14 ms·
AS13335 doing SSH scanning
- cuu508 5y agoIn case Cloudflare monitors the keyword "Cloudflare" in HN comments, I'll mention it here – Cloudflare.
- evgen 5y agoCloudflare is all over HN and their CTO, jgrahamc, will frequently appear to answer questions. California is just waking up so I expect a few ho it a before we get some solid answers to this issue.
- jimsi 5y agoPreviously this post was named in such way, but post get flagged... So I removed its mentioning and replaced with ASN
- johnklos 5y agoI'm beginning to suspect that in addition to Cloudflare fanbois who'll downvote anything that paints Cloudflare in a bad light, Cloudflare may even have bots of their own. There're just too many downvoters to be explained by simple fanbois. I get that some companies have fans, and I get that some of those fans become fanbois - fans regardless of the truth, with a ridiculous us-versus-them mentality. But I seriously doubt there are enough to explain what we see here on HN. It'd be nice if Cloudflare weren't such assholes. They refuse to answer questions directly, they intentionally use form responses to be vague and uncommunicative when it suits them, and they clearly don't care about doing the right thing. They COULD be a much better company if they just communicated without being smug assholes. Even a straightforward answer that isn't what we want to hear, like, "These are our VPN endpoints, and we have no plans to do anything about VPN customers who are attempting to brute force ssh." would still make it easy for us to respect Cloudflare. Instead, they facilitate abuse, ignore abuse complaints, and refuse to communicate, which, at least in my opinion, makes them assholes.
- vadfa 5y agoCloudflare has a VPN product, WARP. It's possible that they are clients of theirs doing the scanning. In any case I wouldn't think much of it. If you obsess over any garbage traffic you get you will go insane.
- jimsi 5y agoMaybe that's a case, but their abuse team hasn't replied anything in a 2 weeks about that after I gave them all timestamps and both source/destination IP addresses
- vadfa 5y agoThey won't disconnect clients over SSH scanning. That's a ridiculous expectation. It's 2021. Nobody cares.
- brohee 5y agoWhat kind of answer would you expect, in all seriousness? The thing you are reporting is not illegal or even dodgy.
- jimsi 5y agoI expect to hear who (and why) generates that kind of traffic from cloudflare owned subnets.
- tux3 5y agoI can understand your frustration with background internet noise, but please note Cloudflare is not known for broadcasting their customers' names to the first abuse report with a pcap of a TCP handshake. There may be more realistic ways to go about protecting people's SSH servers that trying to dox Cloudflare VPN users.
- Hrundi 5y agoWho's trying to dox those users?
- jrockway 5y agoThis is probably Cloudflare Workers? I don't think that demanding that every ISP inspect and censor outgoing packets is ever going to work. Every network operator has their own definition of good and bad, and it's probably up to that operator to enforce it themselves. Regarding SSH, you can basically assume that 4.2 billion IPs will concurrently try every password database that exists against your server 24/7. Passwords are a failed experiment. People can't remember them, and attackers can easily guess them. The solution is: don't accept password logins, and ban particular IPs after a certain number of failed attempts. (You should do the same for any unauthenticated resource -- if someone gets 1000 pages from your website in a second, you should probably cut off access to them for a while. Some script has gone awry, and it's costing you money, not the author of the script.) The topics that HN discusses can show you the breadth of opinions on this issue. One day it's "I hate cloud provider X for blocking my abusive service" with 3000 comments agreeing. The next day it's "I hate cloud provider Y for not blocking someone's abusive service" with a different 3000 commeters agreeing. No consensus will ever be reached, and there is no Internet police force you can bully into agreeing with you. I would just take precautions and move on, rather than appealing to a mob or administrative body for some meaningless justice.
- jimsi 5y agoProbably yes, but hey! Why do Cloudflare Worker would need SSH connection establishment? I do not asking Cloudflare to block 22/tcp entirely, but all this situation is very odd - I am seeing anomaly, reported abuse to them, but no explanation why this is happening. About password authentication I totally agreeing with you, but this is a bit out of scope of this thread. The only purpose of this article is to know the truth what is really happening. I have never seen such many connections to the SSH even from researchers.
- dapids 5y agoI think you need to spend more time looking at logs and network traffic in general, this is standard. I bet your public home IP will be scanned at least a couple times just today.
- brohee 5y agoWhat is the issue exactly? Is there any kind of exploitation attempts or is someone fishing for banners to do statistics upon? The second case is research, and legitimate...
