Brute.Fail: Watch brute force attacks fail in real time

https://brute.fail/

by mike_d • 3 years ago

728 259 3 years ago

brute.fail

blakesterz• 3 years ago

This is fun to watch, seeing all the passwords is pretty interesting.

Just curious, why x out the IP at all?

zeta0134• 3 years ago

Presumably many brute force attempts come from compromised residential PCs, whose owners may not be aware that they are participating in an attack. It's not especially polite to expose all of that personal info.

mike_d8• 3 years ago

Just curious, why x out the IP at all?

Trying to avoid being a jerk. The sources are likely hacked boxes where the owner has no idea.

Filligree• 3 years ago

And since they don't get called out, they won't get an idea. Unless the infection is retargeted against themselves.

TacticalCoder• 3 years ago

Trying to avoid being a jerk.

There are lists updated in real time by white hats, sharing exact IP of machines known to be engaging in bad behavior. You can, if you want, update your servers in real-time from these lists and then act accordingly: drop the traffic, reject the trafic, serve a "your IP address is participating in brute forcing attempts" page, etc.

FWIW some ISPs may be monitoring these looking for IPs on their subnets and acting accordingly.

It's not about "being a jerk". It's about giving attackers the middle finger.

mardifoufs• 3 years ago

Seems like some of them are residential IP addresses! I guess parts of a botnet or a compromised device?

jethro_tell• 3 years ago

Internet of things.

Lets put 20 unpatched linux computers on every network and see how that goes.

jabroni_salad• 3 years ago

"residential proxy" is a very popular black market service, since it's less straightforward for website owners to block than other common vpn termination points. These applications market themselves as free VPN services, get loaded by special offers bolted onto legitimate software installers, or are added to trojanized pirate distributions of popular applications.

slater2• 3 years ago

Man, that one Brazilian IP really going hard

mdaniel4• 3 years ago

it bugs me that they're not trying the passwords in lexigraphical order :-D

also, who has sshd without `PermitRootPassword=no`? they need to broaden their horizons and try `admin`, `ec2-user`, and `ubuntu` /s

tjohns• 3 years ago

Who still allows password-based login for any SSH account, root or not? Keys, certificates, or Kerberos for all users.

varenc• 3 years ago

The people with PermitRootPassword=no are also the ones that’ll have weak default password. It’s probably actually saving the attackers time that allowing root password login and bad password choice occur together. If everyone with randomized high-entropy root passwords actually allowed root password logins that bruteforcers would have to spend so much more time!

jovial_cavalier• 3 years ago

Even if you disallow root login with a password, the user can still try to log in, and the attempt still gets logged

If you're asking why it would ever be worth it, there's always valuable stuff online with incompetent configuration. I don't know if shodan is still up, but I remember going on there in high school and getting access to random webcams (sometimes in peoples' homes)

BrandoElFollito7• 3 years ago

I do on my home servers where I am the only one and do not need traceability?

Why do you ask, because it is dangerous?

I would love to learn something here.

OptionX2• 3 years ago

Yes, someone got a word list. Shame it's a Chinese one.

czbond• 3 years ago

That's what a typical attempt looks like unless they're progressively timed out with fw blocks

channel_t• 3 years ago

This is a pretty excessive amount of SSH brute force but it honestly doesn't seem as bad as some of the cloud machines I run. There are always like at least 3 different IPs going relentlessly hard 24/7/365.

koolba2• 3 years ago

That’s neat. What’s the total volume per day? Are the passwords themselves being escaped in the final UI rendering? Otherwise you’d have an XSS for a password like “<script>/* code */<script>".

EDIT: Unless it's happening on the server side where it's being saved, I don't think they're being escaped:

    col1.innerHTML = '<span class="fi fi-' + msg.cc + '" title="' + msg.cc + '"></span> ' + msg.src;
    col2.innerHTML = msg.proto;
    col3.innerHTML = '<code>' + msg.u + '</code>';
    col4.innerHTML = '<code>' + msg.p + '</code>';

mike_d8• 3 years ago

It is escaped server side. Anything long enough to be a useful payload is trimmed.

koolba2• 3 years ago

How short we talking?

