Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Visualizing malicious IP addresses

romeov.github.io

Post reply on HN
Print view View original

81–90 of 124 posts

Re: Visualizing malicious IP addresses

#81

Post by jeroenhd »

tonymet wrote: post #53

why is ssh open to the internet to begin with? ufw is the first thing I install, even on a "private" network and here's why. I recently installed a router with IPv4 and IPV6. I later found out that IPv6 was globally addressed with no firewall. Always run ufw and begin by shutting off everything to the internet, then only open up what you need.

> I later found out that IPv6 was globally addressed with no firewall.

Crazy! What brand router was this? I've never seen an IPv6 capable router configured to permit all traffic by default.

Re: Visualizing malicious IP addresses

#82

Post by jeroenhd »

miyuru wrote: post #49
unraveller wrote: post #17

If you're lucky enough to have a big ISP with a single big block of IP addresses that never changes you can disallow all other ranges on your VPS admin ports and only have to worry about VPNing through that ISP. I guess you could block the main country offenders but you'd have to pay an API to keep up with the IP allocations to be sure.

I just use IPv6 and only allow my ISPs single /32 block. Its neat that IPv6 has cleaned the mess of IPv4 having different IP blocks all over. My prefix is dynamic, If it was static it would be more secure. And also I have fail2ban for good measure.

Another advantage of IPv6, if implemented well by the hosting provider (i.e. they assign you a /64 or larger), is that you can pick a random IP address from a pool of billions to host your SSH server on. There's a tiny chance of accidentally conflicting with another service if you're provisioning your addressing using SLAAC, but that chance is low enough that I'm willing to risk it. Scanning the entire IPv6 internet isn't very feasible for automated tools because of how large the IP space is.

This approach does require some client side hacking, though either in the form of SSH config, or in the form of a split horizon DNS so you can easily access your server, but that's no different from alternatives such as port knocking or simply altering the SSH port.

Re: Visualizing malicious IP addresses

#83

Post by yau8edq12i »

kimixa wrote: post #20
abound wrote: post #18

Earlier quoted context omitted.

Or alternatively, block port 22 entirely on your firewall and use something like Tailscale to access the machine. Of course, now your attack surface includes Tailscale, which has had it's own vulns in the past, but I think blocking all public traffic ends up being much stronger than any weaknesses Tailscale may introduce.

Isn't that just the same thing in different clothes? Just a different protocol offering the same features of authentication and encryption - often using exactly the same primitives? Is it "Security through obscurity" assuming fewer people are attacking vpn protocols that than ssh? And I'm not sure that's even true

Introducing obscurity to the process doesn't make it insecure. Criticism of "security through obscurity" is that security shouldn't rely on obscurity. The system should remain secure even if the attacker knows every detail of your system. Here the point of the "obscurity" (if you can call it that) is to avoid blowing up your logs and wasting compute cycles and energy on attempts that will fail anyway.

Re: Visualizing malicious IP addresses

#84

Post by jeroenhd »

voidUpdate wrote: post #74

So this made me realise where I could find the SSH log file, and I spent a little while panicking at just how many attempts I've been getting on my webserver, and locking things down just a little harder out of paranoia

If you use a good password (meaning a unique, randomly generated one), or disable password login and use private keys only, your chances of getting hacked by any of these are abysmally small.

There are reasons to lock down your SSH port (fear of exploitation of the SSH software, like in the xz backdoor scenario) but I generally wouldn't worry too much about all the failed login attempts in your SSH log, as long as you're using secure enough login credentials.

Re: Visualizing malicious IP addresses

#86

Post by zaik »

3abiton wrote: post #85

I have been doing similar, albeit less complex analysis, of incoming malicious, and it's always surprising the amount of relentless attacks. Any good practices to maintain a secure online server?

No root login, no password login, public key only. This should make ~100% of ssh attacks futile. If you don't want to see many failed login attempts in your logs, listening on a completely random 5 digit port and has worked well for me. You can specify the port in ~/.ssh/config so you don't have to type it every time you log in.

Re: Visualizing malicious IP addresses

#87

Post by iforgotpassword »

chgs wrote: post #67
iforgotpassword wrote: post #58

Earlier quoted context omitted.

It's not illegal to try to log in to an ssh server. Or many. Apart from that I think the map from the article is mostly matching the number of internet-connected devices per country/region. So I think you can replace "some" by "almost all" in your statement. I mean, find a vulnerable iot device, use it for scanning/botnet.

In what country? I suspect that given the intentions it would be a breach of the U.K. computer misuse act for example. Holding the perpetrator to the law is another matter of course.

> given the intentions

Exactly. If I just nilly willy connect to your server, try a password and it works and I immediately disconnect, will that get me in trouble in the UK? That would be worrying.

Re: Visualizing malicious IP addresses

#88

Post by denton-scratch »

voidUpdate wrote: post #74

So this made me realise where I could find the SSH log file, and I spent a little while panicking at just how many attempts I've been getting on my webserver, and locking things down just a little harder out of paranoia

People have been having this experience for ages. The first time you look at access/security logs for an internet-connected server, your jaw hits the floor, you get very curious about who all those bad people are, and you start worrying whether you're doing enough to keep them out.

Re: Visualizing malicious IP addresses

#89

Post by denton-scratch »

ies7 wrote: post #28

> Interesting! We can see the most locations in India, Indonesia, and China as well as a significant number in the US and Europe. Are these because the bad guys are in there or just because of the population size? China, India, US, and Indonesia are the top four of the most populous country and also 4 countries with most internet users. Even the size of 10% of Indonesian internet users are almost the entire Taiwan po…

I was surpriswed at the sharp concentration of addresses in the Netherlands. It looks as if it's a matter of national boundaries - thee's no concentration in Germany or Belgium.

That could be a couple of "relaxed" ISPs, I suppose. I doubt it's a question of different national legislation.

Post reply on HN