4 ms·

What's the best way to make sure that your system isn't part of this?

gameboy24 11y ago
https://www.stateoftheinternet.com/downloads/pdfs/2015-threat-advisory-xor-ddos-attacks-linux-botnet-malware-removal-ddos-mitigation-yara-snort.pdf https://www.stateoftheinternet.com/downloads/pdfs/2015-threa... Read Section 7.0
doguozkan 11y ago
I think monitoring your outgoing traffic would give you a clue. Also if what I read on Ars is correct, this botnet preys on weak root passwords, so disabling remote root or using keys would be great ways to protect yourself against this botnet.
- mirimir 11y ago
  This! And also, in sshd_config, disable password-based authentication. But first, make sure that key-based authentication works ;)
deleted 11y ago
[deleted]
- digi_owl 11y ago
  Makes one ponder the issue of monoculture...
  - johnchristopher 11y ago
    Sorry, I tripped up.
johnchristopher 11y ago
I garbled my post :( Pull the plug /s Don't allow password-based SSH access. https://blogs.akamai.com/2015/09/xor-ddos-threat-advisory.html https://blogs.akamai.com/2015/09/xor-ddos-threat-advisory.ht... https://isc.sans.edu/forums/diary/XOR+DDOS+Mitigation+and+Analysis/19827/ https://isc.sans.edu/forums/diary/XOR+DDOS+Mitigation+and+An... example (first Google result)
Tobu 11y ago
`PermitRootLogin = without-password` in /etc/ssh/sshd_config Same thing for non-root: `AuthenticationMethods = publickey` And when buying a router, buy something that will get regular security updates, or where you can put OpenWRT.
- bkor 11y ago
  From openssh 7.0 release notes: * PermitRootLogin=without-password/prohibit-password now bans all interactive authentication methods, allowing only public-key, hostbased and GSSAPI authentication (previously it permitted keyboard-interactive and password-less authentication if those were enabled). It mentions that previously without-password it would still allow keyboard-interactive logins. Should be fairly easy to fake for a botnet!
  - mirimir 11y ago
    I still prefer "PermitRootLogin=no".
- ATsch 11y ago
  However unrealistic it is, I still wish that open source Projects would agree on what to call things. The /etc/sudoers NOPASSWD and sshd without-password sound like the same thing, but are far from that. I feel like they could have named it better.
  - eikenberry 11y ago
    Sudoers NOPASSWD means you don't have to type the password for that feature. Sshd without-password means passwords are disabled. Not the same thing.
gingerlime 11y ago
As others mentioned, prevent password logins. I also recommend fail2ban[0] for completely blocking IPs after detecting repeat failed access attempts. [0] http://www.fail2ban.org/ http://www.fail2ban.org/
- IE6 11y ago
  Fail2Ban is great - I've used it for more than just blocking brute force attacks on ssh (although a real security expert might say this is the wrong tool to use).
  - gingerlime 11y ago
    Yep, I also use it to detect repeat errors on our own application logs and block offending IPs. Fail2ban has a reasonably easy to tweak detection and blocking rules, plus lots of available ready-made ones that do the job. If you're comfortable with regular expressions (which most people on HN probably are), then it's really straight-forward to write your own rules. The only problem I encountered with it is when you start it up and you have a huge amount of data in your log files. It can cause 100% cpu usage for a long time until it digests the whole thing...
upofadown 11y ago
If for some bizarre reason you allow remote root logins over ssh be sure that that password is as strong as possible. Machine generated random strings are good, at least 12 characters to be sure. If you turn off root logins but still allow user logins the remote attacking system will have no way to detect that fact and will still attempt to brute force you.
tedunangst 11y ago
http://bartblaze.blogspot.com/2015/09/notes-on-linuxxorddos.html http://bartblaze.blogspot.com/2015/09/notes-on-linuxxorddos....
skarap 11y ago
Use a good password.

https://www.stateoftheinternet.com/downloads/pdfs/2015-threat-advisory-xor-ddos-attacks-linux-botnet-malware-removal-ddos-mitigation-yara-snort.pdf https://www.stateoftheinternet.com/downloads/pdfs/2015-threa... Read Section 7.0

doguozkan 11y ago

I think monitoring your outgoing traffic would give you a clue. Also if what I read on Ars is correct, this botnet preys on weak root passwords, so disabling remote root or using keys would be great ways to protect yourself against this botnet.

mirimir 11y ago
This! And also, in sshd_config, disable password-based authentication. But first, make sure that key-based authentication works ;)

deleted 11y ago

[deleted]

digi_owl 11y ago
Makes one ponder the issue of monoculture...
- johnchristopher 11y ago
  Sorry, I tripped up.

johnchristopher 11y ago

I garbled my post :( Pull the plug /s Don't allow password-based SSH access. https://blogs.akamai.com/2015/09/xor-ddos-threat-advisory.html https://blogs.akamai.com/2015/09/xor-ddos-threat-advisory.ht... https://isc.sans.edu/forums/diary/XOR+DDOS+Mitigation+and+Analysis/19827/ https://isc.sans.edu/forums/diary/XOR+DDOS+Mitigation+and+An... example (first Google result)

Tobu 11y ago

`PermitRootLogin = without-password` in /etc/ssh/sshd_config Same thing for non-root: `AuthenticationMethods = publickey` And when buying a router, buy something that will get regular security updates, or where you can put OpenWRT.

bkor 11y ago
From openssh 7.0 release notes: * PermitRootLogin=without-password/prohibit-password now bans all interactive authentication methods, allowing only public-key, hostbased and GSSAPI authentication (previously it permitted keyboard-interactive and password-less authentication if those were enabled). It mentions that previously without-password it would still allow keyboard-interactive logins. Should be fairly easy to fake for a botnet!
- mirimir 11y ago
  I still prefer "PermitRootLogin=no".
ATsch 11y ago
However unrealistic it is, I still wish that open source Projects would agree on what to call things. The /etc/sudoers NOPASSWD and sshd without-password sound like the same thing, but are far from that. I feel like they could have named it better.
- eikenberry 11y ago
  Sudoers NOPASSWD means you don't have to type the password for that feature. Sshd without-password means passwords are disabled. Not the same thing.

gingerlime 11y ago

As others mentioned, prevent password logins. I also recommend fail2ban[0] for completely blocking IPs after detecting repeat failed access attempts. [0] http://www.fail2ban.org/ http://www.fail2ban.org/

IE6 11y ago
Fail2Ban is great - I've used it for more than just blocking brute force attacks on ssh (although a real security expert might say this is the wrong tool to use).
- gingerlime 11y ago
  Yep, I also use it to detect repeat errors on our own application logs and block offending IPs. Fail2ban has a reasonably easy to tweak detection and blocking rules, plus lots of available ready-made ones that do the job. If you're comfortable with regular expressions (which most people on HN probably are), then it's really straight-forward to write your own rules. The only problem I encountered with it is when you start it up and you have a huge amount of data in your log files. It can cause 100% cpu usage for a long time until it digests the whole thing...

upofadown 11y ago

If for some bizarre reason you allow remote root logins over ssh be sure that that password is as strong as possible. Machine generated random strings are good, at least 12 characters to be sure. If you turn off root logins but still allow user logins the remote attacking system will have no way to detect that fact and will still attempt to brute force you.

tedunangst 11y ago

http://bartblaze.blogspot.com/2015/09/notes-on-linuxxorddos.html http://bartblaze.blogspot.com/2015/09/notes-on-linuxxorddos....

skarap 11y ago

Use a good password.