ssh distributed dictionary attack... how many requests/sec?

[axl]

Jan 18 02:50:45 ruja postfix/smtpd[4845]: NOQUEUE: reject: RCPT from unknown[88.133.135.163] 450 4.7.1 Client host rejected: cannot find your reverse hostname, [88.133.135.163]; from=<geceho@dale.ro> to=<geceho@dale.ro> proto=ESMTP helo=<[88.133.135.163]>


the relevant part is the ip rcpt from unknown. it's never the same ip. I have logs. over 65535 TOOOOOday.

dale.ro. that seems obvious at this point. bit these sorts of requests.

turn this off.

i can't turn off the domain itself.

this. exactly this. i have been bombarded with these all day. which is weird coz most days ... nothing happens. and then some days ... everything happens.


personally I'm less moved by that day or the other. but why. why does this happen?

You can hide everything. can you hide legacy tcp 25 port?

[eccerr0r]

probably someone found you to have an open relay at some point and trying to prank someone. I wouldn't call this hacking your machine to gain privileges, this is simply exploiting your machine...and failing!
_________________
Intel Core i7 2700K/Radeon R7 250/24GB DDR3/256GB SSD
What am I supposed watching?

[axl]

no.

it's not like a clown thing. u're the worst. haha.


i'm doing everything right.

[eccerr0r]

not saying you're doing anything wrong, but everyone gets this time to time, though it's been a long time since i got that. Most machines don't open relay anymore, but they're hoping they hit one that's open. But in any case, chances of privilege escalation of doing the same thing over and over again is none (unless they figured some race condition...)

That seems like something easy to fail2ban anyway.
_________________
Intel Core i7 2700K/Radeon R7 250/24GB DDR3/256GB SSD
What am I supposed watching?

[erm67]

[eccerr0r]

That's messed up, people doing "research" should ask for permission to do so...unless the intent was malicious, then it really is...

Anyway, my logfile on my burdened machine as of now:

[axl]

https://www.pastiebin.com/5e24b79b87fc5

[eccerr0r]

As for shame lists, I was thinking about some new publish list of these sshd spammers:

Have a website that you can upload your list... but you can't download the list people upload.

The website isn't a simple collation of the lists it receives - the collator will do some massaging like aging the list as needed so people don't stay there if the attacks stop. Perhaps any one host needs to be on more than one person's upload list before it gets published. That number may be something else or perhaps a number of things together (time, number of attempts, etc.)

The collation should help against false positives for someone mistaking fubarring their password. But not sure how well this would work.

I'd be tempted to code something up but I don't know of an easy way to collect data and verify authenticity. Perhaps this needs to be community based of a more tight-knit group of concerned people instead of public access.

Alas DROP is probably the best solution for me and those who are bandwidth limited. I wish I had unlimited large bandwidth that I could redirect to a honey pot, or just have a honey pot, would be interesting to frustrate the hackers.
_________________
Intel Core i7 2700K/Radeon R7 250/24GB DDR3/256GB SSD
What am I supposed watching?

[erm67]

Do you really believe that you have the real ip address of a bad guy in your drop list? Are youy so naive to believe that hackers are so naive to use their real IP address while attacking you? It would be too easy just whois and send an email to their isp ..... your list of shame is probably a list of victims, all the ip you see are just compromised hosts belonging to innocent people. Shaming them publically might be a real crime since none of the ip addresses belongs to a bad guy, all you can do is find out the abuse email address of the ISP where the ip is located and send a complaint to them. They have not commited any crime since they did not actually hack your host so the police is useless.

When I worked for an ISP a few years ago I cleaned several infected servers, of course hackers don't want to be catched and, apart from some stupid script kiddies, never use their IP directly. The first reaction of a lot of customers was we have the ip send the police and have them arrested and explaining them thet it wasn't so easy was just adding another problem to the problem.

Bad guys are a lot mor phobic than you because they risk consequences IRL and don't want to be catched, clearly, being hackers they know that if they use their real IP address even by mistake they will be arrested so they hide behind layers and layers of encrypted connection, a round or 2 of tor, irc chat, C&C malware .... they even use emails to control their malware. Only after an infected host was in their total control for a long time it will be moved up in the control chain, otherwise it will just be used to attack their targets or find other computers/servers to zombifie.

For smtp there another solution, force the use of tls and enforce certificates validation, at that point hackers will also need a valid server SSL certificate and, unless some geniuses @Microsoft decide to trust fake ECDSA certificates, SMTP will be safer. There are a series of problems for that, for example emergency email should be accepted even if tls validation fails, maybe some new future standard will fix that.
For the moment you could create an enforcing MTA-STS TXT record, a TLSRPT TXT, a CAA record for your domain or dnssec, a HTTPS server for MTA-STS policy and allow only tls connections from valid certificates to your server. I say you could because after all that work a lot of good emails would be bounced back; mails coming from big sites like google, yahoo, hotmail etc. comes in but a lot of small ISP don't have a proper TLS setup, and, for example, a lot of mailing lists are sent directly with programs that doesn't implement properly all the TLS stuff etc.

The best working solution for the moment is to allow non tls connections and use ACL rules to drop unencrypted or self signed messages you don't really need (whitelist postmaster@yourdomain abuse@yourdomain stupid ML mailer that doesnt do TLS etc...):
with exim:

[forrestfunk81]

For completeness sake I want to mention fail2ban. But of course this also results in itpables rules only.

I've an internet exposed virtual server running since some years and despite following best practices (non standard ports, key only, fail2ban ... ) I never felt safe. If I got hacked, I probably never would have noticed, because I don't have time to analyze tons of logs every day.

