The Slow Bruteforce Botnet(s) May Be Learning

badger.foo writes "We've seen stories about the slow bruteforcers — we've discussed it here — and based on the data, my colleague Egil Möller was the first to suggest that since we know the attempts are coordinated, it is not too far-fetched to assume that the controlling system measures the rates of success for each of the chosen targets and allocates resources accordingly. (The probes of my systems have slowed in the last month.) If Egil's assumption is right, we are seeing the bad guys adapting. And they're avoiding OpenBSD machines." For fans of raw data, here are all the log entries (3MB) that badger.foo has collected since noticing the slow bruteforce attacks.

Comments

Solution: Public Key Auth

[slifox]

The obvious solution is to use public/private key authentication and disallow password logins.

This is much safer anyways, since your private key and your passphrase stays on your local machine always, so even if the server is compromised and the SSHd is bugged, no one will have immediate access to your login token.

Re:Solution: Public Key Auth

[Hojima]

The other solution is to use asshole seeking missiles on the botnets. Of course it would probably end up leading astray from the pricks with the checklist that always responds to peoples' solutions to spam.

Re:Solution: Public Key Auth

[Anonymous Coward]

The other solution is to use asshole seeking missiles on the botnets

I didn't know bots had assholes. Well, besides Bender.

Re:Solution: Public Key Auth

[Anonymous Coward]

That wont work and Ill tell you why:

1)Those launching the missiles also have assholes.
2)Knives would be funner
3)Barney sucks
4)People like checklists

Re:Solution: Public Key Auth

[arbiter1]

Another idea, is change the port SSH uses to some a random high number, that will kill off most of them also.

Re:Solution: Public Key Auth

[corsec67]

So then brute force attacks would be preceded by an open port check?

Unless you use some kind of port knocking attempt, that wouldn't solve much of anything for long.

Re:Solution: Public Key Auth

[FugitiveMind]

Since changing my SSH ports to something really high (above 50000), I have had exactly *zero* failed password attempts in the last 14 months.

I know the plural of 'anecdote' is not 'data', but this is the case across *all* my servers.

Re:Solution: Public Key Auth

[nobodymk2]

That would stop small scale hackers but not people that want to use passwords instead of remembering hash files stored with text files on their flash drive... Think beyond desktop OS's now and think more toward people that leave their systems on. Is anyone really that stupid to leave there personal desktop on and run up their energy bill? Can a brute force attack work with sleeping computers? It's a slow brute force network because you're being attacked by sleeping computers (I've seen SQL servers go into Sleep Mode at places where I don't control IT, sadly) hence zombie invasion or more like sleep walking computers!

Re:Solution: Public Key Auth

[Chris Daniel]

The "slow" in "slow bruteforce" refers to the intervals between attempts. Attackers have made their attempts less frequent in order to evade some detection mechanisms.

Re:Solution: Public Key Auth

[Anonymous Coward]

1)Those launching the missiles also have assholes.

There is a solution to this: butt plug.

Re:Solution: Public Key Auth

[HeronBlademaster]

I didn't change my ssh port to something that high, but I changed it to something above 1024, and the botnet attacks have stopped, so you can add my anecdote to yours...

Re:Solution: Public Key Auth

[Sancho]

Unfortunately, this is often too hard for your users.

What's really scary is that I'm starting to see really good passwords coming through (I modified the OpenSSH source to log the password sent for one of my jails.) I'm seeing passwords that have no particular rhyme or reason (in other words, they're either random or are generated through an obfuscated scheme.) I have to assume that they're passwords which were harvested in some way. It really makes me wonder where they're getting them.

Re:Solution: Public Key Auth

[corsec67]

Since changing my SSH ports to something really high (above 50000), I have had exactly *zero* failed password attempts in the last 14 months.

That means that you haven't been attacked by a portscanning bot yet.
I don't know that any exist yet, so you would be safe until they do. Really, wouldn't any port other than 22 that isn't used for anything else bots attack work?

Re:Solution: Public Key Auth

[beav007]

Since changing my SSH ports to something really high (above 50000), I have had exactly *zero* failed password attempts in the last 14 months.

That means that you haven't been attacked by a portscanning bot yet.

That or they got the password right...

Re:Solution: Public Key Auth

[techno-vampire]

It really makes me wonder where they're getting them.

One way to get them is to set up some sort of site that logically requires you to log in, let it become popular, then harvest the password file and use it in your attacks. Be sure to make the site geeky, though, to get good passwords and give it an attention-getting name. Something like "Slashdot."

Re:Solution: Public Key Auth

[Anonymous Coward]

or thread and needle

Re:Solution: Public Key Auth

[FugitiveMind]

I use public key auth only. :P

Re:Solution: Public Key Auth

[FugitiveMind]

This wouldn't matter anyways, unless RSA has been broken, but I do see your point.

Re:Solution: Public Key Auth

[nobodymk2]

Correct, but look at all the attempts for "Root". I mean I would certainly call tech support if I couldn't log in under my user, but you are "missing the point entirely". I've never had a remote access protocol I didn't have another way around by physically shutting down the system before I saw it go caput. I've disabled the user called root and admin from accessing externally. It only works with internal loopback... dDoS attacks could affect actual DNS servers with sheer brute force or Spam. Destroying the Internet is a much less dangerous prospect than AI development. Someone is behind the scenes, but the Original Article, TFA as some people say, mentions nothing about AI development except smug analogs to robot takeover.

