When Chinese hackers declared war on the rest of us

Re:When Chinese hackers declared war on the rest of us by Supermancho on Tuesday January 15, 2019 @01:22PM (#18913483)

Take any given server. Log the IPs of invalid SSH attempts to access the machine over 3 months. Plot the IPs on a geolocation.

Chinese originating IPs are the overwhelming number.

I posted my actual data years ago as a response to some comment, but I could just grab my recent logs and nothing has changed much (frequency, outliers, and some volume trading).

While the phrasing may be obtuse, it's a sentiment reflecting reality.

[ Parent | on HN ]

Re:When Chinese hackers declared war on the rest of us by auiya on Tuesday January 15, 2019 @02:33PM (#18914142)

It would stand to reason. China has the largest number of endpoints, and thus is most likely to have the largest number of compromised hosts. I take it you've ruled out the possibility this is a geographically diverse spread of actors taking advantage of poor security practices on the large swaths of Chinese infrastructure in your logs?

[ Parent | on HN ]

Re:When Chinese hackers declared war on the rest of us by monocasa on Tuesday January 15, 2019 @04:04PM (#18915254)

China has large numbers of pirated unpatched systems meaning that botnets have large presences in China, regardless of who's running their command and control.

[ Parent | on HN ]