Since there's multiple opportunities to inject code, it's possible to split out the payload across multiple fields: https://www.highseverity.com/2011/06/xss-in-confined-spaces....

Ten characters per block is enough for:

    <script>/*
    */eval(/*
    */'....'+/*
    */'....'+/*
    */'....'+/*
    ...
    */)/*
    */</script>

Best to escape everything at render time.

mike_hock2• 3 years ago

As the other comment said, just write proper code instead of going "oh but it's escaped and size-limited."

JS has sane APIs where no string is "dangerous," use them.

unlog• 3 years ago

Sorry, but this is not the way. It's like saying, "but I am escaping my inputs on sql with my function"... instead of doing the right thing.

The equivalent code is really not that hard:

    const span = document.createElement('span')
    span.setAttribute('class', 'fi fi'+msg.cc)
    span.setAttribute('title', msg.cc)

    col1.appendChild(span)
    col1.appendChild(document.createTextNode(msg.src))

    col2.textContent = msg.proto

    let code = document.createElement('code')

    code.textContent = msg.u
    col3.appendChild(code)

    code = code.cloneNode(true)
    code.textContent = msg.p
    col4.appendChild(code)

or something in these lines.. you get the idea

ok_dad• 3 years ago

I kinda want to know the server's address so I can send a "hello_hn" message in the passwords there.

spuz• 3 years ago

I tried the IP resolved by the domain "brute.fail" but it doesn't accept SSH connections :)

dmurray• 3 years ago

The Internet is not that big, though. You could potentially try all 2^32 IPv4 addresses with your password of choice and see when it came up here.

sltkr2• 3 years ago

I tried mikedamm.com (the author's domain) and it does accept SSH but my failed login attempts don't show up.

seabass-labrax• 3 years ago

Fun idea, but the data for this site (which is streamed via a WebSocket) doesn't contain that information :)

fragmede3• 3 years ago

Upthread the author says one of the three servers is in Digital Ocean, which gives you an AS to target. Reverse engineer the web page so you can capture the websocket to your terminal, grep it for your IP, and search all of DO's ipv4 address space. use Shodan to limit your targets to only machines with an open port 22 to make it go faster.

cyclotron3k• 3 years ago

Looks like it's been figured out. People are basically using it at a chat service now

jonfairbanks• 3 years ago

This is cool... is it open source? :)

fullspectrumdev• 3 years ago

Oh that’s pretty fucking cool.

Is code available anywhere?

I run a slowly growing network of SSH honeypots that do central logging (Greylog), that I’ve been meaning to document the setup of for here somewhen.

Bolting something like this onto that would be pretty funny.

mike_d8• 3 years ago

No code yet, it was literally pieced together last night.

It is only processing SSH attempts from 3 hosts right now (one in colo, one EC2, one DigitalOcean) because when I pointed the full firehose at it the user experience of the website wasn't great.

Elrecoal• 3 years ago

Damm, the same brazilian IP is trying really, really hard

OptionX2• 3 years ago

If this doesn't get to install fail2ban don't know what will.

lloydatkinson• 3 years ago

And SSH key only login

mdaniel4• 3 years ago

I was actually thinking about that: OT1H, fail2ban would really clean up the list, so it's not monopolized by the one joker, but OTOH given sufficient spans of time it would make the output go quiet, which for this specific case defeats the purpose

I actually much prefer the projects that give the caller a fake shell, and watch what they type after "breaking in." It'd be the Kitboga of ssh attacks :-D

Sodman• 3 years ago

I would 100% watch the Kitboga of ssh attacks, is that something that exists today? The closest I've seen so far is password purgatory - https://www.troyhunt.com/sending-spammers-to-password-purgat...

OrangeMusic• 3 years ago

give the caller a fake shell, and watch what they type after "breaking in."