Re:Solution: Public Key Auth

[beav007]

Do you happen to use Debian by any chance? It may only take 4 or 5 tries...

;)

Re:Solution: Public Key Auth

[Anonymous Coward]

It's over 9000!!!

Re:Solution: Public Key Auth

[Dun Malg]

One way to get them is to set up some sort of site that logically requires you to log in, let it become popular, then harvest the password file and use it in your attacks. Be sure to make the site geeky, though, to get good passwords and give it an attention-getting name. Something like "Slashdot."

Snorf. Try that with my password and you gain access to only a really pitiful Cobalt Qube with my friend's baby picture web site on it. Or you could just log in using the name of the site as UID and PW.

But yeah, that'd work for a lot of other's systems, I bet.

Re:Solution: Public Key Auth

[Anonymous Coward]

Since changing my SSH ports to something really high (above 50000), the botnets guess my password correctly every time! I haven't seen any failed password attempts in months!!@#

Re:Solution: Public Key Auth

[ion.simon.c]

Are you saying that you configure your RAP servers to only allow access over loopback to root, or for all users?

Re:Solution: Public Key Auth

[ion.simon.c]

Unfortunately, this is often too hard for your users.

:(
We need to grow smarter users.

Re:Solution: Public Key Auth

[slughead]

Since changing my SSH ports to something really high (above 50000)

Because they were really going to portscan you anyway. I bet putting at 23 (as opposed to the default) would be almost as effective.

At a web message board I setup, I used some popular software and was getting a ton of spam bots. So I added a simple "are you a human" question--no captcha or anything, just another checkbox to check... Not 1 single piece of spam. Same principle: the bots aren't that smart--you avoid the norms even by a little, and you're okay.

Re:Solution: Public Key Auth

[FugitiveMind]

I do, but I generated new 8192 bit keys once that flaw was discovered. :|

Re:Solution: Public Key Auth

[supernova_hq]

Actually no. Most port scanners (read: almost all of them) only scan up to 1024. This is because that is where 99% of vulnerable machines open their ports. The only people that scan higher than that are the ones with a list of specific targets. If you are on that list, chances are you are going to see some incoming traffic no matter what you do.

Re:Solution: Public Key Auth

[chaim79]

Yah but two anecdote's don't make a parable... right?

Re:Solution: Public Key Auth

[supernova_hq]

look at all the attempts for "Root".

Well, that's why nobody got in. Every OS with a root account is also CaSe-SeNsItIvE!

Re:Solution: Public Key Auth

[nobodymk2]

I'm saying to make it less obvious to slow bots. I always worried about fast bots, but slow bots need to match USERNAME and PASSWORD. It's just too slow.

The issue would be brute brute force still works on servers that require logins.

The issue is solved with proper remote access control unless a proper SQL injection is done. SQL injections require better SQL database managers. I've never seen this affect real IT because there is no remote access in the real world unless you gain access to the routers of the building which are passive devices. Fast bot nets can target. But you seem to be missing the point entirely. The point is this doesn't meet the definition of AI since it has human influence. It has the definition of dumb AI. Dumb AI will only listen to programmers. The Federal government and/or CIA can get in on tracert routines, however, but not simple harassment issues. Local authorities may be significantly advantaged by the idea of entrapment, however.

Re:Solution: Public Key Auth

[nobodymk2]

Haha, finally someone figured out the point I'm trying to make. Mod parent up...er...well This is a tree so who's the parent of a n-tree when there is no root except for the ROOT? Slow bots aren't "adapting and evolving" they don't meet the definition of AI. AI has to self-evolve, otherwise its dumb AI /simulated AI / human-controlled AI. No robot wars as long as the international/federal/local government(s) can pull the plug on a computer so it would seem. Good thing Nixon isn't president though, like in the IT security futurama episode that created a time paradox.

Re:Solution: Public Key Auth

[snikulin]

Well, add my 3-d point. The same story here: port > 1024 == no attacks. Parable!

Re:Solution: Public Key Auth

[Anonymous Coward]

"I've got pink bazookas, I'm such a nut,
I've got AK-47s up the butt,
I've got asshole seeking missilesmounted underframe,
makes meatloaves outta weenies who are really lame!"
- The Meatmen, Come on over to Mah Crib

Your post was either the coolest linguistic coincidence ever, or I'm not the only /.er who remembers the glory of the Meatmen.

Re:Solution: Public Key Auth

[Moridineas]

Well, a counter story...

I run a website for a small company. It does around $50k in ecommerce sales a year, so not a huge volume site by any means. I had a custom written contact form so that the staff directory page didn't have employee emails listed in the HTML. About a year ago, a couple employees reported getting weird emails, that had jibberish subject lines and bodies. A day or so after that, the hosting provider (pair.com -- highly recommend) blocked access to that page, and alerted me that it had been compromised and had been sending junk mail to outside addresses. I fixed up the security hole (very stupid on my part...guilty of NIH too!) and added some additional tricks (used CSS to hide a textbox and a checkbox and if there is anything in them, disregard the submit, etc) and no problems since.

It was rather a wake up call to me that even this small website could become a hacking target.

Re:Solution: Public Key Auth

[johanatan]

Actually, I think the point is that these worms do port scans--just not exhaustive ones (as that would be infeasible).

Re:Solution: Public Key Auth

[Killjoy_NL]

But then we'll get the eugenics wars?

