7 ms·
So funny story, for a while I worked on a 'reverse' exploit. Which is to say morphing the response from ssh to the client with large malformed packets. The idea
by ChuckMcM 3y ago
So funny story, for a while I worked on a 'reverse' exploit. Which is to say morphing the response from ssh to the client with large malformed packets. The idea was to crash the client making the request. In my case I found these attacks would have like 6 to 10 attempts from the same source address. By time stamping the requests, I could evaluate if the next attack from the same address came more quickly or more slowly. I then had my server "morph" the return payload somewhat randomly and keep the three responses that caused the most slowdown. When I got to 100 variants that had "won" this selection criteria I took the three best and started over from there. After a couple of months of this I finally got a response where after one request I would not get a second.
I felt extremely pleased with myself for about another month, and then my server address got hit with a massive DDOS attack (for me anyway) over my 6MBPS DSL line. So clearly I had hit a nerve somewhere :-). Anyway, I moved my server to a different address and used fail2ban to just note source IPs and put them into the IP tables as banned addresses. That works great and hasn't resulted in the same sort of drama as last time.
- fireant 3y agoWow that's a cool evolutionary algorithm in practice! I'm actually surprised it worked, especially with the amount of fuzzing I'd expect ssh ecosystem to receive (well perhaps the servers do, but not the clients haha).
- quickthrower2 3y agoDistributed valgrind
- sneak 3y agoDisable password authentication and fail2ban becomes completely unnecessary.
- nico 3y agoYou still get the attacks and they show in the logs Also, it’s not just ssh, there are brute force attacks for pretty much any service that you run Our logs show automated attempts to run exploits on our web servers everyday
- BrandoElFollito 3y agoThis. I really do not understand why people use fail2ban when the threat is somewhere else. It won't stop a ddos but will certainly, at some point, prevent you from logging in.
- thelopa 3y agoI disable password authentication and use fail2ban. It's unlikely they will be able to brute force my key, but no server is perfect. sshd might be compromised one day. I’d rather have an extra layer of defense just in case.
- wkat4242 3y agoIt's impossible they will brute force your key if you have a decent length. While I'm sure it is possible for some (mainly government) actors to brute force keys, I'm also sure these do not include the same low-hanging-fruit vandals blasting brute force attacks. And I'm also pretty sure you're not one of the select targets of these highly advanced actors. A vulnerability in sshd is indeed possible and happens once in a while. Fail2Ban won't stop this though because a known exploit will let them through on the first attempt. I personally view fail2ban more as nuisance control when it comes to SSH with password auth disabled. Minimizing the log crap, the wasted CPU resources by the failed handshakes. It's not really a security protection in that scenario. In other cases (e.g. web logins where passwords must be used) it of course is.
- sophacles 3y agoUnless the maintainer of your distro's ssh package accidentally introduces an error that reduces the number of possible keys to, say - 32,767 total possible keys.[1] That's a brute-forcible number of keys that fail2ban would help mitigate. (1: https://research.swtch.com/openssl https://research.swtch.com/openssl)
- rerdavies 3y agoOr the NSA subverts a cryptographic standard in order to produce predictable seeds for cryptographic random-number generators that are used to produce private keys. [1] (1: https://www.bbc.com/news/technology-24048343 https://www.bbc.com/news/technology-24048343 )
- deleted 3y ago[deleted]
- XorNot 3y agoI prefer libshield but one thing I've found is that annoyingly sshd didn't use PAM to check if the login user is valid apparently (so it never fires when only using keys).
- wkat4242 3y agoNot really. A lot of these bots are super duper dumb and continue slamming your server with handshake attempts even if password auth isn't even turned on. Every handshake is wasted CPU resources (and asymmetric crypto isn't cheap). It also makes it harder to see real dangers in the logs.
- scrps 3y agoAnd/or run sshd exposed only to a wireguard or tailscale interface.
- seized 3y agoNot for other services... I have fail2ban parsing my NVR logs. Wrong password three times and it permanently blocks the IP on my Opnsense firewall.
- nvarsj 3y agoAnd change the sshd port. I use my birth year. 0 brute force attempts in the logs after that.
- mike_hock 3y agoYou still got the response packets?
- DougMerritt 3y agoNice. Also an illustration that its good to establish one's inner motive first, like here might range from a desire for simple solutions, to another dimension of drama, which might indeed be desirable sometimes, for entertainment or for snapshots to use in a book one is writing. :)
- daniel-cussen 3y ago[dead]
- lgats 3y agoAnother fun one is sending a redirect to a gzip bomb or extremely large file (i.e. speedtest download file) for when certain non-existant URLs are requested, i.e. /wp-login.php on a non-wordpress site.
- KomoD 3y agoEarlier this month I was downloading top 1 million websites' robots.txt and some guy just served 100mb of whitespace :/
- pnpnp 3y agoI love it!
- hayley-patton 3y agoOnce I was trying to scrape from some internal API, and made a request that used parameters the real client wouldn't make. I didn't expect curl to scream "FUCK YOU <some name>" at me. Presumably the name belonged to someone who scraped it before.
- KomoD 3y agoLOL, that is great.
- gitgud 3y agoIs it legal to host a gzip bomb? Seems like a malicious file to serve up…
- bytesandbots 3y agoIt can cause your site to end up on Google's safe Browsing black list which can be a death sentence for a business. Google has automated process for identifying malware and black list such websites. Almost all browsers use this list to warn users. This is why it is also dangerous to host anonymous uploaded files even for a short time. https://news.ycombinator.com/item?id=25802366 https://news.ycombinator.com/item?id=25802366
- api 3y agoTry negotiating ssh compression and then sending terabytes of compressed zeroes. Might work for a badly implemented scanner.
- heyoni 3y agoDetails! Seriously this is both hilarious and intriguing and deserves a long form blog post or something.
- myself248 3y agoSeriously, this should be standard practice. Fail2evil...
- Jenda_ 3y agoMySQL has a weird feature, by default enabled in many clients, that the server can request a file from the client. I have requested /etc/shadow, cracked the hash for root password, and ssh'd back into the botnet node that was bruteforcing passwords. I then shared the information with the webhoster where the botnet was running and a local infamous antivirus company (Avast before it was leaked that they are evil) and got a t-shirt. https://www.abclinuxu.cz/blog/jenda/2019/2/exploiting-mysql-arbitrary-file-read-a-honeypot-that-kicks https://www.abclinuxu.cz/blog/jenda/2019/2/exploiting-mysql-...
- mdaniel 3y agoOutstanding job! My opinion of mysql continues to improve :-/ As a curiosity, I found the submission link in the comments on that thread https://news.ycombinator.com/item?id=19305823 https://news.ycombinator.com/item?id=19305823