News for hackers. Stuff that matters.

A comment on Learn from your attackers – SSH HoneyPot. Parent comment

Re:Learn from your attackers – SSH HoneyPot by thaumaturgy on Tuesday September 19, 2017 @07:02PM (#15289510)
I've been doing something similar to this for years on a mail server that hosts all of my mail as well as a number of customers. Contrary to the other replies, it's worked out really well, and you can rely on customers to complain pretty quickly if anything's not working right.

The bulk of the abuse comes from Russian and Chinese networks, with Brazil working hard to catch up. Those can be pretty well perma-banned without consequence. Under "folks that should be fined into oblivion", there's cogentco.com, quadranet.com, colocrossing.com, level3.com, vpls.com, softlayer.com, hostingsolutionsinternational.com, datashack.net, singlehop.com, actonsoftware.com, and a whole raft of others.

The secret sauce is a carefully tuned ban decay function that scales up with the number of abuses. Occasional hits get a network banned for an hour or less, subsequent hits get them banned a little longer, and then there's a fine line where the function goes exponential, all the way up to 6-month-plus ban periods for really big nuisances.

Otherwise it's just fail2ban on some logs and some home-brew code that does whois lookups on nuisance IPs and some data mining on the whois response.

[ Parent | on HN ]
Re:Learn from your attackers – SSH HoneyPot by forinti on Tuesday September 19, 2017 @07:55PM (#15289715)
I run a Brazilian site and the latest attack came from Europe (France and Bulgaria). I get a lot from the US and China as well.

As we are really only interesting in our state, I don't think twice about banning international IPs and they are mostly from large datacentres.

[ Parent | on HN ]
Re:Learn from your attackers – SSH HoneyPot by noir_lord on Tuesday September 19, 2017 @07:26PM (#15289616)
I can't ban China as our suppliers at work are partly -Chinese, it's a royal PITA, I can't even whitelist them as they have to bound around VPN's just to get around the Great Firewall of China on their end.
[ Parent | on HN ]
Re:Learn from your attackers – SSH HoneyPot by yorwba on Tuesday September 19, 2017 @08:22PM (#15289840)
If your suppliers use VPNs anyway, you can absolutely ban Chinese IPs without much consequence for them. However, if it's for a user-facing site, please don't just ban all of China. After relocating, I was quite annoyed by the number of websites that are unavailable not because they are blocked by the Great Firewall, but because they banned all of China and VPNs to stop the abuse they saw from some IPs in those ranges.
[ Parent | on HN ]
Re:Learn from your attackers – SSH HoneyPot by yeukhon on Tuesday September 19, 2017 @11:53PM (#15290688)
The problem is VPN is now banned unless it's recognized by the state (must be registered). You can still try to use the underground VPN, but not guaranteed. The GFC knows everything in and out. It is one of the most acclaimed and sophisticated closed source networking system in the world. They can toggle on and off in matters of minutes. They have a huge work force monitoring their internet and censoring speech in no time.

Of course the Chinese government are aware of existing circumvention, but they still allowed them because they want to capture data. They let these circumvention to exist even though they have the brightest engineers in China working for them. I vaguely remember a talk from RealCrypto a number of years ago, someone presented how one could try to escape GFC by sending data over different protocols and then resemble by the recipient. It's an ingenious circumvention that is quite hard to decipher, until someone recognizes a traffic pattern, then Chinese government knows.

[ Parent | on HN ]
Re:Learn from your attackers – SSH HoneyPot by meZee on Wednesday September 20, 2017 @06:30AM (#15292218)
Not sure if same protocol, but iirc Dust (https://github.com/blanu/Dust) was supposed to accomplish this. Created by Brandon Wiley co-founder of freenet.
[ Parent | on HN ]
Re:Learn from your attackers – SSH HoneyPot by noir_lord on Tuesday September 19, 2017 @10:05PM (#15290216)
If they consistently used VPN's I would but it seems to be intermittent since the GFWoC is a fickle thing.
[ Parent | on HN ]
Re:Learn from your attackers – SSH HoneyPot by askz on Wednesday September 20, 2017 @04:15AM (#15291668)
You can ask a friend to setup a vpn at home with his traditional ISP
[ Parent | on HN ]
Re:Learn from your attackers – SSH HoneyPot by Zetaphor on Tuesday September 19, 2017 @08:41PM (#15289904)
Would you be interested in open sourcing that?
[ Parent | on HN ]
Re:Learn from your attackers – SSH HoneyPot by askz on Wednesday September 20, 2017 @04:16AM (#15291671)
Yup, would be great!
[ Parent | on HN ]
Re:Learn from your attackers – SSH HoneyPot by hueving on Wednesday September 20, 2017 @01:50AM (#15291136)
> Under "folks that should be fined into oblivion", there's cogentco.com, quadranet.com, colocrossing.com, level3.com, vpls.com, softlayer.com, hostingsolutionsinternational.com, datashack.net, singlehop.com, actonsoftware.com, and a whole raft of others.

What do you mean these should be fined? Level3 is a transit provider for massive portions of traffic on the Internet and Softlayer has some hundred thousand servers.

[ Parent | on HN ]
Re:Learn from your attackers – SSH HoneyPot by unixhero on Wednesday September 20, 2017 @05:16AM (#15291895)
He means that is the host range he saw the most attacks from. Deduction then takes his argument to the understanding that many attackers use Level3 and Softlayer for attacking purposes.
[ Parent | on HN ]
Re:Learn from your attackers – SSH HoneyPot by user5994461 on Wednesday September 20, 2017 @06:20PM (#15298851)
IBM SoftLayer is a reputable cloud as far as I am concerned, just like AWS and Digital Ocean. I've seen and banned a few of the other names given, after concluding that they exclusively provide spam and malicious servers.
[ Parent | on HN ]