4 ms·

Is 3 hours a large time for an open server to be discovered? Do the attackers just have a giant list of ips that they constantly scan and can instantly know if

by pm90 5y ago

Is 3 hours a large time for an open server to be discovered? Do the attackers just have a giant list of ips that they constantly scan and can instantly know if it’s suddenly open to traffic?

Shank 5y ago
Check out masscan [0]. It’s extremely easy to scan IPv4 very rapidly and find targets in an automated fashion. It advertises scanning the internet in 5 minutes. [0]: https://github.com/robertdavidgraham/masscan https://github.com/robertdavidgraham/masscan
shakna 5y ago
ZMap claims to be able to scan the entire IPv4 space of the Internet in about 45mins. [0] There's no reason not to believe that claim, either. With many people doing this, it is kind of surprising that it took so long for a vulnerable server to be discovered. [0] https://zmap.io/ https://zmap.io/
gnyman 5y ago
Yes if you publish a known insecure service like mongodb, on the standard port, on a well known VPS provider you can expect it to be automatically compromised within hours if not minutes. As others commented, scanning the whole Internet is even not a problem so scanning a "limited" part where you are likely to see these services pop up is even less of a problem. I think the takeaway is that you cannot hide in the masses on the Internet anymore, 10-20 years ago you could throw up a insecure server and it could be fine for a long time. Nowadays you must assume someone will find and try to login to your service, even if you put it on a non-standard port. Also, if it's a HTTPS service take note they when you get a certificate you will be announcing that domain to the whole world and publish it to a searchable database (for example https://crt.sh/ https://crt.sh/ ).
- jd_mongodb 5y ago
  If you want to secure your on-premise MongoDB we publish a checklist here https://docs.mongodb.com/manual/administration/security-checklist/ https://docs.mongodb.com/manual/administration/security-chec... better still use MongoDB Atlas and get our best security practices baked in.
achillean 5y ago
It's possible to check every IP on the Internet nowadays so you don't need to keep a list. You can just brute-force check every IPv4 address in less than an hour. I've written on the subject a few times: https://blog.shodan.io/its-the-data-stupid/ https://blog.shodan.io/its-the-data-stupid/

by pm90 5y ago

Is 3 hours a large time for an open server to be discovered? Do the attackers just have a giant list of ips that they constantly scan and can instantly know if it’s suddenly open to traffic?

Shank 5y ago

Check out masscan [0]. It’s extremely easy to scan IPv4 very rapidly and find targets in an automated fashion. It advertises scanning the internet in 5 minutes. [0]: https://github.com/robertdavidgraham/masscan https://github.com/robertdavidgraham/masscan

shakna 5y ago

ZMap claims to be able to scan the entire IPv4 space of the Internet in about 45mins. [0] There's no reason not to believe that claim, either. With many people doing this, it is kind of surprising that it took so long for a vulnerable server to be discovered. [0] https://zmap.io/ https://zmap.io/

gnyman 5y ago

Yes if you publish a known insecure service like mongodb, on the standard port, on a well known VPS provider you can expect it to be automatically compromised within hours if not minutes. As others commented, scanning the whole Internet is even not a problem so scanning a "limited" part where you are likely to see these services pop up is even less of a problem. I think the takeaway is that you cannot hide in the masses on the Internet anymore, 10-20 years ago you could throw up a insecure server and it could be fine for a long time. Nowadays you must assume someone will find and try to login to your service, even if you put it on a non-standard port. Also, if it's a HTTPS service take note they when you get a certificate you will be announcing that domain to the whole world and publish it to a searchable database (for example https://crt.sh/ https://crt.sh/ ).

jd_mongodb 5y ago
If you want to secure your on-premise MongoDB we publish a checklist here https://docs.mongodb.com/manual/administration/security-checklist/ https://docs.mongodb.com/manual/administration/security-chec... better still use MongoDB Atlas and get our best security practices baked in.

achillean 5y ago

It's possible to check every IP on the Internet nowadays so you don't need to keep a list. You can just brute-force check every IPv4 address in less than an hour. I've written on the subject a few times: https://blog.shodan.io/its-the-data-stupid/ https://blog.shodan.io/its-the-data-stupid/