Slashdot Mirror
How Do You Handle Portscanning Attacks?
Kainaw asks: "I tried to submit this earlier, but I couldn't because I had no bandwidth available. The reason is simple: I use Comcast for cable Internet. My modem/router is portscanned constantly. Nothing makes it past the router, so everyone tells me that it isn't an issue. Well, it is when I can't access any webpages, get email, or even submit a simple article to Ask Slashdot because my entire bandwidth is eaten up by script kiddies with a new portscanner toy. This is a two-part question: First, can anything be done with a simple at-home modem/Linksys router/two computer setup to stop a portscanning attack? Second, is it possible for the Linksys router to become a 'bot' and actually be the originator of much of the traffic?"
I would suggest you contact Comcast. They might be able to help you out, especially if you think it's a problem on your end. I've never heard of a Linksys router being made into a bot, though.
On a side note, I've also go Comcast, and I've never run into anything like this. They do tend to have a lot of problems with their DNS servers, though.
"Extremism in the pursuit of liberty is no vice. Moderation in the pursuit of justice is no virtue." --Barry Goldwater
Sounds to me like you have bigger problems than the portscanning. Even hundreds of simultaneous port scans are unlikely to chew through all your bandwidth on a cable line. Sounds to me like your computer(s) may be zombied and *that's* what's eating up your bandwidth.
Got the IP addys of your tormentors?
Post them here!
I'm sure some of us could persuade these kids that port scanning is bad for your health...
^_^
____
~ |rip/\/\aster /\/\onkey
Mere portscanning doesn't intentionally clog all bandwidth.
IANA network security expert, but I'd say put a more capable firewall behind the router (read: a Linux or BSD box) and make it the DMZ.
At least you don't have some punk trying to find a weak username/password combo through SSH. (Silly script kiddie, you can't login to root through SSH on my box.)
It's basically a fact of life on the Internet that you'll get port scanned. If you have an IP, probes are bound to happen.
I'm sure someone could upload firmware to a router and set it up to port scan or other activity.
Comment removed based on user account deletion
Basicly, no. End users are the scum of the internet, no ISP really cares what happens to you as long as you pay the bill. If you don't, they don't care because others will.
Your best bet would be to detect the port scan (eg, >5 sequential connections from the same host, or >15 nonsequential ones) and nullroute it so they get no response at all.
Of course they can get around that, but if you're avoiding the common drones it doesnt matter.
Second off, its not an attack, its just trying to get more information on you. Calling it an attack makes it sound bad, which furthers scare away the masses(who then get to vote on this stuff). If your isp didnt limit your upstream so much you wouldn't even notice it. nmap running in standard mode doesnt use nearly as much packets or bandwidth as my isp flooding me with arp who-has packets to see whos on.
sidenote, be careful with whatever you do. Last time I found out a friend of mine ran a stupid windows firewall that would automaticly firewall anything that portscanned him, I spoofed a scan from his dns, then after I had fun watching him wonder why he couldnt resolve anything, I spoofed one from his gateway.
Automated dropping is dangerous.
Pain lasts, kid. Its how you know you're alive. Sometimes I think this growing up thing is just pain management-TheMaxx
One thing that I did was to disable ICMP echo reply. (I allowed it from IP ranges that I'm likely to be at, but in general, it's turned off.) That means if someone tries to ping me, they don't get a response, so many script kiddies will assume that there is no computer at my IP address and move on.
I've also set it up to drop incoming TCP requests for dead ports (actually, it blocks the outgoing connection refused packets). So if they scan ports that aren't open, they never get a single packet back.
Essentially, unless they're connecting to something I intentionally have open, they can't tell that my system exists.
And you don't allow access to it from un-trusted machines (i.e., the Internet), right?
Otherwise, in theory, it could get pwned. It is running Linux and tools such as busybox.
You are being MICROattacked, from various angles, in a SOFT manner.
You might also be the victim of a lame DoS attack. Participate in any flamewars recently? Send relevant portions of your incoming traffic logs to the respective ISPs for (in)action.
Another possible cause is one of the machines behind your firewall has been pwned and is now a spam zombie. Is your firewall blocking both incoming and outgoing?
Speak truth to power.
If your computer is connected to the internet through a Linksys/whatever router, how do you know you're being portscanned?
portscans use minimal bandwidth, enough that even a modem can be portscanned without a major slowdown. If you're getting enough traffic to shut down your network, but not enough that comcast would notice it, this so-callled "portscan" is likely not the cause of your problems.
