SSH scans - I caught one

http://seclists.org/fulldisclosure/2010/Nov/228

by mcgin • 16 years ago

162 67 16 years ago

Interesting idea. Reading through the threads it becomes apparent that the attackers are targeting home wired/wifi routers. The attacker sits on your gateway and passively monitors your traffic with you being none the wiser!

AdamTReineke• 16 years ago

How would you detect if your router was compromised?

konad• 16 years ago

plan ahead & run an IDS on it

olefoo• 16 years ago

Depends on the compromise, but generally speaking the observable difference in behavior (assuming you are unable to monitor upstream of the router) is very minor. Greater power drain, and evidence of compromised information being used that could only have been gained from that source.

WestCoastJustin2• 16 years ago

Without having access to a box that was compromised it's hard to tell since the attacker could hide his tracks.

For this case specifically, if you're running openwrt you could try 'ps aux|grep syslgd' and see if you find anything. Then use 'lsof -p PID#' to see what files it's using. Or use 'lsof -i' to see what software has open connections. This can be very telling. Maybe 'netstat -anp| and looks for syslogd connecting out to the internet.

You should really follow basic security best practices and disable sshd on the outside interfaces, firewall unknown address, and switch sshd to a different port (security through obscurity will prevent the mass drive by port scanning).

grav1tas• 16 years ago

Analyze the firmware. If it doesn't pass a checksum, it could be compromised. If the software doesn't pass a checksum, it's compromised. Strange traffic coming out of the router is a bad sign. If the router is running analysis on your packet, you will likely experience diminished throughput on the high end because of limited resources on the router.

I think if you can go without enabling remote access to a router, then you should. This will protect the router itself from direct login attacks from the outside, but if somebody compromises a machine on your LAN, you're boned. If you can't, and you have security concerns, you need to establish metrics of verifying whether or not the router is behaving the same way it was when it came out of the box and (presumably) was not compromised. Like I mentioned, software/firmware checksums are a possibility (these could be hard, though...getting a router to dump its internals out probably isn't a feasible solution for everything), but YMMV depending on what you do and what you need your router to do. My biggest guess at the tell-tale sign of a compromised router is that it just starts slowing down.

rasur• 16 years ago

That's really quite sad - are the script kidiots hoping to take over a bunch of SGI's?

edit: I stand corrected..

DanielBMarkham• 16 years ago

Looks like it tracks to a server/VPS place in The Netherlands

Wonder if he followed-up with the hosting service by reporting the address as being used in an attack. It would be interesting to turn the tables and listen in on some of his traffic going to that address.

nowarninglabel• 16 years ago

Anyone had much luck lately reporting to hosting companies/ISPs? I've reported 7 IPs in the last couple months (4 for malicious/bot activity, 3 for spambots), and never got any responses. Granted, they were all located in Hungary, Romania, or China.

_Lemon_2• 16 years ago

As someone who runs a hosting company -- yes I fully investigate with the information given. Just please try to give as much as possible and make it easy for me to easily pinpoint things.

Oh, and please don't come with a snooty attitude, it's not pleasant to work with.

mrshoe2• 16 years ago

I was the victim of an SSH scan once. I set up an old box as a dev server in my apartment for a project course in college. I was in a group of about 12 students. One of them whose username was robert set his password to robert (a brilliant move).

We only realized the machine was compromised because the interloper decided to pick two user accounts at random and delete them (another brilliant move).

Upon investigation I found that a keylogger had been installed in order to discover the root password. I inspected the output of the keylogger to trace the attacker's steps. Similar to the SSH scan in the article, the attacker had logged into his own FTP server to download various scripts and crackers. Well, the keylogger had logged his FTP password as well (whoops). Naturally I logged in and deleted absolutely everything in sight. :-P

BrandonM3• 16 years ago

> Naturally I logged in and deleted absolutely everything in sight. :-P

...and you probably completely screwed over some hapless soul who was a victim of the same guy who cracked you. Do you think these guys put their IP address and FTP password out there for anyone to collect as evidence? Most likely, he hacked into an FTP server and hosted his malicious files there along with everything else that was already hosted there. Congratulations on breaking the law and ruining someone's day.

16s3• 16 years ago

Most likely the "hacker" broke into the FTP server because the admin of that server used the word "password" as his password. So natural selection took them both out. Two less idiots to deal with.

wizard_2• 16 years ago

Try to get the cops to care about this. Try to get campus security to care about this. Try to get your campus IT department to care about this. (They probably don't want you running servers anyway.)

Law enforcement has bigger issues. In a world where HBO can send a letter to my roommate from an IP in 10 days, and the police investigating a robbery have to wait 9 months for the same thing. You did the right thing.

I would have played a longer con game instead of nuking some random ftp server, he probably just set up another one.

mrshoe2• 16 years ago

I should have mentioned that I definitely thought of this scenario before I deleted anything and confirmed, via the hostname of the server, directory names, and file names, that everything on that server was for h4x0ring (at least for that user account).

I also thought of more subtle and clever ways to exact revenge, but decided I was too busy to pursue any of them.

Also: Do you think these guys put their IP address and FTP password out there for anyone to collect as evidence?