Oh YES! Do it, please! We could learn a lot!

firstlink• 3 years ago

I don't see the point of fail2ban on a server without password login, except to keep the log file tidy. That isn't worth risk of locking out legitimate users due to misconfiguration or user error. CMV.

fragmede3• 3 years ago

Keeping the log file tidy isn't just an OCD thing. If you're searching for a needle in a haystack, where needle is "suspicious login", and the haystack is "all of the login attempts from the past the months", your job is made much easier when the haystack is much smaller.

That said, the fail2ban defaults are way too low and I've locked myself out with them. They can be turned way up (ban after way many more attempts) so that there's no risk of locking out legitimate users. (Assuming your users didn't forget their exact password and then generated a small dictionary to try with.) On a server with potential misconfiguration, accepting passwords is one of them.

vsviridov2• 3 years ago

For this reason I've put `endlessh` on port 22 and moved actual ssh elsewhere...

Also started using Crowdsec recently, but not sure about if it's worth it...

fail2ban out of the box works fine for SSH, but for dovecot and postfix it's somehow broken, and the configuration scripts are just too obtuse.

kenniskrag2• 3 years ago

Nice idea. From the docs:

Endlessh is an SSH tarpit that very slowly sends an endless, random SSH banner. It keeps SSH clients locked up for hours or even days at a time. The purpose is to put your real SSH server on another port and then let the script kiddies get stuck in this tarpit instead of bothering a real server.

Since the tarpit is in the banner before any cryptographic exchange occurs, this program doesn't depend on any cryptographic libraries. It's a simple, single-threaded, standalone C program. It uses poll() to trap multiple clients at a time.

https://github.com/skeeto/endlessh

jhartwig• 3 years ago

Wow. That is pretty brilliant.

artursapek2• 3 years ago

That’s hilarious

operator-name• 3 years ago

I'd be cautious about stuff like this - if you annoy the wrong person that could paint a target on your back.

avidiax• 3 years ago

I spent 10 minutes to set this up. I was shocked to see that I got my first taker less than a second after I opened port 22 on my firewall.

https://www.abuseipdb.com/check/178.62.237.183

Unfortunately, it only wasted 30 seconds of that IP's time.

It's not clear what type of tarpit would waste the most of the operator's time. Maybe something like a "byzantine VM", that seems exploitable, takes payloads, passes initial checks, and then starts having "problems". DDOS attacks redirect to the C&C server. Coin miners report false mined coins. Hosted files have corruption, and won't complete transfer, etc. Whatever it is, it needs to somehow seem like the operator has an error in their code :)

sltkr2• 3 years ago

That seems like overkill. I just disable password authentication, and use SSH public keys only. It prevents brute force attacks completely.

BrandoElFollito7• 3 years ago

This, and move the endpoint on an uninteresting port to lower the noise in the logs

ravi-delia• 3 years ago

It's not for security, it's public service and entertainment

bootsmann3• 3 years ago

Do the dovecot and postfix scenarios work well for you with crowdsec? Always like hearing user stories :)

vsviridov2• 3 years ago

I think the blocklists have filtered out a bunch of that noise, so from a straigh-up dovecot logs I've not seen much yet...

koromak• 3 years ago

Its just stupid at this point. You can put up a wordpress site with 5 daily visitors, and you'll still get thousands of SSH / xmlrpc hits per day.

andyp-kw• 3 years ago

The range of IPV4 address's is small enough that a single server can scan it, in a single day.

So I guess the problem isn't going away.

m00dy• 3 years ago

Realtime honeypot

0___0• 3 years ago

http://www.m-d.net/projects.php

slater2• 3 years ago

looks like it's getting hn-hugged to death.

technics256• 3 years ago

Guess it got brute forced

tiagod• 3 years ago

Two hours layer, it's still dead.

Kailhus• 3 years ago

Yep, totally pwned

quickthrower24• 3 years ago

Hugged on port 80/443 or 22

gambiting3• 3 years ago

I have an RDP server open to the internet(on a custom port) and it just receives an absolutely relentless stream of login attempts with all kinds of random logins. That's a private server on a private home IP, not associated with a known domain or anything. Changing the port stops it for about 24 hours then it starts again.

omgmajk3• 3 years ago

Yeah, we have the same problem. I made a custom firewall rule and a python script that watches the windows logs for multiple failed logins to combat this and it seems to work pretty well but there's always new ips.