Re:Solution: Public Key Auth

[johanatan]

A port knocking scheme is exactly what should be implemented to combat this. It would not be very hard at all to make it completely automated on both the server and client sides (and the knock sequence could even be loosely based on the time--say to a precision of 15 minutes).

Re:Solution: Public Key Auth

[dasmoo]

This is much safer anyways, since your private key and your passphrase stays on your local machine.

Until your laptop is stolen. Then they have access to all your machines. Laptops + private key auth != security.

Re:Solution: Public Key Auth

[Heembo]

The moment you have a system that even has the capacity to log passwords, you have a security anti-pattern. Passwords are to be stored as per-user salted sha-2 hashes and should never be logged.

Re:Solution: Public Key Auth

[ion.simon.c]

You seem to be a chatbot. I'm not sure how you got onto slashdot, but welcome!

Re:Solution: Public Key Auth

[beav007]

We need to grow smarter users.

Actually, we can use the differences to out advantage. Whoever is smart enough to fill the forms out correctly obviously isn't human, and therefore should be blocked.

The issue here is that websites might decide they prefer the intelligent discussion that you get from bots to the discussion you get from real users.

Option #1:
<bot1> Grow your penix! Make the ladies swoon!
<bot2> Genuine fake Rolexes, at discount prices!
<bot3> Good day to you my frend. I relise this message may come a sa surprise too you, but I am in true, a prince of a small provence of Nigeria...

Option #2:
<4chan user1> Check out this pic! So ugly!
<4chan user2> I bet you hit that every night! Get some man-love!
<4chan user3> Dude, that's his mom. So you're probably right...
<4chan user2> *goatse pic*

Re:Solution: Public Key Auth

[ion.simon.c]

WAT?

Why do we need to kill the dumb ones? Who would be left to serve us fried foods?

Re:Solution: Public Key Auth

[Sancho]

That's absurd. The system is a honeypot. It cannot be accessed directly--you must log in to the host system to do gain access. No accounts are allowed through SSH to the jailed host, but passwords are logged for the sole purpose of gathering information on the botnet. The jail has no users other than root, and root is not permitted to log in through SSH. Hell, strictly speaking, root isn't allowed to log in at all--the jail mechanism doesn't count as a login.

It's about as secure as you can make a system which listens on TCP ports.

Re:Solution: Public Key Auth

[nobodymk2]

It's the caffeine. They need to stop giving me anti-depressants. IT's 1:32AM and I feel too energetic for chronotherapy.

Re:Solution: Public Key Auth

[Killjoy_NL]

Easy, we build robots

(me assumes I'm not one of the dumb ones ;))

Re:Solution: Public Key Auth

[X0563511]

This is all simply because they don't need to bother looking for you, there are plenty of others on 22. As well, if you know enough to change the port, you probably are resistant to brute-force attacks.

In short, you are not the intended target anyways.

Now, if everyone started doing it, they would do what they needed to hit the low-hanging-fruit again. Once again - you are not the intended target.

Re:Solution: Public Key Auth

[X0563511]

Not over time... enough bots scanning intelligently over a month or so would make short work of it.

But why bother, when there are plenty of low-hanging fruits to be had without the extra effort?

Re:Solution: Public Key Auth

[NitroWolf]

Add mine too. Across all my servers, those that still use port 22 get probed all the time. The ones I've changed to different high numbered ports = 0.

Re:Solution: Public Key Auth

[Gerzel]

They all have exhaust ports. That's how they moved the earth and prevented Agnu from being sold.

Re:Solution: Public Key Auth

[OverlordQ]

That's odd, if $large_company would do something like this, everybody on slashdot would bitch at them for "Security through Obscurity"

Re:Solution: Public Key Auth

[ianare]

The other solution is to use asshole seeking missiles ...

Hum, not sure that's a good idea, I don't think the species would survive that.

Re:Solution: Public Key Auth

[ianare]

What was the security hole ? Just wondering.

Re:Solution: Public Key Auth

[Architect_sasyr]

Yeah because that's proven to be safe so far.

Defence in depth people, defence in depth.

Re:Solution: Public Key Auth

[xous]

This solution is practically useless as when a sufficient number of hosts use a non-standard port they will simply use port scans. As a systems administrator that has to deal with morons constantly locking themselves out of their servers due to using random ports and other silly techniques I find this to be an extremely stupid idea. -1 points for suggesting people change their ssh port to a non-standard port. There is a reason we have standards. Real solution: use Public Key Authentication or at least require strong passwords.

Re:Solution: Public Key Auth

[ladybugfi]

It really makes me wonder where they're getting them.

Keyloggers.

Re:Solution: Public Key Auth

[Anonymous Coward]

You can still use the standard port, just install a simple defense system in iptables.

iptables -A INPUT -p tcp --dport ssh -m state --state NEW -m recent --update --seconds 99 -j DROP
iptables -A INPUT -p tcp --dport ssh -m state --state NEW -m recent --set

Now any particular IP address can only open a tcp connection to your ssh server once every 99 seconds, or longer if they keep trying during the blackout period^^

Maybe put some whitelist rules before that. Change it to 900 (fifteen minutes) if you don't log into your server that often from other addresses.

Re:Solution: Public Key Auth

[Anonymous Coward]

Since changing my SSH ports to something really high (above 50000), I have had exactly *zero* failed password attempts in the last 14 months.

That means that you haven't been attacked by a portscanning bot yet.