Yes, I do. You're giving the script kiddies far too much credit.

burgerbrain3• 16 years ago

This gentleman is illegally hosting my tools, which are copyrighted and not licensed for redistribution. Just because I try to pwn your box doesn't mean you have the right to violate my copyrights. Expect to hear from my lawyers.

jeebusroxors3• 16 years ago

Would you care to post a quick synopsis of what these tools are doing/their purpose? The thread mentions targeting routers - can you confirm?

burgerbrain3• 16 years ago

I say, that's a joke son. </foghorn leghorn>

devmonk5• 16 years ago

cd /var/tmp;

When I see things like this it makes me think that if standard paths weren't used, then it would it at least make things a little more interesting for the hacker. (They'd have to find a location first.)

jeebusroxors3• 16 years ago

It would be trivial to find a directory. You would be left with a bunch of boxes with things in random places, and programs possibly looking for non existent dirs.

devmonk5• 16 years ago

But for simple devices or server setups with few changes over time, it might be worth it as it would at least cause a little more work to hack in. I remember that it used to be encouraged to use non-standard paths for security's sake, but then it seemed like too much work for the reason you stated. But these days, with more automated attacks relying on standard paths, I don't think it is out of the question.

daten• 16 years ago

cd `find / -type d -perm -o+wx | head -n1`

devmonk5• 16 years ago

I'm beginning to think I could cause hackers a lot of headache via long-running find commands caused by directory trees full of tmp-like dirs. But then they'd just use one of them.

Nitramp• 16 years ago

like, "cd $TEMP;"?

devmonk5• 16 years ago

Change the environment variable name, go through through your apps (and kernel probably) change the code to use a new one. Anything is doable, it just takes time. I'm not saying it is trivial by any means; I'm just saying it is an option. If you build everything from source, it is more doable. In fact, it would be nice to have a secure -nix distro that did it for you. (I know there isn't one that does this, but it could generate a random env var names and paths during install, and maybe change them on demand (by external boot).)

I'm perfectly aware that this could be "extremely difficult" or "not feasible" in many situations, but it wouldn't be so hard to control if you made the device and designed the OS for it (linux-based routers, etc.). I'm just tired of people giving up and laying things out like a holiday dinner because it's "too difficult". Good security requires sacrifice of work and time.

dionysiac2• 16 years ago

  find / -maxdepth 3 -perm -7 -type d -print

and tweak as needed.

devmonk5• 16 years ago

But a find on root takes a lot of time in some cases, during which the attacker could be compromised. And the scripts might not use it for that reason. The script could use it as a backup only if the standard one doesn't exist, but still, it is a bump in the road, and might be worth it to cause the script to use find and delay it.

_b8r04• 16 years ago

The correct way to address this is not to rely on fail2ban or start moving ports around (although these will remove noise from your logs, they shouldn't be solely relied upon) but to use public key authentication. It's not hard to set up and once you disable password authentication support on OpenSSH then the scans can try all they like, but they're not getting anywhere.

http://wiki.centos.org/HowTos/Network/SecuringSSH

younata• 16 years ago

I have this problem right now.

A botnet found one of my computers. Most likely through IRC. They have been trying relentlessly to get my computer added.

They have no chance of getting in - using public key authentication - but it still takes quite a toll on my network speed.

That said, I have a file containing about 366 IPs belonging to this botnet, as well as a half-meg file containing nmap scans of all these IPs. What should I do with it?

_b8r04• 16 years ago

With the places you access the computer from do you use dynamic or static IP addresses?

If they're all static IP addresses, try to block everything on port 22 except for your static IPs.

If it's dynamic you should have a pool address block, you can add the block in but there's a risk that if your block is in an ISPs home user pool that the botnet could infect people in your block.

If you can't use upstream filtering then I'd suggest you configure a firewall to do the same thing, either in hardware (preferable) or software.

nl• 16 years ago

I have a somewhat unique situation which I think stops me from using this.

I access my servers from a shared (Windows) computer. I trust the other users enough not to install keyloggers, but not enough to put the private keys on the computer.

From some experimentation with putty, I can't find a reasonable workflow that lets me save the server configs, but prompts for the private key every time I log in, so I can load them (from a USB key for eg).

The best thing I've come up with is using long random, machine generated passwords with a password manager.

Any better ideas?

_b8r04• 16 years ago

If you password protect the keys it's essentially the same at your end as if you were using a password. The only difference being that they need to copy the keys if after compromising the password they want to log on elsewhere.

akkartik• 16 years ago

book recommendation: http://www.amazon.com/Cuckoos-Egg-Clifford-Stoll/dp/06717268...

runjake• 16 years ago

Lots of needless clutter in the discussion, so I thought I'd drop a quick comment with clarifications:

1. As far as I can tell, this specific attack is meant to target MIPS-based OpenWRT/DD-WRT devices, like the Linksys WRT series.

2. lsof and all that crap isn't available by default. So, use 'ps' and 'netstat -a', and 'ls -la /var/tmp' to poke around your router.

3. Go into the web admin interface and disable sshd on the WAN interface, if it isn't already (it's off by default). In DD-WRT, go to Administration->Management-> and ensure "SSH management" is disabled.

hackermom• 16 years ago

There will always be the usual crowd of "conservatives-just-for-the-sake-of-being-conservative" crying out whenever this advice is given, but here goes: if possible in your environment, and for your users, just run your SSHd on a non-standard port, and the problem of automated scans will be a non-problem.

udp• 16 years ago

A friend had me look at a server that had been compromised by SSH bruteforce a few months ago. The intruder was using it as an IRC bouncer, and he was a romanian named Alexino.

I actually found him on the IRC network, and he tried to get me to pay him to tell me how he got in :)

_b8r04• 16 years ago

I've seen similar things come up before on HN and on mailing lists I'm on. Rather than keep repeating myself whenever this crops up, I've posted here: http://www.minklinks.com/weblog/2010/11/19/practical-guide-s...

adam0101• 16 years ago

I blocked all of China and my logs decreased 65%.

SSH scans - I caught one

Related Stories