i got hacked. what were they up to?

madmango · Guru Joined: 15 Jul 2003 Posts: 507 Location: PA, USA

Please. I wasn't getting any of these attacks until I was an idiot and pinged one of the addresses. Now I'm getting brute-forced all the time. Nobody's gotten in though.

Has somebody looked into WHEN these attacks are occuring? I get scanned around 7:10 PM (GMT-5).

Logs:

befa · Apprentice Joined: 28 Oct 2004 Posts: 208 Location: rennes

if you wanna be more secure, edit your sshd.config and put that

unicolet · n00b Joined: 27 Oct 2004 Posts: 7

vdboor · Posted: Thu Nov 11, 2004 4:49 pm Post subject: Re: automated log scanners

oog · n00b Joined: 18 Oct 2003 Posts: 22

I read through this whole thread and while I think I'm doing the right things to secure my ssh connections (I use a key, disabled root logins, enabled only my own account, turned off all other forms of authentication), I still haven't found a way to force a person to wait for a period of time before they can try another ssh connection. I saw a number of people suggest that in this thread. Does someone know how to do this?

GenKreton · Posted: Fri Nov 12, 2004 5:46 pm Post subject:

revertex · l33t Joined: 23 Apr 2003 Posts: 806

i changed the default ssh port (22) to a higher port (2222).

now the only connections attempt that i see in my logs are mine.
all these attempts seems be produced by linux boxes compromissed by a fool script that only looks for servers with port 22 open.

some dumbass sysadmins must be empaled, how someone with a linux knowledge let your boxes be infected by that stupid worm/script?

i guess they are MSCE forced to deploying linux, then they make it most insecure as possible to blame linux as a unsafe system.

ARC2300 · Apprentice Joined: 30 Mar 2003 Posts: 267

Don't know about anyone else, but I do think that if you get hammered enough on these tries, it can crash your box, or at least drop it offline. I've had my server up for 120 days, no problem. This started, and my box crashes almost every 5 days until I changed ports. And no, there aren't any strange directories or users, and netstat shows only my local IPs causing traffic.

http://home.insightbb.com/~arcruea/attempts.log << Lots of attempts on my IP from 5 log files.

I must say, though, that this is REALLY pissing me off. I've emailed countless abuse@ISP addresses now, and finally gave up. I should write a script, though, that does it for me.

And I looked at one of the address in that attempt log in a web browser. . .it's an HTTP debian server with default install.

_________________
It's fun to take a trip
Put acid in your veins

jkroon · Posted: Mon Nov 15, 2004 8:31 pm Post subject:

Aha, weird thread.

Anyway, when these were at their peaks I picked up to 7 or 8 attempts up per day over a period of about 3 months, still getting a few every now and again. Mostly from taiwan and surrounding area...

port knocking was mentioned a few times, so http://www.kroon.co.za/portknock.php - let me know what you think. I've put this together a while back on request from a system administrator. Afaik there is no problems with it and I've used it for a while until I decided that ssh really is secure enough.

And about the iptables firewall, the following small set of rules should do:

rex123 · Apprentice Joined: 21 Apr 2004 Posts: 272

jkroon · Posted: Tue Nov 16, 2004 11:53 am Post subject:

Well put.

No, I'm afraid as the masses convert (if they ever do) we will see many, many, many more of these types of problems.

I've also had a few "Administrator" attempts, probably aimed at OpenSSH running on Windows ...

Also, I've actually heard of quite a number of successful breakins based on these test type users...
_________________
There are 10 kinds of people in the world,
those who understand binary and who don't

vdboor · Posted: Tue Nov 16, 2004 6:58 pm Post subject:

ai · Posted: Tue Nov 16, 2004 8:27 pm Post subject:

flickerfly · l33t Joined: 08 Nov 2002 Posts: 677 Location: Lanham, MD

Is anyone using tenshi to do reports on the logs for you? I'm curios what your config would look like. I've been meaning to get into that prog and this seems like a good test subject.

I don't care that they fail to log in on I shant try to block them, but I can learn from their efforts.

_________________
An Evil Genious' Guide to Sheeple and How To Avoid Becoming One | 0x4C9EF4A

ARC2300 · Apprentice Joined: 30 Mar 2003 Posts: 267

jkroon · Posted: Thu Nov 18, 2004 5:15 am Post subject:

You really do not a lot of these attempts per second before it should start becoming a serious issue, as in to the degree of slowing down your host. There should be no way for it to crash your machine. It might take it "offline" due to all your bandwidth being absorbed, but there are more effective, stealthier ways to achieve that, such as smurf attacks, or even simple SYN flooding from a spoofed address.

A quick question to ARC2300, you say your box crashed when this started? What exactly crashes, OpenSSH, the kernel, or some other subsystem?
_________________
There are 10 kinds of people in the world,
those who understand binary and who don't

gigel · Guru Joined: 14 Jan 2003 Posts: 370 Location: .se/.ro

after seeing the texts and where they hosted the files i suspect(i mean,i'm sure) there are just another bunch of romanian lamers...

vdboor · Posted: Thu Nov 18, 2004 11:45 am Post subject:

bware · n00b Joined: 23 Mar 2004 Posts: 22 Location: Amsterdam

In general simply run some rootkit checkers to detirmine wether you've been rooted

On a side note... most virus scanners (including the windows variants) are able to detect most rootkits/exploited files.

If you suspect your machine, disconnect it from the net - to keep others from being abused - and check to see if it is so running rootkit checkers, virus scanners, etc. by booting from unwritable media (livecd).

Programs to check are useradd, ps, ls, grep - most rootkitcheckers will do this for you - examine timestamps (simple ls -la will suffice). If you're victim, I'd suggest a clean install, but then again it's up to you
_________________
Regards,
BWare

ARC2300 · Apprentice Joined: 30 Mar 2003 Posts: 267

Actually, I know it hasn't been rooted, as not strange directories have shown up, as well as nothing strange in the logs, and netstat -a shows up nothing out of the ordinary.

And it just crashed after I've switched the port to one much higher, so I'm thinking it's something else. That motherboard has been giving me issues for some time, such as not wanting to take on the other 80GB HDD I just put in (that works fine everywhere else), and losing BIOS information occasionally.
_________________
It's fun to take a trip
Put acid in your veins

vdboor · Posted: Sat Nov 20, 2004 11:35 am Post subject:

hanj · Veteran Joined: 19 Aug 2003 Posts: 1500

hanj · Veteran Joined: 19 Aug 2003 Posts: 1500

ARC2300 · Apprentice Joined: 30 Mar 2003 Posts: 267

Chris W · Posted: Sun Nov 21, 2004 2:19 am Post subject:

Thou shalt not allow tunnelled, clear-text password authentication over SSH

Public key authentication or no access.