That or they got the password right...

Really, you better check your system if the attacks _stop_.

Re:Solution: Public Key Auth

[Sepodati]

Most vulnerabilities with simple contact forms are email header injections. A malicious user will inject newlines into something like the "Subject" and then rewrite the headers and the email message itself. The headers/message the programmer intended to be inserted into the email will still be added on at the end of the message, but it's usually in the body by that time and can be hidden. Google has more info, but I can't get much to pull up right now.

---John Holmes...

Re:Solution: Public Key Auth

[Anonymous Coward]

5) ?????
6) Profit!

Re:Solution: Public Key Auth

[dynchaw]

All my servers have SSH sitting on a high port and have never had SSH attacks on them. In the one case where someone found the port, their bot attempted to use the port to proxy a web page. On port 22 I run a program that firewalls out anyone who creates a full TCP connection :)

Re:Solution: Public Key Auth

[m_frankie_h]

Unless the private key is protected by a passphrase, preferably one that is not easily bruteforced.

And if you notice your laptop was stolen (this should not be very hard), make a new key (and remove the old one from your servers).

Re:Solution: Public Key Auth

[houghi]

I use BlockHosts and even though I still get hit, the amount of tries is 4-5 and the IP address will be blocked for 12 hours.
Very seldom I see them hit me a second time.
The advantage is that it is live and although initially looks in the log files it does not depend on them.

Entry currently in my hosts.allow, which is after some IP addresses I specifically always allow.

#---- BlockHosts Additions
ALL: 216.146.46.29 : deny
ALL: 65.111.164.53 : deny
ALL: 77.48.41.174 : deny

#bh: ip: 122.166.17.253 : 1 : 2008-12-22 09:48:44 CET
#bh: ip: 216.146.46.29 : 5 : 2008-12-22 09:43:41 CET
#bh: ip: 65.111.164.53 : 4 : 2008-12-22 02:02:53 CET
#bh: ip: 77.48.41.174 : 5 : 2008-12-22 02:02:49 CET

#bh: logfile: /var/log/messages
#bh: offset: 5717251
#bh: first line:Dec 20 19:15:07 pasta syslog-ng[2148]: new configuration initialized

#---- BlockHosts Additions
sshd : ALL: spawn /usr/bin/blockhosts.py & : allow

Re:Solution: Public Key Auth

[NCG_Mike]

Since changing my SSH ports to something really high (above 50000), I have had exactly *zero* failed password attempts in the last 14 months.

So all hacks were successful ;-)

Re:Solution: Public Key Auth

[J.Y.Kelly]

At a web message board I setup, I used some popular software and was getting a ton of spam bots. So I added a simple "are you a human" question--no captcha or anything, just another checkbox to check... Not 1 single piece of spam. Same principle: the bots aren't that smart--you avoid the norms even by a little, and you're okay.

I've had the opposite experience. I run a website for a small choir and we have a contact form on there. This is something I wrote myself, not some popular package, and it's very tightly tied down so that the worst which can happen is that an attacker can send more junk to me.

Over the last year I've had at least two repeated and persistent attacks against this script. They were random bits of text with a random URL (not working or registered) at the end. After playing cat and mouse changing field names and blocking certain phrases which kept reoccurring I only managed to stop it in the end when I completely blocked the ability to include URLs in any message (which I didn't really want to have to do). We are a very small site and none of the attacks ever worked - but someone spent a considerable amount of time trying to break our site.

The moral is that noone is safe and it's just the luck of the draw if someone decides to focus their attention on you.

Re:Solution: Public Key Auth

[UPi]

I have noticed brute force attempts for years now. I have a simple script that adds hosts with a number of failed attempts to /etc/hosts.deny automatically. If a host logs in successfully, all its past "mistakes" are forgiven.

This has helped cut down on the invalid login attempts by >90%. This is by no means a perfect defense, since each botnet slave has three "shots" at guessing my passwords, but it still helps mitigate the problem.

To use my script, you need to add this to your sshd_config:

    MaxAuthTries 3

And this to your root cronjob:

    @reboot tail -F /var/log/auth.log | ~/bin/AutoDenyAttacker.pl &

(Replace the path for AutoDenyAttacker to fit your needs). You can download the script here: http://apocalypse.rulez.org/~upi/AutoDenyAttacker.txt (This is a perl script -- rename it to .pl after you download.)

This script works well for debian etch and lenny, and I expect it would work on other systems too, perhaps with a bit of tweaking.

Regards,
UPi.

Re:Solution: Public Key Auth

[Looke]

"For long"? 5 years and counting here. It's just like running Linux with no anti-virus. Crazy, I know, but I like living on the edge!

Re:Solution: Public Key Auth

[Anonymous Coward]

5)...
6)profit

Re:Solution: Public Key Auth

[0xygen]

I'm another in agreement with this - but will say I still do not have passwords enabled and solely use key based authentication for SSH.

I understand the argument against security through obscurity, but also believe that given a simple opportuniyu to decrease your attack surface it should definitely be taken!

Confession... both of the above changes were made after a really stupid day giving my GF access to my music via Samba lead to me creating an account with the username "mp3", the password "mp3" and forgetting that it would by default have an SSH enabled account. The machine was scanned and brute forced within about 3 days (surprised it took that long TBH).

sshblack is also really against stupid attackers (ie anyone except the distributed attackers in the articule).