So I started having a look at metrics with Grafana, Influx and Telegraf. You can get some security relevant informations out of the box (i.e. netstat and iptables) or write short scripts pushing own metrics to the database. For example sent metrics for each ssh login via /etc/ssh/sshrc or /etc/profile.d/ script. With proper designed Grafana boards you can check your systems state within minutes instead of hours.
_________________
# cd /pub/
# more beer

[eccerr0r]

IMHO I'm not that worried about being hacked, I'm assuming that if my machine was successfully attacked, most likely others would be too as I'd be using the same software and assumedly same bad passwords as other people. I suspect people hack my machine only because they want another machine for their botnet, otherwise unless it's an easy hack, there's no sense to hack my machine.

However these attack packets are a good portion of my network bandwidth and I want to reduce that as much as possible.

I had a virtually baremetal exposed server running. Standard ports, several standard services (http, smtp, dns), and ssh password authentication. Seems this attracts a lot of attention. I hadn't been blocking a lot of attempts and thus people have been "appreciating" this and thus find it interesting.

Now blocking these packets seems to make it less interesting and hopefully fewer useless-to-me packets get transmitted/received over my IP link.

[msst]

I also use fail2ban and it does reduce the load of these scans quite a bit.

You can set this up to report ssh scans to a blocklist and it is also possible to DL the blocklist and apply it to iptables. Which is slow but means their bot IPs loose their value fast.

[axl]

[axl]

[axl]

[eccerr0r]

The only thing I have to say about "being hacked" is that I do care about detection. Once detection occurs then cleanup will need happen.

It seems for the most part people are dealing with CYA over convenience. It indeed is OCD. These attempts are merely that, attempts. As long as the attempts don't succeed, it's no different than block any attempts from occurring - either way they still don't succeed in logging in.

Except that there's a convenience cost. Whether that be you need to have a certain hardware/software device handy to login remotely or not. I have been thinking about requiring myself (yes this is a home machine we're dealing with, not some company machine) to login to VPN to login remote, but I found that there are still too many networks out there that drop VPN packets (port or udp drop or something) after getting OpenVPN set up and working. *sigh* truly annoying.
_________________
Intel Core i7 2700K/Radeon R7 250/24GB DDR3/256GB SSD
What am I supposed watching?

[axl]

[eccerr0r]

Remember that UDP has no guarantee of packets transferred in order (or even arrival). If your program can't handle out of order UDP packets, that's a bug in that program. TCP the packets will be reordered by the kernel and will not pass packets to the client programs until all packets before it have arrived.

UDP is actually the closest ideal datagram packets for VPNs because it's almost bare IP. Just encapsulate the regular IP packet and send it as UDP, let the endpoints deal with problems, and you have no roaming problems. VPN over TCP was made because of the NAT traversal problem, because NAT wants to be lazy and not keep track of UDP packets -- it's an unsolvable problem when memory isn't infinite. ("almost" ideal because people in the past have used VPN encapsulated in raw IP packets to make it even more like IP, and this REALLY makes routers unhappy, and will happily drop your VPN packets.)

My ISP has no problems with UDP surprisingly enough, but when I'm remote, I do notice many services tend to block UDP because of the NAT problem. I've come across several places that indeed allows UDP to arrive intact and that's what I prefer using if possible. But at least on my own side, it's my own gear that has issues with UDP traversal if any at all. If you have any sort of NAT, that would explain a lot of UDP issues.

(BTW I'm aware of the static+domain name problem and is probably another reason why hackers likes my home machine so much.)
_________________
Intel Core i7 2700K/Radeon R7 250/24GB DDR3/256GB SSD
What am I supposed watching?

[axl]

https://preview.redd.it/duv11av99nm11.png?width=960&crop=smart&auto=webp&s=e936ab3a84fd270493fa2dc504821aad12bb7a39

I really hope the links I'm posting are working. At least for a while.

https://media.giphy.com/media/PAujV4AqViWCA/giphy.gif

Now... i'm gonna go in a corner a laugh my ass off.

It's not that I don't like UDP. I do. But man... it's funny.

[erm67]

[Amity88]

[eccerr0r]

[axl]

I have been hacked once. You didn't ask me directly, but I could share my experience.

Should be noted that: it was a stranger, it was a fluke, it wasn't serious.

It happened in 2010ish I think. A old client which refused updates on the base that it hinders operations. So, over time, someone found a simple openssh remote hack. and that's how they got in in the first place.

Later, while installing a new machine, by ways of chroot as per gentoo handbook, in a remote session, I got careless with my key. I uploaded my key on the remote machine, without knowing it was compromised. The attacker took my key and then got on my network. all my machines. I don't think he was a particular good gentoo guy. He only knew how to compromise openssh. and only a specific version.

later analysis revealed that he would wget his own ssh tar, and just copy the binary over the system binary.

So I think It was openssh 6.6. or around that version. which was vulnerable on its' own, but the guy had a special version of the sourcecode, modified in such a way that it would keep a log of users and passwords hidden as a file in /opt.

took me like forever to find out why that server was infected. and at the end of it... omg... this asshole infected me too. but at the end of it, the big thing he was running was just some irc clients. nothing very nefarious or scary. nothing a good reinstall wont fix.


None the less , with that open bleed ssl bug, and specter and meltdown, you kinda have to ask yourself, would you actually know if you are being hacked? I obsess thinking about that. how would you know. I take crazy measures. like... I have my own piece of code, that counts the memory of every other piece of code happening to run on that vm. And it's a good thing I got a handle on servers and daemons and vm's and stuff.

Coz:

[erm67]

[erm67]