quoted context omitted.

Anyone who has run an SSH server on the default port knows that you’ll get hundreds or thousands of login attempts per day. Changing the port to something less obvious and running fail2ban is enough to mitigate most of it. They’re just looking for low hanging fruit.

Changing the default port - yeah, works wonders for reducing noise. But I don't understand why people run fail2ban. Nobody is going to be brute forcing a ssh login, all it does is add another moving part very close to a security boundary for very little gain.

Yes they do. I had a colleague who opened up his machine to another using the logon "remote" and let them set the password.

It was cracked the next day. It turns out having 12345678 is probably a bad password.

Re: Visualizing malicious IP addresses

#65

Post by wolfendin »

dfex wrote: post #29

> Upon closer inspection of Asia, we can notice a significant number of addresses located in South Kora, (and possibly North Korea?), as well as in Taiwan. > I was surpised to see that the distribution of attacks is extremely uneven with most of it concentrated in parts of Asia, Europe, and the US, and (almost) none from South America, Middle East, and Russia. Aside from the casual stereotyping of bad actors here, th…

That’s perfectly consistent with sources of bad actor data I have access to and compile myself.

Re: Visualizing malicious IP addresses

#66

Post by Joel_Mckay »

midnight_shaman wrote: post #63

I always install fail2ban on publicly exposed machines, especially if ssh is enabled. It won't block new malicious IPs but at least it will stop bruteforce attacks coming from each IP

Sure, but most people have had do the walk of shame to a local coffee shop when someone inevitably trips the ban on your own network.

A proper firewall port-knock set interleaved with 5 day ban tripwire port rules is effective at mitigating distributed brute-forcing. However, a ssh route whitelist rule set with SSL or iodine tunnel traffic priority is probably more important (when someone saturates the bandwidth trying to starve your session off the server).

Have a great day =)

Re: Visualizing malicious IP addresses

#67

Post by chgs »

iforgotpassword wrote: post #58
mianos wrote: post #9

I always wondered how the IPs like this 180.101.88.232 from this block: ISP ChinaNet Jiangsu Province Network Domain Name chinatelecom.com.cn Continue to be the source of thousands of ssh password login attempts for years and years on end. It's not a big deal, I use a tarpit on all ssh with 2FA on the one I use, but it seems ridiculous that some participants of the internet don't give a shit about the rest of the wor…

It's not illegal to try to log in to an ssh server. Or many. Apart from that I think the map from the article is mostly matching the number of internet-connected devices per country/region. So I think you can replace "some" by "almost all" in your statement. I mean, find a vulnerable iot device, use it for scanning/botnet.

In what country? I suspect that given the intentions it would be a breach of the U.K. computer misuse act for example. Holding the perpetrator to the law is another matter of course.

Re: Visualizing malicious IP addresses

#69

Post by ykonstant »

tonymet wrote: post #53

why is ssh open to the internet to begin with? ufw is the first thing I install, even on a "private" network and here's why. I recently installed a router with IPv4 and IPV6. I later found out that IPv6 was globally addressed with no firewall. Always run ufw and begin by shutting off everything to the internet, then only open up what you need.

Hey, a question: I also use ufw because I don't understand firewall rules properly. Is there a benefit for me, a desktop user who would like to set up a tiny home network and possibly setup an SSH server to connect from afar, to delve into iptables/nftables instead? I tried once, but couldn't understand how the rules work.

Also, if there is a ground-up explanation of firewall rules, their uses and misuses, and illustrative examples, I'd love if people could share.

Re: Visualizing malicious IP addresses

#70

Post by ykonstant »

iforgotpassword wrote: post #60
micw wrote: post #30

"Failed publickey" - does this make sense? What is the chance to brute-force a private key that way?

1. Scrape GitHub et al for accidentally committed private keys, maybe even get the appropriate username. 2. Run botnet that tries all these keys on the entire Internet. 3. Profit!

Why is GitHub not(?) hosting a flock of repos* with fake private keys/username pairs to annoy/deter those people?

*Flock because of the Cloud? What is the appropriate noun for many repos?

Post reply on HN