Seen as none of the comments so far has answered your question, let me just offer my 2:
Rather than using a Broadband NAT router, set up a firewall running Linux, *BSD, or similar. This way, you can send "irrelevant" traffic (e.g. ICMP ping requests, or TCP/UDP packets to ports on which you do not provide services) to the bit bucket ("DROP" in the language of Linux IPTables).
This slows down port scanning of your machine (e.g. using "nmap") to near a grinding halt, and thereby reduces the bandwith consumed by such port scans to near zero.
It is not bulletproof - someone could still direct DoS attacks against you - but it would nearly eliminate the traffic caused by causal port scanning of your machine.
Funny story, in fact, they were scanning me and I didn't know who it was (all I had was an IP and very little knowledge about the internets) so I called them up and informed them that "such and such IP is attempting to haxor my boxor!" (well, not exactly like that...)
People have mentioned, like, ICMP auto-respond or sumthin, and that might have something to do with it, with one of the ports they scan. Are you breaching contract?
When you're afraid to download music illegally in your own home, then the terrorists have won!
It's a fallacy that ignorant kids are behind the port scanning.
It's spammers. It's professional organized crime. I believe the majority of these port scanning and worm/virus propagation is going on by organized groups looking to take over peoples' computers for the purpose of finding new IP space from which they can send unsolicited e-mail. If there are any script kiddies, they are a fraction of a fraction of the percentage of the traffic.
My systems are constantly under probe attacks and port scans. The majority of these attacks originate from rogue IP space in China, Korea, and other areas that appear to be more liberal in doing business with the spammer organized crime contingent.
At this point, I don't see technology making much difference. This is a political and enforcement issue.
My advice is to contact your local District Attorney and demand that they start prosecuting computer tampering cases. We know these people are ultimately in the U.S. and can be caught even if they route from around the globe. We know they're breaking laws and can be prosecuted. We have laws in effect right now - we don't need more laws. We need enforcement and government authorities who WILL ENFORCE THE LAW AND STOP THESE PEOPLE. You can't count on ISPs to help since they profit from bandwidth consumption; you can't count on corporations to help, they are scared of any attempt to curtail cyber marketing of any sort. You must start on a local level and demand that the judicial and enforcement branches go after these criminals.
Seriously, dump that Linksys or other SOHO box and spring for a small *nix-based machine. Personally, I use a slimmed-down Linux box running iptables. I also use the TARPIT target. The TARPIT target is designed to keep the connection open until it times out. This slows port scans and worms to a crawl. While it takes slightly more resources on the firewall machine itself, it doesn't eat up any more bandwidth than the port scan itself would, except that now the bandwidth is spread over a longer period of time. It also helps to block other packet types that can cause issues, such as ICMP echo. It is definitely not a good idea to block all ICMP traffic, though. Also, try setting up QoS or some other form of traffic shaping to give priority to your packets, specifically ACK packets, as this will improve responsiveness and will keep you from being locked out of your connection, even when under a high bandwidth load.
Apparently it's a zombie PC located at...
(let me jot down)
one two seven... dot zero... dot zero... dot one. There! Hit it guys.
If you have a fw inside a router, the router will send a "destination host unreachable" ICMP message in response to traffic to non-existant hosts.
A drop will generally indicate:
1) firewalling
2) an inverse map - "I didn't get the ICMP 'dest. host unreachable', ergo something is there"
blocking that outbound ICMP message is possibly a mistake if you have public net resources.
As others pointed out, a drop vs. the icmp error slows the scan down nicely, though.
I use online port scanning tools to check my home network. I don't know about your Linskys device but but some router/modem's allow you to configure a DMZ and to specify a private IP address you don't actually use. Basically, inbound portscans might see the DMZ but nothing else. Since the DMZ doesn't lead anywhere, your ports are stealthed and the scanner gets bored and tries elsewhere. This may not work on some Linskys router modems due to a software bug...
m l
i n/Linksys_routers_and_DDoS.html
Make sure that you disable inbound http and ftp. After all, why would you want to remotely configure your router/modem from outside your home network? ICMP echo requests should also be prohibited. If the hardware manual is not helpful, try searching for info on the web.
http://www.grc.com "Shields up"
http://scan.sygatetech.com/prestealthscan.ht
You may find this article of interest: http://techupdate.zdnet.com/techupdate/stories/ma
My hyperlinks aren't worth the paper they're printed on.
So the peak scan bandwidth of a really noisy nmap scan is about 100 kilobits per second, and you would have to have 23 simultaneous scans being performed in the absolute worse case scenario to max out your link. If your router's external interface was actually replying to these scans, you would notice problems at somewhere less than this, say, 20 simultaneous scans. The actual number of scans you could endure before noticing it is much, much higher than this, because I used -T5 to make nmap really noisy (not typical for k1ddi3s scanning), and I took the peak bandwidth instead of the average bandwidth for my calculations.