SlavikCA• 3 years ago

IPBan does that:

https://github.com/DigitalRuby/IPBan

justsomehnguy• 3 years ago

https://github.com/al-ign/Protect-RDSFromBruteforce

Solvency• 3 years ago

I know nothing about networking, so pardon the ignorance:

Why isn't there (or is there) some kind of service you can use to map some crazy URL to your personalip:port, like...

http://obscuremyshit.com/393nnasjhf83u98723401 = personalip:port

And only when a connection is referred from that source, does the RDP server even expose itself? And for all other traffic that hits personalip:port, it does absolutely nothing?

fragmede3• 3 years ago

There are numerous ways ways around it (port knocking, VPN) that gambiting (for whatever reason) is choosing not to employ. Your idea is a good one though

KMag2• 3 years ago

Is there some referrer field in the RDP protocol handshake that I'm not aware of?

m348e912• 3 years ago

Why isn't there (or is there) some kind of service you can use to map some crazy URL to your personalip:port,

You might be able to do this by responding with a hyperlink which points to ssh://x.x.x.x:1234

Some browsers will recognize that format and pass to an ssh client application to spawn an appropriate ssh connection.

The reason why it's not a worthwhile idea is that there is a limit of 65535 ports to chose from on a given IP address and they all can be scanned pretty quickly in order to locate an active SSH service port. This really makes the URL idea ineffective.

Port-knocking may be a little bit more effective because the SSH service will not reply to a connection request unless you've attempted to establish a connection on a different port first. Scanning for an open SSH service becomes much more difficult.

diarrhea• 3 years ago

That’s how I hide my password manager, but that’s HTTP and has Header fields to dispatch on in the reverse proxy.

throwaway742• 3 years ago

Why not VPN?

gambiting3• 3 years ago

Because it's a disposable server running in an isolated VM that I need for one reason only and even if someone does break in(impossible with these random logins, and I assume RDP doesn't have any currently known security faults) then it wouldn't be the end of the world - I have a notification on successful login so I'd be told if it ever happened and I would just kill the VM instantly. Right now it's exposed to the internet for simplicity sake.

costco• 3 years ago

Welcome to the world of "cracked RDP"! Various internet lowlives get a big list of bruteforced RDP IPs/credentials then sell them in bulk: https://www.bleepingcomputer.com/news/security/over-85-000-h.... Sometimes the hacked machines are used to start attacks from.

omgmajk3• 3 years ago

I like that I'm not alone in the world of obsessively looking at my log files.

menotyou• 3 years ago

I put on my firewall a block for incoming traffic for all IPs outside Europe which helped a lot with the quantity of attempts.

Gunnerhead• 3 years ago

Very naive question: can a bad actor just use a VPN to get around this?

marcrosoft• 3 years ago

Yes

flangola72• 3 years ago

Not if you also block VPNs

oriettaxx2• 3 years ago

is it possible? how did you filter?

(I've tried 2 years ago: at that time even aws is not able to provide a reliable EU ip list)

LaputanMachine• 3 years ago

I use this setup [1] on my servers. IPs are mapped to countries using Maxmind's GeoLite2 database. Linux's Tcp Wrappers are configured to block access for all IPs that aren't in my country.

A custom fail2ban jail adds all IPs that get blocked by the Tcp Wrappers to the system's firewall.

[1] https://www.axllent.org/docs/ssh-geoip/

ztgasdf• 3 years ago

Getting PR_END_OF_FILE_ERROR on Firefox, anyone else?

drewg123• 3 years ago

I was too.. I then disabled DNS over https (which was pointing at nextdns) and it started working. Not sure if that was coincidence or an actual fix

chrismorgan2• 3 years ago

A remark on your fail.js, since you’re engaging here and I figure this could interest you or others:

Once there are more than thirty rows, you fade rows in like this:

  row.style.opacity = 0;
  let intervalId = setInterval(function() {
      opacity = Number(window.getComputedStyle(row).getPropertyValue("opacity"));
      if (opacity < 1) {
          opacity = opacity + 0.1;
          row.style.opacity = opacity;
      } else {
          clearInterval(intervalId);
      }
  }, 100);

This would be better done with a CSS animation or transition—it takes less code, and is smoother.

