8 ms·
Only 150,000 ? We see upwards of 2 million unique ipv4 sources scan us on port 23 every day. These are all compromised IoT devices and routers. In the past h
by justinsaccount 10y ago
Only 150,000 ?
We see upwards of 2 million unique ipv4 sources scan us on port 23 every day. These are all compromised IoT devices and routers.
In the past hour we saw 350k+ unique sources.
In just the past 3 minutes that number is 168,230
Top sources in the past 3 minutes:
848 211.201.69.50
840 180.66.99.72
838 222.121.157.61
759 95.17.97.136
639 171.248.123.112
542 189.78.49.194
511 176.109.222.124
386 60.249.84.179
378 118.161.69.18
377 61.75.42.129
252 125.142.55.218
252 183.102.221.85
245 106.186.20.183
233 112.162.191.217
203 121.143.65.181
199 115.86.134.94
190 89.163.242.12
183 91.205.123.37
181 86.90.10.151
179 91.240.140.14
177 191.103.72.251
173 185.129.2.236
169 218.201.74.122
168 116.99.113.72
164 82.119.65.190
160 118.129.105.9
158 194.88.205.101
156 77.88.202.60
156 82.79.75.5
155 112.165.227.205
We see 2000pps of this shit all day every day. No one cares.
- khc 10y agoIs there a database of this so people can check if their devices are compromised?
- justinsaccount 10y agoI could publish it somewhere.. The problem is people just don't care. I dumped the ASN owners for a bunch of sources, the top 3 are: 15664 BR TELEFNICA BRASIL S.A, BR 15215 VN VNPT-AS-VN VNPT Corp, VN 15112 CN CHINANET-BACKBONE No.31,Jin-rong Street, CN You think TELEFNICA BRASIL gives a shit that they have 15k+ compromised customers? I'd say if you can telnet to your wan IP and get a login prompt, you have a shitty router that exposes telnet to the world and you're probably compromised :-)
- ansible 10y agoYou think TELEFNICA BRASIL gives a shit that they have 15k+ compromised customers? Shouldn't they? It eats a lot of their outbound bandwidth. Even if they have peering agreements that they don't have to pay for, there's still the cost of the equipment and their internal network bandwidth to consider.
- rajangdavis 10y agoshodan.io
- skrowl 10y agoSome kind of IoT realtime block list like we have for spammers would be nice
- justinsaccount 10y agoIt's ultimately not very useful for that sort of thing.. 326,160 addresses in the past 38 minutes. What would you do with this information?
- VikingCoder 10y agoChrome, Firefox, IE, could all check your IP against that list, and inform you, "Looks like you have an unsecured device which is attacking the internet, and slowing down your connection. Here's a site that can help you fix the problem..."
- justinsaccount 10y agoI suppose, but that would require you to install the add-on that does that, or for it to be included by default.. both of which seem unlikely. Having google or facebook check REMOTE_ADDR for every client would work though, but most people wouldn't understand what the notification means. Plus, on a network that isn't using nat you'd never get the alert since the IoT device itself would never be REMOTE_ADDR.
- nacnud 10y agoTrue, but it still would be a step in the right direction for home users.
- bogomipz 10y agoCan you share what is the methodology you are using for determining the source IP is an IoT device? Are you just nmap'ing them and using OS/TCP finger printing? I had the same question for how OVH was determining that X amount were IPs cameras vs X amount were DVRs etc.
- justinsaccount 10y agoIt's just what they are. Routers and IoT devices exposed with telnet running and default credentials. It's probably mostly routers, but the botnet doesn't care. If they can connect to you, send root\nroot or admin\nadmin and get a shell, they will.
- sp332 10y agoHow do you tell the difference between a router and some device sitting behind the router?
- bogomipz 10y agoOK I see, so the router the IoT devices are in back of as well as the IoT device have both been compromised. And the owners of the botnet have made sure that these IoT devices have proper NAT/PAT mappings on these routers.
- justinsaccount 10y agoNo.. separate incidents. People often forward ports to IoT devices or stick them on public interfaces in the first place.
- pritambarhate 10y agoCan you please explain or provide a reference link to provide more explanation: >We see upwards of 2 million unique ipv4 sources scan us on port 23 every day. These are all compromised IoT devices and routers. What is the unique connection between port 23 and IoT devices? Genuinely Curious. Thanks.
- justinsaccount 10y agoShitty underpowered devices that ship with telnet enabled instead of ssh.
- Spare_account 10y agoOne of the observations I read in the aftermath of the Krebsonsecurity DDOS was that the vulnerable IOT devices often permit telnet (port 23 and non-encrypted) connections. A common approach to take over one of these devices starts with brute-forcing the login prompt. Once compromised and running malware, the device proceeds to probe random IP addresses for open telnet ports to spread further. The uptick in port 23 connection attempts has coincided with the perceived spread of IOT malware.
- api 10y agoI wonder if someone should grey hat this and scan and kill vulnerable hardware.
- justinsaccount 10y agoOnce one of these botnets finds a device with admin:admin credentials the first thing it can do is change the password.
- honkhonkpants 10y agoA lot of people including numerous EU regulators would think that posting such a list of IPs is very tacky. At Google I would be reprimanded and probably fired just for producing a list like this, or even writing a tool that was capable of producing a list of non-anonymized IPs of clients. Now that I got that out of my system: where's all the v6 traffic?
- justinsaccount 10y agoThose are not "clients". They are random hosts on the internet trying to compromise hosts on our network.
- honkhonkpants 10y agoEven a light bulb has inalienable rights in the EU, comrade.
- api 10y agoWe run a distributed network of PoPs in the cloud and get easily many times this, as well as massive ssh brute force attempts and other more bizarre forms of scan/attack. I sometimes look up the IPs and check them out and they are ancient cameras, routers, and things like Windows 2000 Server instances sitting on the Internet running malware.
- VikingCoder 10y agoSome idiot has been attacking me all month: 127.0.0.1 I keep counter-attacking him, but he's always one step ahead of me!