4 ms·

I've analyzed the logs of failed login attempts to some SSH server of mine. The most common source AS'es are: - AS9808 China Mobile Comms, China - AS4837 Chin

I've analyzed the logs of failed login attempts to some SSH server of mine. The most common source AS'es are: - AS9808 China Mobile Comms, China - AS4837 China Unicom, China - AS132203 Tencent, China - AS211252 Delis LLC, US - AS209605 Host Baltic, Lithuania - AS4134 China Telecom, China - AS16276 OVH, France - AS134963 Alibaba, Singapore - AS45102 Alibaba, China "china bad" or not, i have hard data that most of this spam orginates from chinese or chinese-controlled ASes.

spaceman_2020 3y ago
Bet there is someone on Chinese HN commenting the same, but with the location set in America
- blueflow 3y ago
  Check answers to this thread later, i asked a friend from Peking and he will grab some logs during the weekend. Will post the new list of AS'es here.
Sophira 3y ago
Or is proxied through them.
- orbz 3y ago
  There’s pretty much no reason not to proxy through multiple international jurisdictions to avoid detection. Each hop raises the cost of investigation and delay by an order of magnitude.
  - 6D794163636F756 3y ago
    When I did itsec work we joked that the #1 indicator of an attack from Russia was a sudden dropoff of connections from Russia. I immediately assume that traffic origin has been spoofed
c00lio 3y ago
Same. 70% of SSH scanners we see is from some (red-)Chinese network. Distant seconds are Russia, Belarus, India. Sometimes, rarely, one sees some Western cloud provider or hoster, but there the activity is typically short-lived due to working abuse-handling. Sibling comment mentions proxying, which would be an explanation. But still, there is absolutely no working abuse handling on Chinese or Russian networks. Either they do not care or are complicit.
fidotron 3y ago
This means very little beyond those hosts being potentially compromised as well.
- Retric 3y ago
  Yes and no. In movies people talk about using proxies around the world, but network latency quickly gets terrible if you ever actually did this. It’s inconvenient enough to suggest most western hackers attacking western targets would choose something else if they had the option. Thus either China’s cyber security is terrible and or these attacks are coming from Asia.
  - Geezus_42 3y ago
    Isn't most of the malware these days mostly automated? If so, why would the attackers care about latency? All they have to do is wait for a ping.
    - Retric 3y ago
      Even for automated systems, latency lowers throughout when you’re mostly opening and closing lots of connections.
  - iavael 3y ago
    I thought that hacked machines usually used not as proxies for traffic from origin attack hosts but rather than large fleet of cheap throwaway attacking traffic origins themselves. There's a used to be fashionable definition "fog computing" for using computer resources like that. Except it criminals used this approach before definition emerged. And as an attacker you couldn't care less about latency when you schedule a job of scanning bunch of ip addresses for vulnerabilities to one of thousands throwaway hacked home pcs in your fleet.
    - Retric 3y ago
      High latency still makes those machines less efficient to both compromise and them use to scan a bunch of ip addresses. ie US hackers hacking Chinese machines to then hack US machines is really inefficient. Latency doesn’t prevent such things from working, but your better off hacking local resources and then using those resources to scan locally. So all things being equal either there’s a huge surplus of especially vulnerable Chinese machines or a surplus of Asian hackers. To be clear there could just be a huge surplus of easily hacked Chinese machines, but that itself would be noteworthy.
klntsky 3y ago
That's because you have a server in a western country. Would be surprised if the stats were the same for a server in China.
- c00lio 3y ago
  Nope. Overseas offices in those regions still get attacked from the same locations in "the East". There is only a small local component, e.g. because some local ISPs filter SMTP on external gateways, but not internally, e.g. in South America.
pera 3y ago
Yup same here. I actually wrote a script to visualize this like 10 years ago, had to cap China because the circle would have occupied all of Asia :P https://files.mastodon.social/media_attachments/files/022/479/340/original/d6c014f0694912b7.png https://files.mastodon.social/media_attachments/files/022/47...
marginalia_nu 3y ago
On the one hand, blocking Chinese and Russian IP addresses is and has for a long time been a very efficient way of drastically reducing intrusion attempts. Like it really works. It's not perfect though: Botnet activity isn't going to come from any particular ASN, but a wide array of unpatched smart fridges and compromised enterprise routers all over the world, so it doesn't crop up in this type of analysis.