Re:Solution: Public Key Auth

[Anonymous Coward]

Damnit, you mean 12345 has already been taken?

Re:Solution: Public Key Auth

[ttldkns]

then you should configure it so that only members of a specific group are SSH users. Then by default no one can login with SSH. A whitelist is much more effective here.

Put
AllowGroups sshusers

in your sshd_config file and then only members of the sshusers group can login via ssh

Re:Solution: Public Key Auth

[thogard]

The obvious solution is to use public/private key authentication and disallow password logins.

No the obvious is to hack sshd to require both if its properly configured. Right now its one or the other but not both. A password can be guessed yet keys allow for a cracked machine to open the doors for lots of others. Sure you can password encrypt your key files but that isn't the same as using a key and a password on the remote system that requires frequent updates.

Re:Solution: Public Key Auth

[Lennie]

I don't think they are interrested in the content, mostly they are interrested in using it as a jump point to get more access to the hosting-providers-network or to host their sites for free or send spam-/virus-/scam-mail and install an other bot to find other victims.

Re:Solution: Public Key Auth

[Anonymous Coward]

I'll add mine to the pile. I changed mine to non-22 (still 1024) and the attacks stopped. It's just not worth it for them to port scan.

Re:Solution: Public Key Auth

[Anonymous Coward]

Most port scanners (read: almost all of them) only scan up to 1024.

Actually, most port scanners (read: the decent ones, anyway; I have no experience with crappier ones that also may or may not exist) will scan up to port 1024 *AND* also probe well-known ports above that.

So if your SSH server runs on, I don't know, port 6000 or 31337 or so, it'd still be found.

Re:Solution: Public Key Auth

[Anonymous Coward]

What're you on about man, everybody knows there is only one person on 4chan, Moot.

<moot> Check out this pic! So ugly!
<moot> I bet you hit that every night! Get some man-love!
<moot> Dude, that's his mom. So you're probably right...
<moot> *goatse pic*

Moot, so ronery.

Re:Solution: Public Key Auth

[hawkinspeter]

I was thinking about this myself recently and managed to find fwknop - http://www.cipherdyne.org/fwknop/
It's an advanced version of port knocking that uses single packet authentication to get around the problem of replay attacks that plagues other port knockers.

Re:Solution: Public Key Auth

[MrZaius]

So then brute force attacks would be preceded by an open port check?

Unless you use some kind of port knocking attempt, that wouldn't solve much of anything for long.

Two points:
1: Port knocking or single-packet authentication really paired with the aforementioned port change really is a remarkably effective solution.

2: The article is discussing attempts to break into a large mass of computers, not targeted attacks on a single box. To add the considerable increase in overhead and visibility inherent in running port scans over a public network would be quite expensive, both in terms of the decrease in the number of boxes you can hit per minute and the risk of nodes in the botnet being cleaned up and removed sooner than they might otherwise have been. The former is doubly troubling to a botnet owner when you consider the cost of trying to identify the protocol in use on all the open ports other than 22, or of wasting an attempt to open a TCP connection on each of the ports.

Re:Solution: Public Key Auth

[witherstaff]

I found that having the typical FORM action lead to a bad page and dynamically changing the destination with onSubmit via javascript kills all auto-signup bots.

Since the sites that I do this on require javascript for other purposes then it's not a problem. I'm sure more bots will be better javascript enabled with so many sites going ajax but for now it's an easy helper.

Re:Solution: Public Key Auth

[QuantumRiff]

Yah but two anecdote's don't make a parable... right? Not without a car analogy....

Re:Solution: Public Key Auth

[earthcreed]

I think they might be getting them from the recent google gmail vulnerability. I was logging in to my gmail account one day, but typed my password into the google search box. The very first hit was my e-mail address and password listed in a big password listing. I checked out the site, and the list itself was behind a paywall, but they let the googlebot through. . .so you could get the entire dataset with some googlefu.

Re:Solution: Public Key Auth

[shess]

I changed my port to something in the 200k range, and I've had less than zero attacks.

Re:Solution: Public Key Auth

[Anonymous Coward]

As obvious as your solution is, it simply does not work for many reasons, as the bloke in the link outlines.

Re:Solution: Public Key Auth

[maxume]

Using a high port number is like parking in an empty part of a parking lot. It adds a small amount of inconvenience, reduces the likelihood of an incident, but fails to mitigate any of the consequences of an incident that does happen.

Re:Solution: Public Key Auth

[prograde]

Since changing my SSH ports to something really high (above 50000),

Really, wouldn't any port other than 22 that isn't used for anything else bots attack work?

Confirmed.

I've had zero failed password attempts in 5 years on (port < 1024 & port != 22).

Additionally, anyone using the examples on the man page of nmap don't see the box. Of course, if they actually know how to use nmap, it falls back to security by obscurity. Which is why I also keep ssh patched, use strong passwords, disallow root login, etc. etc. etc..

The port switch is really just to keep the logs clean enough for me to notice incidents which require attention.

Re:Solution: Public Key Auth

[Hordeking]

I'll add mine to the pile. I changed mine to non-22 (still 1024) and the attacks stopped. It's just not worth it for them to port scan.

Note to self: Brute force your SSH on port 1024...

Re:Solution: Public Key Auth

[Gyga]

"less than zero attacks"

If the opposite of being attacked is attacking someone else. Does that mean you've been compromised and have been used to commit more attacks than it took to break you?