My suggestion: use animation. Replace the JavaScript with this:

  row.classList.add("fade-in");

And add this CSS:

  .fade-in {
      animation: 1s fade-in;
  }

  @keyframes fade-in {
      from { opacity: 0; }
  }

This does behave a little differently, as if the window isn’t visible, it’ll (roughly) wait until you focus the window before playing the animation. Frankly this is even mildly more desirable.

The alternative: use transitions, which are a tad more involved because you have to trigger the value change one frame later, so that it recognises that something has changed and interpolates to it, rather than it just being the initial value and applied instantly. This JS would do:

  row.style.transition = "1s opacity";
  row.style.opacity = 0;
  requestAnimationFrame(() => {
      row.style.opacity = 1;
  });

Or you could express it with more CSS, like with this CSS + JS:

  tr {
      transition: 1s opacity;
  }

  .invisible {
      opacity: 0;
  }

  row.classList.add("invisible");
  requestAnimationFrame(() => {
      row.classList.remove("invisible");
  });

—⁂—

You might also like `vertical-align: middle` on your spin.svg.

—⁂—

On the flag icons, here’s a cool alternative technique: https://en.wikipedia.org/wiki/Regional_indicator_symbol. Lets you avoid needing even images. Unfortunately, I think Windows still doesn’t ship flags, so you’ll get the two-letter country code there. You can get around this by packaging a web font. It’d be nice if someone would neatly package a flags-only font so others can easily use it. Here’s what I did a few months back for https://ganintegrity.com/country-profiles/, resulting in a single 77KB font file:

  /**
  Copyright 2020 Twitter, Inc and other contributors
  Graphics licensed under CC-BY 4.0: https://creativecommons.org/licenses/by/4.0/
  Twemoji Mozilla packaging via https://github.com/mozilla/twemoji-colr, subset to only include country flags.
  */
  @font-face {
      font-family: flag;
      /* (Generated with `pyftsubset /opt/firefox-nightly/fonts/TwemojiMozilla.ttf --unicodes="U+1F1E6-1F1FF" --output-file=static/TwemojiMozillaFlags.woff2 --flavor=woff2`.) */
      src: url(/static/TwemojiMozillaFlags.woff2) format("woff2");
  }
  
  /* Why do we do this? Because at the time of writing Windows doesn’t do flags, so ‹guzzled by HN› will look like “ᴀᴜ” rather than an Australian flag. (macOS and major browsers on Linux do.) */
  .flag {
      font-family: flag;
  }

mike_d8• 3 years ago

Thanks! This is incredibly helpful! I searched around a bit at like 3 AM while I was building it, but couldn't find a simple clean example like what you provided. Once traffic dies down i'll swap it out.

kwar13• 3 years ago

wow I just got a lesson in css for free. Thanks for taking the time!

dlgltlzed• 3 years ago

Talking about animations, the little animation next to "Connected to WebSocket" is an SVG. I did not know until today that SVGs may be animated. Nice to know.

chrismorgan2• 3 years ago

That’s SMIL. You can also use CSS animations on SVG these days.

boringuser23• 3 years ago

Thinking about it, fail2ban is almost entirely a placebo given that your password should be basically impossible to brute force anyways if you have the knowledge to implement fail2ban.

awestroke• 3 years ago

It can conserve server resources to just stop responding to brute force attacks

veave2• 3 years ago

If your server is a Gameboy, maybe.

alexchamberlain• 3 years ago

Better: just ban password logins, and use cryptographic keys instead.

quickthrower24• 3 years ago

Use Role Based Access Control

seized2• 3 years ago

Fail2ban can work on more than just sshd.

artursapek2• 3 years ago

be careful, this website is easy to vandalize

Dwedit2• 3 years ago

It's easy to see that *certain website* has not yet found this host, judging by the lack of *certain words*.