But I'm a Comcast customer and I don't see anywhere near that level of scanning. I see a few port scans a day, plus the usual worm remnants. Sometimes someone will get a bug up their ass and scan me repeatedly, but that's still just a few scans in a row. This is much, much lower than the 4 Mbit capacity of the throttled rx queue on my cable modem.
The other thing that makes scans an unlikely root cause of your connectivity problem is that Comcast's security department would certainly go after anyone who was scanning one of their customers that hard, and possibly install filters to keep from having to pay their transit suppliers for all that bandwidth.
The most likely explanation is that the problem is a simple misconfiguration, such as a misconfigured DNS setting or a P2P app running on your machine. The P2P apps in particular will cause intermittent problems loading web pages, which sounds like what you're experiencing.
-- thalakan
...is that I DO setup a Linux/BSD box as a firewall as lots have suggested, and I do something stupid and THAT box gets owned. Is/are there bulletproof packages, say like a knoppix (run from CD) distro, that is hardened by default and easy (not necessarily for a newbie, but not requiring a CCNE/CISSP/CCSE either)? It could perhaps keep it's config. on a locked floppy disk, or you could change the config. and burn that onto the CD.
If I recall my reading of the so-called CanSpam act, only ISPs can bring suits against spammers.
In your router settings see if you can manually set the MAC address that Comcast sees. Once you change it, reboot your cable modem and router. Comcast will issue you a new IP address. If someone is targetting your IP, then it will be problem solved. If the attacks don't stop then either your PC or your router is 0wned.
Don't confuse a portscan with a DOS attack. There is a difference, both in method and intent. Portscans are diagnostics or exploratory probes and are necessary for many benign purposes.
I have been a comcast customer for many years at several locations. Their service is unreliable; the internet is sometimes unreachable and like all the big-name ISPs they let worms that could easily be stopped run rampant in their network. Their DNS infrastructure is also well below par. Since they have a regional monopoly, it is not necessary for them to provide a clean feed, there simply is no competition in their market sector.
My comcast-connected systems are, like yours, portscanned constantly. So are my systems at work (where I have far less bandwidth in both directions) but I don't ever have connectivity problems on the non-comcast links.
Again, if it's really a portscan, it's not an attack. But let's say it's a DOS over multiple ports so it looks like a portscan... you can reverse-resolve the addresses, figure out Comcast's IP-to-physical location mapping (easier than it sounds) and go burn down those people's houses. Other than that, probably not. In theory, yes, absolutely. That's why you keep it up to date on patches and always change the default password. Here in the Real World [tm] you haven't supplied the type of router or patchlevel you are using so I can't go look it up on Google or astalavista. Some cable interface boxes are pretty secure due to hardware limitations, others make very good bots.
Finally... most people on comcast that have major problems are infected with viruses or worms, usually propagated by email. Those that are not are sometimes suffering from bad grounds - check that your cable system and the electrical outlets that feed your computer and televison systems are all properly grounded.
HTH, I'm off to dinner.
Never used it, just aware of it. Something like this?
Use it to block all ports and keep connection states.
See in a portscan, they send a SYN, and you send back an ACK... and back and forth. They try to connect to a port, your tcpip stack replies with a drop connection and the increment the port and repeat. The amount of data going in each direction is roughly equal when the ports are closed.
The amount of bandwidth you have is not symmetrical. The best ADSL can do is 4/.8 mbps for download/upload, and the best a docsis modem can do is similar. It is more likely that your upload bandwidth is chocked, since 4mbps of download bandwidth is plenty of room. Unless you have a 'lite' internet speed which is rediculously slow.
So a packet filter simply doesnt take the packet. No replies, either TCP or ICMP. That also means they will give up trying to keep their bandwidth efficient, and start portscanning another IP that actually replies. And since TCPIP is several back and forth packets to connect, you'll save on some download bandwidth, and you'll save ALL of your precious upload bandwidth.
Its even better if you have NO ports open at all from the outside, like ssh or http or smtp. That way intruders cannot know at all if you exist, and its just a waste to portscan all 4 billion IPs, all their TCP and UDP ports rather than just the IPs which actually reply.
My favorite packetfilter is OpenBSD for obvious reasons, they clearly had the best packet filter until recently. Now the competition is close, since everyone seems to be copying them. I dont have much experience with iptables and it confuses me, but it has a much greater install base, and commercial companies to back it.