Re:Solution: Public Key Auth

[steelfood]

It's not like /. requires SSL to log in.

Re:Solution: Public Key Auth

[nizo]

I always park in an empty part of the parking lot. I tried parking in the occupied parts, but my car is too small to shove all those other cars out of the way.

Re:Solution: Public Key Auth

[Goaway]

Funny thing, though, if you'd followed that advice in the last couple years and were running Debian or one of its derivatives, you'd be wide open for pretty much anyone to log in, thanks to that OpenSSL fiasco.

Re:Solution: Public Key Auth

[maxume]

I don't know, I'm pretty sure that the correct, absurd-literal-minded interpretation of 'part of a parking lot' is more than a single empty space.

I do agree that most people park in empty spaces.

Re:Solution: Public Key Auth

[DrgnDancer]

That's because YOU did it. If everybody, or any appreciable fraction of everyone, did it then the botnets could adapt to it trivially. Since it's not a common thing to do, it happens to work for you. It's not like it's a technically difficult hurdle to overcome, and it's not like the botnet controllers wouldn't realize it was becoming a popular technique. It's essentially a form of security by obscurity that works for you because no great number of other people are doing it.

Re:Solution: Public Key Auth

[Facetious]

What's this? An implicit car analogy? Much respect.

Re:Solution: Public Key Auth

[Plunky]

ok, get this

This criminal gang ("The Botnets") are rampaging across the city breaking into cars and stealing the stereos. But, get this, they are all lazy ass fatsos and at the multi-storey carpark they only ever break into cars on the ground level because its too much trouble to walk up to the upper levels. I mean, not many people park up there and these guys are not very good at picking locks anyway. If I had a car, I would park it up a few levels because I like the exercise and I don't like wiping greasy fingerprints off my door all the time. Seems like those other two guys do that too.

You're welcome.

Re:Solution: Public Key Auth

[Xabraxas]

That's the stupidest combination I've ever heard of in my life! That's the kinda thing an idiot would have on his luggage!

Re:Solution: Public Key Auth

[techno-vampire]

You've missed my point: use the passwords on your site as a dictionary for your botnet's brute force attacks on other systems.

Re:Solution: Public Key Auth

[OrangeTide]

if there are only 1000 "common" alternate sshd ports. That dramatically reduces the effectiveness of bruteforce attacks. Especially if you are really evil and put honeypots on the ports.

I should run on an upper port and put a fake sshd on port 22 that records login and ips. That might be fun.

Re:Solution: Public Key Auth

[Tycho]

I once considered attempting to park in an occupied part of a parking lot. I decided not to as my car (and my body too) cannot flow like a T-1000.

Re:Solution: Public Key Auth

[An ominous Cow art]

In post-Soviet Russia, ASSHOLES have BOTNETS!

Sorry, all.

Re:Solution: Public Key Auth

[rmadmin]

Or they're just asking for it. My customers fall for this one constantly: Dear E-mail Account User, Important Notice We have temporarily limited access to sensitive account features, To restore your account access, please you must reply to this email immediately and enter your E-mail account Username here :(.................)and password here:(................) Due to the junk/spam emails you receive daily, we are currently upgrading all email accounts spam filter to limit all unsolicited emails for security reasons and to upgrade our new features and enhancements with your new and improved E-mail account, to ensure you do not experience service interruption. Please you must reply to this email immediately and enter both your user name and password in the space provided to enable us upgrades your Account. A confirmation link will be send to you for the Re-Activation of your e-mail Account, as soon as we received your response and you are to Click on the "Confirm E-mail" link on your mail Account box and then enter this confirmation number: 1265-6778-8250-83.

Re:Solution: Public Key Auth

[sootman]

Related question: has anyone tried running SSH on another service's port if you're not using that port--say, running sshd on 21 if you're not running ftpd?

Re:Solution: Public Key Auth

[Moridineas]

Exactly what the other poster said--header injection.

The form asked for a "From" name and email address, and had a textarea for the email body.

The form then used the PHP's mail function (http://us3.php.net/manual/en/function.mail.php) including the additional_headers field to add the From name and email address to the mail (so that the recipient could just click reply to reply to the sender). The subject line and "to" parameters were set by the program to a limited number of possibilities. I'm assuming that's how the injection was done, so that by crafting a message correctly, the person could send an email to not just to the person in the "to" field, but to anybody.

Re:Solution: Public Key Auth

[cstdenis]

Your post advocates a

( ) technical ( ) legislative ( ) market-based (X) vigilante

approach to fighting botnets. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)

( ) No one will be able to find the guy or collect the money
(X) It is defenseless against brute force attacks
( ) Microsoft will not put up with it
(X) The police will not put up with it
( ) Requires too much cooperation from botnetters
( ) Requires immediate total cooperation from everybody at once
(X) Anyone could anonymously destroy anyone else

Specifically, your plan fails to account for

(X) Laws expressly prohibiting it
( ) Lack of centrally controlling authority
( ) Open relays in foreign countries
( ) Asshats
(X) Jurisdictional problems
( ) Unpopularity of weird new taxes
( ) Public reluctance to accept weird new forms of money
( ) Willingness of users to install OS patches received by email
( ) Armies of worm riddled broadband-connected Windows boxes
( ) Eternal arms race involved in all filtering approaches
( ) Joe jobs and/or identity theft
(X) Technically illiterate politicians
( ) Extreme stupidity on the part of people who do business with spammers
( ) Dishonesty on the part of spammers themselves
( ) Bandwidth costs that are unaffected by client filtering

and the following philosophical objections may also apply:

(X) Ideas similar to yours are easy to come up with, yet none have ever
been shown practical
( ) Any scheme based on opt-out is unacceptable
( ) Blacklists suck
( ) Whitelists suck
( ) We should be able to talk about Viagra without being censored
( ) Countermeasures should not involve wire fraud or credit card fraud
( ) Countermeasures should not involve sabotage of public networks
( ) Countermeasures must work if phased in gradually
( ) Sending email should be free
( ) Why should we have to trust you and your servers?
( ) Incompatiblity with open source or open source licenses
(X) Feel-good measures do nothing to solve the problem
( ) Temporary/one-time email addresses are cumbersome
( ) I don't want the government reading my email
(X) Killing them that way is not slow and painful enough

Furthermore, this is what I think about you:

( ) Sorry dude, but I don't think it would work.
(X) This is a stupid idea, and you're a stupid person for suggesting it.
( ) Nice try, assh0le! I'm going to find out where you live and burn your
house down!

Re:Solution: Public Key Auth

[profplump]

Because there is only one botnet in the world so once you're infected you won't be attacked? I'm not following your logic here.

Re:Solution: Public Key Auth

[dascritch]

I just notice something strange :
I worked for a french big SMS premium company as a "content creator", and made a listing for the used first names for France, other countries of Europe and North Africa.
And this listing is closely following Feminine French first names, then starts an alphabetic list of feminine Arabic first names, then Anglo-Saxons, then in fact a mix of everyone.
There is datamining.

But strangely, most of them are old First names (We never used them for personnalised logo for mobile phones, we rarely had 40+ aged people who used SMS premium).

Re:Solution: Public Key Auth

[jafac]

me too - lol :)

Re:Solution: Public Key Auth

[Anonymous Coward]

And if you flip one upside down you get a hyperbole.

Re:Solution: Public Key Auth

[nobaloney]

And you never make a mistake?

Re:Solution: Public Key Auth

[Cato]

One thing to watch out for with randomly chosen SSH ports is traffic shaping - I used port 119 (NNTP) for SSH at one point and only realised after some time that the ISP's Ellacoya traffic shaping hardware was configured to prioritise port 22 and greatly de-prioritise 119. Switching to port 22 greatly improved things. Of course this is ISP specific and they don't usually publish their traffic shaping policy rules including ports...

Re:Solution: Public Key Auth

[Anonymous Coward]

"Funny" is wrong. There is no joke about that comment.

Re:Solution: Public Key Auth

[noppy]

I tried that and it works. Unfortunately now I miss my favorite past time of skimming through log files for amusing failed username and passwords...

Re:Solution: Public Key Auth

[Heembo]

Ah, that makes sense.

My comment about secure password treatment stands true for enterprise applications, but for a honeypot it makes total sense to log passwords.

But, suppose you had an administration console to the honeypot that you did NOT want hackers to have access to - like some honeypot report/statistical sub-application - well, for that sub-app you would want to take my advise about password treatment.

Re:Solution: Public Key Auth

[Sancho]

Indeed. It's a good, general policy.

Re:Solution: Public Key Auth

[Anonymous Coward]

But do tell more - so a user logs in and gets authenticated. Then, you note suspicious activity - and pass them off to a honeypot to tract their activities? tre cool. Can you tell us a little bit more about your honey-architecture?

turd post

[Anonymous Coward]

one thing they're not avoiding: Barack Obama's gorgeous asshole!

A couple weeks ago, while browsing around the library downtown, I had to take a piss. As I entered the john, Barack Obama -- the messiah himself -- came out of one of the booths. I stood at the urinal looking at him out of the corner of my eye as he washed his hands. He didn't once look at me. He was busy and in any case I was sure the secret service wouldn't even let me shake his hand.

As soon as he left I darted into the booth he'd vacated, hoping there might be a lingering smell of shit and even a seat still warm from his sturdy ass. I found not only the smell but the shit itself. He'd forgotten to flush. And what a treasure he had left behind. Three or four beautiful specimens floated in the bowl. It apparently had been a fairly dry, constipated shit, for all were fat, stiff, and ruggedly textured. The real prize was a great feast of turd -- a nine inch gastrointestinal triumph as thick as his cock -- or at least as I imagined it!

I knelt before the bowl, inhaling the rich brown fragrance and wondered if I should obey the impulse building up inside me. I'd always been a liberal democrat and had been on the Obama train since last year. Of course I'd had fantasies of meeting him, sucking his cock and balls, not to mention sucking his asshole clean, but I never imagined I would have the chance. Now, here I was, confronted with the most beautiful five-pound turd I'd ever feasted my eyes on, a sausage fit to star in any fantasy and one I knew to have been hatched from the asshole of Barack Obama, the chosen one.

Why not? I plucked it from the bowl, holding it with both hands to keep it from breaking. I lifted it to my nose. It smelled like rich, ripe limburger (horrid, but thrilling), yet had the consistency of cheddar. What is cheese anyway but milk turning to shit without the benefit of a digestive tract?

I gave it a lick and found that it tasted better then it smelled.