ChuckMcM• 3 years ago

So funny story, for a while I worked on a 'reverse' exploit. Which is to say morphing the response from ssh to the client with large malformed packets. The idea was to crash the client making the request. In my case I found these attacks would have like 6 to 10 attempts from the same source address. By time stamping the requests, I could evaluate if the next attack from the same address came more quickly or more slowly. I then had my server "morph" the return payload somewhat randomly and keep the three responses that caused the most slowdown. When I got to 100 variants that had "won" this selection criteria I took the three best and started over from there. After a couple of months of this I finally got a response where after one request I would not get a second.

I felt extremely pleased with myself for about another month, and then my server address got hit with a massive DDOS attack (for me anyway) over my 6MBPS DSL line. So clearly I had hit a nerve somewhere :-). Anyway, I moved my server to a different address and used fail2ban to just note source IPs and put them into the IP tables as banned addresses. That works great and hasn't resulted in the same sort of drama as last time.

sneak• 3 years ago

Disable password authentication and fail2ban becomes completely unnecessary.

nico3• 3 years ago

You still get the attacks and they show in the logs

Also, it’s not just ssh, there are brute force attacks for pretty much any service that you run

Our logs show automated attempts to run exploits on our web servers everyday

BrandoElFollito7• 3 years ago

This. I really do not understand why people use fail2ban when the threat is somewhere else.

It won't stop a ddos but will certainly, at some point, prevent you from logging in.

XorNot• 3 years ago

I prefer libshield but one thing I've found is that annoyingly sshd didn't use PAM to check if the login user is valid apparently (so it never fires when only using keys).

wkat42428• 3 years ago

Not really. A lot of these bots are super duper dumb and continue slamming your server with handshake attempts even if password auth isn't even turned on. Every handshake is wasted CPU resources (and asymmetric crypto isn't cheap). It also makes it harder to see real dangers in the logs.

scrps• 3 years ago

And/or run sshd exposed only to a wireguard or tailscale interface.

seized2• 3 years ago

Not for other services... I have fail2ban parsing my NVR logs. Wrong password three times and it permanently blocks the IP on my Opnsense firewall.

nvarsj• 3 years ago

And change the sshd port. I use my birth year. 0 brute force attempts in the logs after that.

mike_hock2• 3 years ago

You still got the response packets?

DougMerritt• 3 years ago

Nice. Also an illustration that its good to establish one's inner motive first, like here might range from a desire for simple solutions, to another dimension of drama, which might indeed be desirable sometimes, for entertainment or for snapshots to use in a book one is writing. :)

lgats• 3 years ago

Another fun one is sending a redirect to a gzip bomb or extremely large file (i.e. speedtest download file) for when certain non-existant URLs are requested, i.e. /wp-login.php on a non-wordpress site.

KomoD5• 3 years ago

Earlier this month I was downloading top 1 million websites' robots.txt and some guy just served 100mb of whitespace :/

gitgud• 3 years ago

Is it legal to host a gzip bomb? Seems like a malicious file to serve up…

quickthrower24• 3 years ago

Distributed valgrind

api• 3 years ago

Try negotiating ssh compression and then sending terabytes of compressed zeroes. Might work for a badly implemented scanner.

KomoD5• 3 years ago

Semi-related, I've just started serving large files to webserver scanners, some are so poorly made that they just download the entire file

heyoni• 3 years ago

Details!

Seriously this is both hilarious and intriguing and deserves a long form blog post or something.

myself2482• 3 years ago

Seriously, this should be standard practice. Fail2evil...

fireant• 3 years ago

Wow that's a cool evolutionary algorithm in practice! I'm actually surprised it worked, especially with the amount of fuzzing I'd expect ssh ecosystem to receive (well perhaps the servers do, but not the clients haha).

Jenda_• 3 years ago

MySQL has a weird feature, by default enabled in many clients, that the server can request a file from the client.