I've tried the WRT56GX Linksys (latest wireless) router, and havent been impressed with its firewall options. I wonder if I can grab a linksys and replace the firmware with a much simpler OpenBSD embedded system (is there an Openbsd for ARM?). For serious outfits, I'd use OpenBSD on a pentium III-ish with two good nics and low power consumption for stability.
"Give orange me give eat orange me eat orange give me eat orange give me you." -Nim Chimpsky
The mac/usb addy on the modem is the id that comcast uses to let you have internet service..ie, it is the ONLY one *they see* (if i'm not mistaken, they wouldn't care what you have beyond their modem/gateway (mac addy).
The Motorola Surfboard 5100 (one of the brands they suport/lease) DOESN'T have a firewall, just dhcp (if you want).
If you *change* your modem (or mac address), you have to tell them so they can make a note of it-- so you don't loose syncing w/ their network.
Then again, this might piss them off (asking them).. and they may just-say-no to the idea, especially if you are 'renting' their modem (gateway).
or were you talking about *spoofing* your own mac addy? :)
I will gladly loose all of life's battles.. in order to win the war..
Be very carefull changing your mac addresses.
Some cable companies use MAC address filtering as a way of stopping pirateing.
Write down your old mac address first. We got a new cable modem and they had to wait until there cisco guy got in before cox could get us back online once.
BTW: Don't things get routed by IP address once the cache (arp?) tables upstream get updated?
Turn off WIFI and check your bandwidth...
Chances are someone's pulling your bandwidth via WIFI or its creating some problem.
I haven't quite nailed it down yet but in the last few months both my personal network and a friend of mine's have been bogged down whenever the WiFi is turned on. I like to think I'm security savvy but I just started digging into it yesterday.
I'll reconfigure the netgear so it only accepts the MAC addresses I have but it's still quite annoying. I didn't broadcast the SSID and I used WEP/WPA but my surfing lags horribly whenever WiFi is turned on. Even in rural Idaho there be issues.
who'd thunk it?
Good luck!
"Don't fear death... fear not living..." -me
Whoa down there buckeroo. Bandwith is not the only resource at stake here. Depending on the vendor of the router upstream, a port scan will consume route cache entries that may make it very hard to open new outbound connections. I know of a major university with the wrong vendor that was routinely getting taken down by a handful people scanning their /16. Yes it was a poor router design in that version, but it was happening. Considering you only get maybe 64k route cache entries that is only 1 or 2 near simultaneous port scans of 1 port across a whole /16 or 1 or 2 scans on all ports on 1 ip address. It *is* possible for port scans to cause problems.
In theory, yes. But that just doesn't wash with this particular situation. *If* Comcast had that kind of problem it would affect many more than just this one user, and we'd no doubt have heard about it through the NOG grapevines by now.
Andrew
Gotta do a deep think on this topic.
Why attempt an ICMP echo reply in the FASTEST TIME possible? I have no interest in running the quickest server possible; I want to make my internet experience the most pleasant FOR ME.
Anyone have any method of delaying the ICMP echo reply by up to the maximum limit, plus 1K ms?
I think the right question is "how should I handle my bandwidth being eaten up?" and a lot of people have responded in a good manner. Verify the source, send logs. Additionally, cut down on promiscuous activity (IRC on some servers, or some channels), some multiplayer games, etc. Generally, if you're smart enough to be doing that kind of stuff, you recognize that it's promiscuous.
One of my favorite stories was how I dealt with port scanners in college in 1996. I had an unswitched 10baseT in my dorms. Password sniffers and hackers were everywhere. I was getting constantly scanned. So, I set up an entry in init.d which launched a counter-offensive if someone went after my finger or name service ports. Everyone who knew me knew that I didn't run either service, so that left the ignorant masses with less than honorable intentions. I'd picked out some effective attacks, mostly against Windows machines. The scans slowed down a great deal after I put in my countermeasures.
When I got to grad school, I moved into an apartment with a cable modem (one of the first markets in the US). Without thinking, I left my countermeasures up. Our sysadmin ran some automated portscans to verify that his customers weren't running open mail relays, IRC servers or name servers (upload hungry services). One day, the cable modem lost its signal. My system logs showed three port scan attempts. Each of them stopped after the first countermeasure enabled port was hit, and after the third countermeasure we lost our cable modem. I had to discuss the situation with the admin before being allowed to use the cable modem again. He was irked, but audibly amused.
So I simplified my countermeasure to just respond to every finger attempt with a finger against the opponent. Shortly after that, I learned our admin was paged every time his scanner computer was fingered...
