3 ms·
> However, if the threat is "a botnet trying to abuse a new openSSH vulnerability", then changing the port does help. Because no bot takes the time to scan tens
by peterwwillis 6y ago
> However, if the threat is "a botnet trying to abuse a new openSSH vulnerability", then changing the port does help. Because no bot takes the time to scan tens of thousands of ports in that case when there are millions of other hosts around who listen on port 22.
It takes about 8 minutes to scan the whole internet for port 22. If there's an SSH 0day, and I have a botnet, I am going to make the entire botnet scan the entire internet on every port, because I know people move their SSH port. With 5,000 hosts, I can scan all 65,535 TCP ports across the entire internet in 104 minutes.
How fast can you patch your server after the 0day's been announced? What if you're asleep?
The time it takes to change the SSH port could also be used to harden the sshd config, which would eliminate several classes of previous exploits. A little more time and the entire system could be hardened, so that even if you are attacked, the attacker can't do much of anything.
- reincarnate0x14 6y agoHave you done much with IPv6 scanning? I know some researchers have set up public services like NTP servers to try and build a catalog of active addresses but with the privacy address extensions even that seems functionally infeasible to me. But most of the things I care about are on private networks these days so I haven't had much cause to seriously investigate.
- peterwwillis 6y agoI haven't; there are definitely some protocol scanning differences. But off the top of my head, you could try 1) do a reverse lookup on a v4 address and then query the name for a v6 address, 2) do DNS probing for a domain you're interested in, 3) try the v6-in-v4 mapping to find v6 addresses mapped to v4 addresses. If you could sit on a backbone and sniff DNS traffic or something, that'd be a nice sized cache of addresses.