I have requested /etc/shadow, cracked the hash for root password, and ssh'd back into the botnet node that was bruteforcing passwords. I then shared the information with the webhoster where the botnet was running and a local infamous antivirus company (Avast before it was leaked that they are evil) and got a t-shirt.

https://www.abclinuxu.cz/blog/jenda/2019/2/exploiting-mysql-...

mdaniel4• 3 years ago

Outstanding job! My opinion of mysql continues to improve :-/

As a curiosity, I found the submission link in the comments on that thread https://news.ycombinator.com/item?id=19305823

nico3• 3 years ago

This is amazing!

Are you open sourcing this?

Can others stream their logs to your servers and have a crowdsourced list of attackers in real time together with their activity?

creeble• 3 years ago

See abuseipdb.com if you care about this.

nico3• 3 years ago

Thank you!

Wish the ISPs would subscribe to this and blocked traffic from the abusive IPs in their networks

Clicked on a random IP on the front page, it said it’s from Palo Alto Networks in Santa Clara, that it was first reported in 2022 and the last report was 5min ago. So that IP has been doing shady stuff for months and it seems their ISP (Palo Alto Networks) doesn’t really care

bootsmann3• 3 years ago

Hey we actually built the second part as a product. Its a modern revamp of fail2ban combined with crowdsourcing aspect to deliver an up-to-date blocklist of active threats. You can check it out at https://github.com/crowdsecurity/crowdsec

nonethewiser• 3 years ago

Are these really failures though? This is just how brute force works.

avodonosov• 3 years ago

Some of these credentials could be of legitime users who have just mistyped the IP address.

rabuse• 3 years ago

The odds of that are slim to none.

londons_explore• 3 years ago

I'm of the opinion that if they accidentally leak their credentials to anyone, they might as well leak them to everyone.

Sure, the risk of compromise goes up, but the whole culture of "we only sent those passwords once on unencrypted ftp across the internet" leads to powerful nation state spies having a field day...

If all unencrypted data sent over the internet were in a big public archive for everyone to see, then people would soon clean up their security habits.

BLKNSLVR• 3 years ago

In the intro text it specifically says:

No legitimate services are offered on the addresses receiving these attempts, so there is no chance of a real user accidently submitting their credentials. (Yes things other than SSH occasionally show up)

msephton• 3 years ago

Server down

nubinetwork4• 3 years ago

This sounds interesting. When it comes to my setup, I don't even answer their connection attempts. I just log the IP and call it a day.

You'd think that would be enough for them to stop, but I have some IPs with 25k connection attempts over a 90 day span. (Of course it had to be someone using digitalocean)

segmondy• 3 years ago

I use port knocking on 3 preselected ports to open up ssh which is not on port 22. I can't bother to have my logs cluttered with these garbage.

satvikpendem• 3 years ago

This site is now brought down due to the collective brute forcing of HNers visiting the site, as if akin to a DDOS. How ironic.

mike_d8• 3 years ago

Is it not working for you? I see over 350 active users at the moment.

I did get one report that it was blocked by a corporate network because the domain was newly registered.

Shakahs• 3 years ago

The Websocket connection did stop updating a few times when your site was getting the HN hug.

You could push an updated list to Cloudflare KV every few seconds and have the front end poll it from there for cheap and near unlimited scalability.

yonatan80703• 3 years ago

I've seen people call this the "Hug of death" when your post gets so popular the site goes down

psawaya• 3 years ago

What about an actual user fat-fingering their username but entering their password correctly? Would this publish that attempt publicly?

huy-nguyen• 3 years ago

From the site:

No legitimate services are offered on the addresses receiving these attempts, so there is no chance of a real user accidently submitting their credentials.

foobarbecue• 3 years ago

Would be nice to have timestamps on these to get a feel for how fast they're coming in.

wkat42428• 3 years ago

It's not that funny.

While there may be millions of useless attempts, it only takes 1 to get through.

Of course SSH has a great option in key / certificate auth. So if that's enforced it's not such a big deal. Many other systems don't (at least not until we finally implement Passkeys everywhere).

nerdbert• 3 years ago

It's not a real ssh daemon; there's no "through" to get.

