5 ms·
From the blog post: "While we aggressively rate-limit login attempts and passwords are stored properly, this incident has involved the use of nearly 40K unique
by pavs 13y ago
From the blog post:
"While we aggressively rate-limit login attempts and passwords are stored properly, this incident has involved the use of nearly 40K unique IP addresses. These addresses were used to slowly brute force weak passwords or passwords used on multiple sites. We are working on additional rate-limiting measures to address this. "
- Pxtl 13y agoI've seen this mentioned before - using a tremendous number of IP addresses across a tremendous number of sites and over a massive length of time to perform a very low-grade incessant brute-force attack. It means that any weak password anywhere is always vulnerable because everybody is always under low-grade brute force attack.
- ChuckMcM 13y agoThis is one of the more insidious scraping techniques. At Blekko if we see the same exact same query coming in from a bunch of different addresses, differing only by which page of the results they want we temporarily ban the entire lot of them. I'm sure a similar situation would work here, especially with a decent geoip database. If you get 3 - 5 failed attempts on an account separated by more than a few miles (and not along an interstate :-)) you can probably assume someone is using a botnet to try to break in.
- recuter 13y agoHow does IPV6 affect things?
- gnur 13y agoIt is probable that a single machine gets a /64 ipv6 range, but the first 64 bits are consistent. When ipv6 gets more common it will probably be more acceptable to block an entire /64 if you suspect a brute force attack.
- dredmorbius 13y agoAs with IPv4, DoS attacks which tend to be clustered from specific locations (I've seen them originating from multiple hosts within a hosting center's range, or from a particularly poorly managed ISP's allocation), using broader allocations (CIDR blocks and ASNs) to identify responsible networks can be useful. The challenge in general is translating from IP addresses to the administrative block responsible (there are IP reverse lookups which do this, in some cases the zonefiles are downloadable allowing lookups at local network speeds), and in translating the information to some sort of policy (few network management devices offer AS blocking rules, though CIDR is pretty much native).
- oelmekki 13y agoBruteforce techniques are indeed evolving. Before I switched my sshd ports a few weeks ago, I often saw break in attempts on my servers that would imply checking only a single username and a single password. My guess on that is that bruteforcers, rather than testing thousands of usernames with thousand of passwords on a single host will try a single username and single password on thousands of hosts.
- werid 13y agoyes, this have been going on for a while http://bsdly.blogspot.no/2013/10/the-hail-mary-cloud-and-lessons-learned.html http://bsdly.blogspot.no/2013/10/the-hail-mary-cloud-and-les...
- oelmekki 13y agoVery interesting article, thanks. I double checked my log archives, it seems not to be exactly the same, though. In what is reported here, a same username will be tried with several password, allowing something like a minute to pass to make a new attempt. In my logs, this is really just a single attempt. Other break in attempt may happen something like two days after, but with an other IP and username. It may just be yet an other evolution of the same botnet knowing its previous pattern has been spotted, though. (and in case you wonder, yes, I always have the nose in my logs, having a dedicated monitor for that :) )
- berlinbrown 13y agoSeems a bit excessive for a open source repo site.
- akent 13y agoPeople have private repos too you know.
- kazagistar 13y agoMany large companies use them as a SaaS dvcs provider for private, closed source repositories. They provide a great tool for an agile workflow at a good price, what more is there to say?
- jader201 13y agoObviously I have nothing to go on for this, but just guessing, it would seem to make sense that: - Of all users, only a small subset would have private repos - Of those users, only a small subset would have private repos that would be of interest to third parties - Of those users, only a small subset would have a weak enough password to allow brute force To reverse it, of these accounts that were hacked, I can't see many of them having private repos that would be of interest. And if so, then this would seem a bit excessive. I know that's a lot of ifs, but it seems reasonable. I would be interested to see the number of total accounts vs. the number of accounts w/ private repos.
- icambron 13y agoA couple of odd assumptions there: - That private repos are the only thing worth targeting. What if you could inject a trojan into a popular open source project? You could do a lot of damage that way, probably way more than on private repo, because so many people incorporate them in their products. Imagine they hacked the Rails repo, for example. Worse, some repos host binaries, for which a meddling would be harder to detect (a bad idea, but doesn't mean it doesn't happen). - That the users being attacked are random and not specifically targeted based on who the user is and what the work on. Not sure if that's the case or not, but I see no reason to assume it.
- ye 13y agoLooks like they didn't rate-limit per-user, but only per-IP. Now that is dumb. I expected more from GitHub.