Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Visualizing malicious IP addresses

romeov.github.io

Post reply on HN
Print view View original

91–100 of 124 posts

Re: Visualizing malicious IP addresses

#91

Post by chx »

iforgotpassword wrote: post #87
chgs wrote: post #67

Earlier quoted context omitted.

In what country? I suspect that given the intentions it would be a breach of the U.K. computer misuse act for example. Holding the perpetrator to the law is another matter of course.

> given the intentions Exactly. If I just nilly willy connect to your server, try a password and it works and I immediately disconnect, will that get me in trouble in the UK? That would be worrying.

1. mens rea probably applies

2. But if you make a stab at shoplifting and you are successful and give back the item, did you break the law?

I am not a lawyer I am just asking.

Re: Visualizing malicious IP addresses

#92

Post by teddyh »

mr_mitm wrote: post #75
Joel_Mckay wrote: post #66

Earlier quoted context omitted.

Sure, but most people have had do the walk of shame to a local coffee shop when someone inevitably trips the ban on your own network. A proper firewall port-knock set interleaved with 5 day ban tripwire port rules is effective at mitigating distributed brute-forcing. However, a ssh route whitelist rule set with SSL or iodine tunnel traffic priority is probably more important (when someone saturates the bandwidth tryi…

Port knocking is one of those things that sound like a good idea, but there are many possible footguns. And why is it that there is no one consensus (or "blessed") implementation? The implementation by Moxie seems interesting, but needless to say that Python 2 is an instant no-go: https://github.com/moxie0/knockknock It hasn't been updated in 12 years, so why is it that there seems almost no real interest in a solid…

Because port knocking is fundamentally a stupid idea: https://news.ycombinator.com/item?id=39898061>

Re: Visualizing malicious IP addresses

#93

Post by chx »

IAmGraydon wrote: post #7
wsintra2022 wrote: post #6

Interesting, if it’s an issue you could try port knocking to prevent the constant attempts

Anyone who has run an SSH server on the default port knows that you’ll get hundreds or thousands of login attempts per day. Changing the port to something less obvious and running fail2ban is enough to mitigate most of it. They’re just looking for low hanging fruit.

I just run sslh...

Re: Visualizing malicious IP addresses

#94

Post by brazzy »

As others have pointed out, the location of the IP address does not necessarily correspond with the location of the attackers.

Specifically, in Germany, the central-ish culster of dots is in the Frankfurt area, which is also the location of DE-CIX, one of the world's largest internet exchange points, and of roughtly 1/3 of all datacenters in Germany.

So I think rather than comparing the IP locations with population density, it would be even more interesting to compare them with the location of internet infrastructure. This is of course correlated, and probably harder to find as an open dataset.

Re: Visualizing malicious IP addresses

#95

Post by AndroTux »

Joel_Mckay wrote: post #66
midnight_shaman wrote: post #63

I always install fail2ban on publicly exposed machines, especially if ssh is enabled. It won't block new malicious IPs but at least it will stop bruteforce attacks coming from each IP

Sure, but most people have had do the walk of shame to a local coffee shop when someone inevitably trips the ban on your own network. A proper firewall port-knock set interleaved with 5 day ban tripwire port rules is effective at mitigating distributed brute-forcing. However, a ssh route whitelist rule set with SSL or iodine tunnel traffic priority is probably more important (when someone saturates the bandwidth tryi…

> Sure, but most people have had do the walk of shame to a local coffee shop when someone inevitably trips the ban on your own network.

VPN, other server, mobile hotspot... No need to leave the house.

Re: Visualizing malicious IP addresses

#96

Post by reincoder »

ayewo wrote: post #77
reincoder wrote: post #39

You can use IPinfo's IP map ( https://ipinfo.io/tools/map ) or IP summary tool ( https://ipinfo.io/tools/summarize-ips ). Both of these services support sending IP addresses via an API endpoint and can handle up to 500k IP addresses. You can also share the report via URL.

Thanks for the tip. I'm also working on a similar analysis where I need to geolocate a bunch of IP addresses at once.

Feel free to check out the IPinfo CLI: https://github.com/ipinfo/cli

I highly recommend the following commands:

  - grepip: extract IP addresses from text.
  - summarize: The command summarizes the IP addresses and provides output in text. It is different than the summary tool I mentioned.
  - bulk: Bulk/batch enrich IP address. Output can be CSV or JSON.
If you need any help or want me to take a look at those IP addresses (or ASNs and organizations), please create a post on the IPinfo community. I can share the code and instructions with you.

Re: Visualizing malicious IP addresses

#97

Post by Joel_Mckay »

AndroTux wrote: post #95
Joel_Mckay wrote: post #66

Earlier quoted context omitted.