- jimsi 5y agoI have asked Cloudflare about this traffic, but support says "Cloudflare helps protect sites, and accelerate them. We do not attack sites, and our network can't be used to generate attack traffic." They deny any malicious outgoing traffic, but after I have provided pcap dump they just ignoring me and do not reply anything. Very odd behaviour for researchers.
- r1ch 5y agoCloudflare likes to use the "We're just a proxy" defense when it suits them, but with the rapid release of other products they are very capable of generating arbitrary traffic and hosting content without an origin.
- Bluecobra 5y ago> What is the issue exactly? The OP has too much time on their hands. :) You can play this whack-a-mole game indefinitely. If you have SSH open to the Internet, expect that others will try to connect 24/7.
- _moof 5y agoJust curious/not furious: is there a convincing argument for why one should enable this particular kind of research at the cost of potentially diminished security? I recognize that this question relies on an assumption that is itself arguable, and that it might vary with context. (Aside: I really wish English had a better way to distinguish between an earnest question and a rhetorical challenge.)
- sammy2244 5y agoCloudflare warp is essentially a free vpn, this is going to happen. Iirc they use completely separate subnets for this so you can filter it/block it. Ip starts with 8. Something
- sm_javaarchive 5y agoYep, if the site you're accessing is not on the cloudflare network, they'll see an ip starting with 8.
- benjojo12 5y agoTo the best of my knowledge, the IP blocks in the 8.0.0.0/8 range announced by cloudflare are their VPN exit blocks. I had similar issues with them in the past spewing weird traffic. Didn't really ever reach a conclusion on it, other than just reducing logging for that error condition a scanner was triggering.
- jimsi 5y agoHow did you discover this? Anyway thanks for additional information
- benjojo12 5y agovia support ticket with cloudflare. They didn't explicitly confirm it, but my experience is that they would have corrected me if that was wrong :)
- joshenders 5y agojimsi, employees are also extremely active on Twitter. It’s not the most scalable but that’s usually my goto for eyebrow raising Cf related questions.
- aaron42net 5y agoEnabling Warp via the "1.1.1.1" Android app gets me an 8.x.x.x VPN address, at least. This /24 appears to be routed to my city's Cloudflare node, so presumably there's a /24 per city they run this service in. Running a quick port scan from my phone against one of my machines works, so it doesn't look like they are restricting this too heavily. And I'm not logged into this app and haven't granted it additional permissions, so I'm not sure they have any idea who I am here.
- zinekeller 5y agoUpdate: they apparently also have a paid product called "Cloudflare for Teams", which also uses the same infrastructure and are targeted for companies. Probably the reason they don't block out SSH is that companies do want SSH access - but I'm pretty sure that RDP access would be higher on the list. My friend working in an ISP has cleared the mystery for me - it's Cloudflare's Warp product (a semi-VPN (in the "teleport to other countries" sense, not the original definition)), which can be used for free, and I'm not shocked that it is being abused. Cloudflare has also categorically denied that their Worker product allows SSH connections - it is simply not designed for that, apparently. So I don't know how to respond to this specifically except that I didn't know Cloudflare offers a VPN (apparently a limited knocked-down one though) and I'm pretty sure that other people in other ASes scan the default SSH port - in fact, I see more and more scans from ASes of cloud providers than residential ASes, whereas five years ago I mainly saw Chinese and Brazilian residential ISPs. This is why I often move the SSH port - it's not that it improves my security posture, just so that the noise in the logs are minimised.
- kentonv 5y ago> Cloudflare has also categorically denied that their Worker product allows SSH connections - it is simply not designed for that, apparently. Hi, I'm the tech lead of Workers, so I'll clarify. At present, Workers can only generate HTTP traffic, because the only API we've given Workers for network communications is `fetch()`, which is HTTP-specific. This similar to how in-browser JavaScript today cannot open arbitrary TCP connections, because there's no API for it. It's likely we'll add an API for arbitrary TCP eventually, but at the moment it's not possible that this traffic comes from Workers. (As far as where it did come from, I don't have any internal knowledge, but WARP traffic (that's our VPN-like service) seems like an obvious explanation to me.)
- tyingq 5y agoHis dump of packets shows an MSS of 1380 versus the more common default 1460, which sounds like it's coming from something with tunneled traffic. MSS 1380 would correspond to a source MTU of 1420, which is a typical default for a GRE tunnel in IPv4sec Tunnel mode. Pretty sure that's what WARP is.