KomoD5• 3 years ago

"Yes things other than SSH occasionally show up"

Like what?

FinalDestiny• 3 years ago

I just saw an FTP one

mike_d8• 3 years ago

HTTP/HTTPS basic auth, FTP/FTPS, LDAP, SSH, and a few other protocols are supported. I only show ones that actively try credentials, not just port scans.

KomoD5• 3 years ago

Interesting!

chlorion• 3 years ago

I setup SSHD to listen on a wireguard interface rather than listening on all interfaces. This makes SSHD only accessible to wireguard peers rather than the entire internet.

A nice aspect of wireguard is that it's "steath", meaning that it does not respond to unauthenticated connections at all, so there is no way to probe and scan for wireguard listeners at all.

I think setting up daemons behind wireguard offers a lot of security. SSHD is probably fine to expose, but something like an IRC bouncer for example really benefits from being protected I think.

I use ZNC over wireguard for this reason! It also allows to use ZNC securely without the need to setup TLS certs, which IME is actually harder than setting up wireguard!

slim• 3 years ago

maybe telnet over wireguard ? :)

yonatan80703• 3 years ago

That just sounds like SSH with extra steps

runeks• 3 years ago

A nice aspect of wireguard is that it's "steath", meaning that it does not respond to unauthenticated connections at all, so there is no way to probe and scan for wireguard listeners at all.

I did not know this. That’s really cool.

Is it done over a stateless protocol like UDP, or is a TCP connection opened first? Ie. is it impossible to see if there’s even a server there at all, or is it first revealed that there’s a server accepting a TCP connection?

omegabravo• 3 years ago

It's over UDP, you can't probe for wireguard AFAIK

jofla_net• 3 years ago

openvpn has had an option for such behavior (over udp obviously) for a while. the option is called tls-auth, it requires you to go through and generate an aditional key which has to exist on all clients and server. Last i remember is that even if you scan the server, it is completely quiet unless the right signature is received as well for each frame.

ttsiodras• 3 years ago

This is why I come to HN - brilliant ideas that I should have thought of before, but didn't!

I just changed my server, and uninstalled the - now truly useless - fail2ban. I use SSH keys of course, but without fail2ban my server's logs were constantly flooded with hacking attempts.

No longer - wireguard for the win. Thank you, chlorion!

saulrh• 3 years ago

Kudos to 185.65.135.x, who attempted to log in with username hn_i_found_it right as I checked HN after work and opened the link, and who proceeded to attempt a number of different simple SQL, html, and js injections. I approve of this effort. I also approve of the author of this site, which appears to have survived this minor attack! :D

iaskedchatgpt• 3 years ago

HELLLOOO HACKER NEWS!

shadowgovt• 3 years ago

Is hiding the last octet of the IP address really enough privacy?

anticrymactic• 3 years ago

Do these people deserve privacy?

Dah00n2• 3 years ago

Yes, because many are residential IPs, so likely hacked machines in a botnet.

Timber-6539• 3 years ago

I don't use password authentication and enforce fail2ban on all of my publicly accessible ssh servers.

Even if someone was to steal my keys or knock at my ssh servers with a zero-day, I will be alerted[0] of any successful login(s).

[0] https://github.com/64mb/SLAT-ssh-login-alert-telegram

pabs3• 3 years ago

It is probably time for OpenSSH to deprecate and remove support for password based authentication.

densekernel• 3 years ago

Would be cool to see brute.success

steakscience• 3 years ago

Would be cool to have another column true/false if that IP is a VPN IP

MrGagi• 3 years ago

It's crazy how much bots can keep trying to enter, and this bot from China really keeps trying, fail2ban really saves our ass

michaelcampbell3• 3 years ago

I was struck by the preponderance of Singapore. Why there?

Sami_Lehtinen• 3 years ago

I guess you guys could find this also interesting: https://infosec.exchange/@rdpsnitch

Brute.Fail: Watch brute force attacks fail in real time

Related Stories