Jun 12 00:29:55 homeplate sshd[40051]: refused connect from 211.147.228.74 (211.147.228.74)
Jun 12 06:58:33 homeplate sshd[40674]: refused connect from ie55129.ie.nthu.edu.tw (140.114.55.129)
Jun 12 07:02:35 homeplate sshd[40683]: refused connect from ie55129.ie.nthu.edu.tw (140.114.55.129)
Jun 12 11:47:50 homeplate sshd[40937]: refused connect from 202.76.92.199 (202.76.92.199)
Jun 12 17:44:07 homeplate sshd[5028]: refused connect from ie55129.ie.nthu.edu.tw (140.114.55.129)
Jun 12 17:48:09 homeplate sshd[5033]: refused connect from ie55129.ie.nthu.edu.tw (140.114.55.129)
Jun 12 23:22:06 homeplate sshd[5802]: refused connect from 142.179.212.215 (142.179.212.215)
Jun 12 23:26:12 homeplate sshd[5897]: refused connect from 142.179.212.215 (142.179.212.215)
Jun 13 05:35:45 homeplate sshd[7342]: refused connect from 202.96.245.204 (202.96.245.204)
Jun 14 04:29:21 homeplate sshd[12730]: refused connect from 218.1.14.68 (218.1.14.68)
Jun 14 04:33:22 homeplate sshd[12737]: refused connect from 218.1.14.68 (218.1.14.68)
Jun 14 05:09:16 homeplate sshd[13038]: refused connect from 211.239.129.105 (211.239.129.105)
Jun 14 05:13:22 homeplate sshd[13051]: refused connect from 211.239.129.105 (211.239.129.105)
Jun 14 05:53:05 homeplate sshd[13252]: refused connect from 211.239.129.105 (211.239.129.105)
Jun 14 05:57:13 homeplate sshd[13256]: refused connect from 211.239.129.105 (211.239.129.105)
Jun 14 06:08:17 homeplate sshd[13306]: refused connect from ds80-237-208-42.dedicated.hosteurope.de (80.237.208.42)
Jun 14 06:12:08 homeplate sshd[13310]: refused connect from ds80-237-208-42.dedicated.hosteurope.de (80.237.208.42)
Jun 14 23:23:34 homeplate sshd[16596]: refused connect from 221.0.193.166 (221.0.193.166)
Jun 14 23:27:38 homeplate sshd[16600]: refused connect from 221.0.193.166 (221.0.193.166)
Jun 15 00:33:38 homeplate sshd[17055]: refused connect from 202.76.92.199 (202.76.92.199)
Jun 15 05:21:53 homeplate sshd[20383]: refused connect from 221.147.5.146 (221.147.5.146)
Jun 15 05:53:49 homeplate sshd[20620]: refused connect from 202.76.92.199 (202.76.92.199)
Jun 15 20:51:41 homeplate sshd[23316]: refused connect from 69.44.57.85 (69.44.57.85)
Jun 15 20:55:40 homeplate sshd[23322]: refused connect from 69.44.57.85 (69.44.57.85)
Jun 16 10:11:46 homeplate sshd[26993]: refused connect from massive.merukuru.org (58.4.29.84)
Jun 16 16:16:02 homeplate sshd[28145]: refused connect from 222.106.22.167 (222.106.22.167)
Go get 'em!
So if you want to run a server on the sly, just observe which IPs the ISP uses to scan. Then drop connections from those IPs or that block.
I just host on a different port and use a full web redirect from no-ip.com.
http://sf.net/projects/sentrytools/
I wrote my own, but I lost it in a disk crash. Basically, it listened on N random ports, and added a firewall rule to drop packets from the host that connected. After however many seconds you told it, it'd remove it (assuming you didn't tell it to just leave the rule). It's not hard to write, though.
Incidentally, I agree with some of the other posters; I doubt it's just portscans doing this.
Really.
Contrary to the popular belief, there indeed is no God.
Had very similar and it was issue with ISP hardware. I'm at the end of a loop and the repeater serving the loop had a slight crack - allowing moisture inside - which effectively dropped my 6Mbit to 50Kbit - every morning if dew - every rainstorm. Took me 2 1/2 months to figure it out and talk ISP into doing proper tests and finally into fixing it.
Been cool for 2 years - wow, what a difference.
Lost in space at an early age. Survived the vacuum. Now rebuilding castle in air.
Just negating an erroneous moderation. Sorry folks.
NetInfo connection failed for server 127.0.0.1/local
One way of dealing with that problem is to block China and Korea altogether. All the l33+ h4x0r5 who try to password guess on my ssh daemons come from educational institutions in Korea. Block them at the border router, problem goes away!
I find your ideas intriguing and I wish to subscribe to your newsletter.