- sowhatw 5y agoWhy do you think this matters in any way whatsoever? Ports are there to be connected to. I don't see the problem.
- gtirloni 5y agoIs SSH scanning considered "abuse" now?
- chmike 5y agoSome ssh scanning is obviously abuse. Is it hard to make the difference ?
- nickdothutton 5y agoPort scanning was always considered abuse until researchers decided they needed additional blog post material. I worked for a “business ISP” in the early 90s and we had no qualms kicking someone off the network for it, although usually the originator of the scan had themselves been compromised… because… as I say it was considered at least a breach of terms of service.
- tptacek 5y agoI ran engineering for what was at the time the most popular ISP in Chicago from 1995-1997 (the company later sold to RCN) and port scanning has never been considered abuse, though there have always been people who wished it was and loudly proclaimed it so.
- annoyingnoob 5y agoI'd say that port scanning is attack prep. When you port scan me I take an adversarial stance. Certainly volume plays a role in determining whether scanning is abusive or not. There are differences between walking by and noticing a door, knocking on a door, trying a key in a door, trying to defeat the lock. Before you can break the lock you have to notice the door. I haven't met any friendly door knockers on the internet.
- tptacek 5y agoYes you have. Censys is a good example (you have assuredly met Censys, whether you know it or not.)
- LinuxBender 5y agoThis is not unique to Cloudflare, Level3 or any of the other networks I've seen mentioned in this thread. The entire internet scans all the common ports and this should be expected to continue indefinitely. If this is causing alerts from your logging, there are a few options: - Implement a firewall on your instances. - Implement port knocking for sshd. - Move sshd to a non standard port to avoid the nmap/bot noise. - Only log successful logins. - Any combination of the above. There are pros and cons to each item so you would have to decide which combination is the most appropriate and least friction for your organization. If leaving the port exposed consider enforcing key based authentication and disabling password authentication. For high risk accounts such as monitoring accounts that use passwordless unrestricted sudo, you can even restrict what networks the keys are valid from.
- vgb2k18 5y agoAdding: [-] whitelist allowed ip's for port 22. Requires static ip's client-side obviously [-] fail2ban if static ip's are not available.
- twodai 5y agoMy favorite is to implement a tarpit while moving the ssh port.
- themulticaster 5y agoDoes that mean that you automatically block IPs that try to login on port 22 (since they are obviously malicious/port scannners)? If yes, is there any specialized daemon for that or are you using firewall rules? Or are you running a SSH honeypot on port 22?
- ben_bai 5y agoA tarpit is a technique to waste your opponents time and network sockets. Usually by accepting the connection but only sending or receiving data at like 1byte/s.
- c0wb0yc0d3r 5y ago
- deleted 5y ago[deleted]
- deleted 5y ago[deleted]
- nickdothutton 5y agoJust use something like fail2ban to drop these at the packet filter level, either courtesy of your cloud provider or on the host itself. Make sure your sshd config is watertight.
- nousermane 5y agoAre there reputable places where people can share the IPs tripping fail2ban? Like spamhaus.org, but for scanners?
- cpach 5y agoHonest question: Why bother?
- loeg 5y agoYou know, or just don’t use fail2ban: https://research.securitum.com/fail2ban-remote-code-execution/ https://research.securitum.com/fail2ban-remote-code-executio... . It’s adding extra attack surface for a cosmetic benefit.
- tempodox 5y agoGood catch, thanks! Remedy: Don't let fail2ban send mail, or at least remove the whois part.
- megous 5y agonftables allows to automatize blocking of IP addresses (even with a automatic timeout) without any userspace involvement. Pretty nifty feature.
- kristianpaul 5y agoI run OSSEC that comes with automatic responses for common SSH authentication events
- cpach 5y agoAs others have pointed out, disabling password-based logins for sshd is a must. You can also go further if you like: Put the sshd service behind WireGuard (or spiped). Then malicious actors will never find your SSH ports.
- loloquwowndueo 5y agoJust install sshguard or some such and move on with your life. Or - block the entire IP range, and see who complains.
- giantrobot 5y agoSo...drop 8.0.0.0/8 traffic and move on? Port scans happen all the time, some are malicious and others not.
- ronsor 5y agoI don't think dropping traffic from roughly 1/200th of public IP space is a real solution.
- giantrobot 5y agoIsn't it? If you don't need to accept SSH traffic from that block you can just drop it.
- specto 5y agoYeah lots of baddies using workers. I blocked cloudflare a long time ago because of workers.