spaceman_2020 3y ago

Bet there is someone on Chinese HN commenting the same, but with the location set in America

blueflow 3y ago
Check answers to this thread later, i asked a friend from Peking and he will grab some logs during the weekend. Will post the new list of AS'es here.

Sophira 3y ago

Or is proxied through them.

orbz 3y ago
There’s pretty much no reason not to proxy through multiple international jurisdictions to avoid detection. Each hop raises the cost of investigation and delay by an order of magnitude.
- 6D794163636F756 3y ago
  When I did itsec work we joked that the #1 indicator of an attack from Russia was a sudden dropoff of connections from Russia. I immediately assume that traffic origin has been spoofed

c00lio 3y ago

Same. 70% of SSH scanners we see is from some (red-)Chinese network. Distant seconds are Russia, Belarus, India. Sometimes, rarely, one sees some Western cloud provider or hoster, but there the activity is typically short-lived due to working abuse-handling. Sibling comment mentions proxying, which would be an explanation. But still, there is absolutely no working abuse handling on Chinese or Russian networks. Either they do not care or are complicit.

fidotron 3y ago

This means very little beyond those hosts being potentially compromised as well.

Retric 3y ago
Yes and no. In movies people talk about using proxies around the world, but network latency quickly gets terrible if you ever actually did this. It’s inconvenient enough to suggest most western hackers attacking western targets would choose something else if they had the option. Thus either China’s cyber security is terrible and or these attacks are coming from Asia.
- Geezus_42 3y ago
  Isn't most of the malware these days mostly automated? If so, why would the attackers care about latency? All they have to do is wait for a ping.
  - Retric 3y ago
    Even for automated systems, latency lowers throughout when you’re mostly opening and closing lots of connections.
- iavael 3y ago
  I thought that hacked machines usually used not as proxies for traffic from origin attack hosts but rather than large fleet of cheap throwaway attacking traffic origins themselves. There's a used to be fashionable definition "fog computing" for using computer resources like that. Except it criminals used this approach before definition emerged. And as an attacker you couldn't care less about latency when you schedule a job of scanning bunch of ip addresses for vulnerabilities to one of thousands throwaway hacked home pcs in your fleet.
  - Retric 3y ago
    High latency still makes those machines less efficient to both compromise and them use to scan a bunch of ip addresses. ie US hackers hacking Chinese machines to then hack US machines is really inefficient. Latency doesn’t prevent such things from working, but your better off hacking local resources and then using those resources to scan locally. So all things being equal either there’s a huge surplus of especially vulnerable Chinese machines or a surplus of Asian hackers. To be clear there could just be a huge surplus of easily hacked Chinese machines, but that itself would be noteworthy.

klntsky 3y ago

That's because you have a server in a western country. Would be surprised if the stats were the same for a server in China.

c00lio 3y ago
Nope. Overseas offices in those regions still get attacked from the same locations in "the East". There is only a small local component, e.g. because some local ISPs filter SMTP on external gateways, but not internally, e.g. in South America.

pera 3y ago

Yup same here. I actually wrote a script to visualize this like 10 years ago, had to cap China because the circle would have occupied all of Asia :P https://files.mastodon.social/media_attachments/files/022/479/340/original/d6c014f0694912b7.png https://files.mastodon.social/media_attachments/files/022/47...

marginalia_nu 3y ago

On the one hand, blocking Chinese and Russian IP addresses is and has for a long time been a very efficient way of drastically reducing intrusion attempts. Like it really works. It's not perfect though: Botnet activity isn't going to come from any particular ASN, but a wide array of unpatched smart fridges and compromised enterprise routers all over the world, so it doesn't crop up in this type of analysis.