Sure, but most people have had do the walk of shame to a local coffee shop when someone inevitably trips the ban on your own network. A proper firewall port-knock set interleaved with 5 day ban tripwire port rules is effective at mitigating distributed brute-forcing. However, a ssh route whitelist rule set with SSL or iodine tunnel traffic priority is probably more important (when someone saturates the bandwidth tryi…

> Sure, but most people have had do the walk of shame to a local coffee shop when someone inevitably trips the ban on your own network. VPN, other server, mobile hotspot... No need to leave the house.

In theory, remember some firewall policies ban most Tor, Proxy and cloud providers. There is always a way. ;)

Re: Visualizing malicious IP addresses

#98

Post by mr_mitm »

teddyh wrote: post #92
mr_mitm wrote: post #75

Earlier quoted context omitted.

Port knocking is one of those things that sound like a good idea, but there are many possible footguns. And why is it that there is no one consensus (or "blessed") implementation? The implementation by Moxie seems interesting, but needless to say that Python 2 is an instant no-go: https://github.com/moxie0/knockknock It hasn't been updated in 12 years, so why is it that there seems almost no real interest in a solid…

Because port knocking is fundamentally a stupid idea: https://news.ycombinator.com/item?id=39898061 >

Two of your three points don't apply to Moxie's and some other implementations, for example Singe Packet Authentication. You can have sufficient bits, and it doesn't have to be cleartext. Maybe it's technically not port knocking anymore, but it's the same idea.

And it's not about adding more bits to your authentication, it's about vulnerabilities that can be exploited without authentication, like the recent xz backdoor debacle. Port knocking would defend against that, longer keys would not.

This has all been pointed out to you in the thread you linked.

Re: Visualizing malicious IP addresses

#99

Post by Joel_Mckay »

mr_mitm wrote: post #75
Joel_Mckay wrote: post #66

Earlier quoted context omitted.

Sure, but most people have had do the walk of shame to a local coffee shop when someone inevitably trips the ban on your own network. A proper firewall port-knock set interleaved with 5 day ban tripwire port rules is effective at mitigating distributed brute-forcing. However, a ssh route whitelist rule set with SSL or iodine tunnel traffic priority is probably more important (when someone saturates the bandwidth tryi…

Port knocking is one of those things that sound like a good idea, but there are many possible footguns. And why is it that there is no one consensus (or "blessed") implementation? The implementation by Moxie seems interesting, but needless to say that Python 2 is an instant no-go: https://github.com/moxie0/knockknock It hasn't been updated in 12 years, so why is it that there seems almost no real interest in a solid…

If your hobby firewall rule-set compiler is perl based than custom trigger rules are rather trivial.

For a random example, most of these ports will just bind to the default web-server (mitigates loopback attacks etc.):

2021 //tripwire 5 day ban, delay 30s

2022 //SSL tunnel for SSH port on VM, with client source-port range restriction.

2023 //tripwire 5 day ban

2024 //tripwire 5 day ban, delay 130s

2025 //tripwire 5 day ban

2026 //trigger 1: enable trigger 2 for specific IP, 5 second delay to open

2027 //tripwire 5 day ban

2028 //trigger 2: enable trigger 3 for specific IP, 4 second delay to open

2029 //tripwire 5 day ban, delay 19s

2030 //tripwire 5 day ban

2031 //trigger 3: close trigger 2, enable SSL tunnel port for specific IP in 1 second

2032 //tripwire 5 day ban

2033 //close all ports for this client IP, and reset trigger states in 1 second

2034 //tripwire 5 day ban

I think the lack of popularity comes from the ease of locking oneself out (initially manual starting a firewall during configuration without rule caching is wise), and lack of client-side automated handshaking scripts on non-*nix systems.

Someone should put together a little tutorial given many people seem to have lost this simple skill-set. Most people tend to ignore fail2ban integration options like banning game cheats.

Have a wonderful day, =)

Re: Visualizing malicious IP addresses

#100

Post by BenjiWiebe »

jeroenhd wrote: post #81
tonymet wrote: post #53

why is ssh open to the internet to begin with? ufw is the first thing I install, even on a "private" network and here's why. I recently installed a router with IPv4 and IPV6. I later found out that IPv6 was globally addressed with no firewall. Always run ufw and begin by shutting off everything to the internet, then only open up what you need.

> I later found out that IPv6 was globally addressed with no firewall. Crazy! What brand router was this? I've never seen an IPv6 capable router configured to permit all traffic by default.

Me neither, and I've even checked an old ISP-provided router.
Post reply on HN