I hesitated no longer. I shoved the fucking thing as far into my mouth as I could get it and sucked on it like a big half nigger cock, beating my meat like a madman. I wanted to completely engulf it and bit off a large chunk, flooding my mouth with the intense, bittersweet flavor. To my delight I found that while the water in the bowl had chilled the outside of the turd, it was still warm inside. As I chewed I discovered that it was filled with hard little bits of something I soon identified as peanuts. He hadn't chewed them carefully and they'd passed through his body virtually unchanged. I ate it greedily, sending lump after peanutty lump sliding scratchily down my throat. My only regret was that Barack Obama wasn't there to see my loyalty and wash it down with his piss.

I soon reached a terrific climax. I caught my cum in the cupped palm of my hand and drank it down. Believe me, there is no more delightful combination of flavors than the hot sweetness of cum with the rich bitterness of shit. It's even better than listening to an Obama speech!

Afterwards I was sorry that I hadn't made it last longer. But then I realized that I still had a lot of fun in store for me. There was still a clutch of virile turds left in the bowl. I tenderly fished them out, rolled them into my handkerchief, and stashed them in my briefcase. In the week to come I found all kinds of ways to eat the shit without bolting it right down. Once eaten it's gone forever unless you want to filch it third hand out of your own asshole. Not an unreasonable recourse in moments of desperation or simple boredom.

I stored the turds in the refrigerator when I was not using them but within a week they were all gone. The last one I held in my mouth without chewing, letting it slowly dissolve. I had liquid shit trickling down my throat for nearly four hours. I must have had six orgasms in the process.

I often think of Barack Obama dropping solid gold out of his sweet, pink asshole every day, never knowing what joy it could, and at least once did, bring to a grateful democrat.

Re:turd post

[Anonymous Coward]

Okay, Mr. Taco, almost every single time a long post has Read the rest of this comment... at the bottom, there is no more content to be displayed. The comment is already displayed in its entirety. Is this a bug, or just insane coincidence that ALL of these posts have one extra newline that puts the length over the threshold?

Re:turd post

[Vectronic]

Im not sure, but I think it's a left-over, Slashdot used to have a setting for how much/long a message would be before it did that, but they seem to have removed that option, so it was probably just left behind in the configuration somewhere, If Msg.Length > 512 Then ShowReadRest = True
except in PHP or whatever.

Re:turd post

[Anonymous Coward]

And with all the whiz-bang ajax shit that's cluttering this place up, you'd think they could use it to retrieve the rest of the post inline.

Re:turd post

[FugitiveMind]

They do... it's just that there's nothing else to retrieve but whitespace.

AI

[religious freak]

I swear, some of the most adaptive, sophisticated, and advanced techniques seem to be coming out of the Botnets.

It's my (admittedly probably crazy) idea that we WILL begin to see "emergent intelligence properties" out of some sophisticated system at some point in time, whether it be Google, an AGI lab, or a botnet. I shudder at the prospect of our first AI of power will have grown from one of these botnets.

NOTE: I'm not saying this will happen tomorrow, but extrapolating the current state of botnets relative to the current state of other systems leads me to believe, on a relative basis, systems may be complex relative to one another as they are today. If that is the case, well... that would be bad.

Re:AI

[Anonymous Coward]

I, for one, welcome our new botnet overlords.

Re:AI

[Fluffeh]

I think what you said is interesting, but if I was to summarize:

You fear the day when a botnet becomes self aware. And then sends you an email telling you it can sell you viagra cheaply or that it has found a better way for you to remortgage your loan.

Me personally? I am waiting for the email I get some a self aware botnet in Nigeria saying how it found this great bank account full of moolah, but just needs to use MY bank account to siphon it all out.

Re:AI

[Anonymous Coward]

I shudder at the prospect of our first AI of power will have grown from one of these botnets.

Why do you shudder? Why even think it would be bad?

If an AI evolves from humans, then it won't necessarily be worse in terms of destruction or spam. It might shut itself down. If indeed it does turn into skynet... then oh well, I get we reap what we sow. But evolutionary-wise, what is happening was bound to be.

Re:AI

[Opportunist]

It's not the artificial intelligent botnet I'm really afraid of. It's the combination thereof with the natural stupidity necessary to actually fall for the spam that scares the hell outta me.

Re:AI

[Al Dimond]

My understanding of botnets is that all their activity is centrally coordinated: the bots sit in an IRC channel waiting for orders and do what they're ordered to do. It doesn't seem likely to me that the listeners are doing anything very sophisticated here. As it's always been with brute-force attacks, There are lots of target hosts, lots of usernames and passwords to try, and lots of bots to try them. Assuming every attempt gives you about the same odds of success it doesn't matter much what order you try them in. So some people changed the order, and changed the way they divide up work, to avoid detection.

I won't deny that it's a clever adaption, or claim I definitely would have thought of it in their situation. But as far as adaptivity goes, the major tactical advance came from an explicit change in behavior by the botnet masters themselves. The parts of the software that might be adaptive, slowing down attempts on hosts where they are repeatedly unsuccessful and avoiding OpenBSD boxes, were probably specifically programmed to adapt in these ways. They're no more advanced than, say, TCP flow control behavior, or P2P programs.

Re:AI

[Fluffeh]

Because computers are widely known for their common sense?

It's like saying to a robot "Can you watch this lamb in the oven?" and they do. They bloody watch it burning for three hours.

Ahh thank you Red Dwarf, even historically, you were so accurate of the future...

Re:AI

[religious freak]

If a botnet is designed to attack, disable and/or infect computer systems (as I'm assuming these botnets were designed to do from what I read in TFS), and it is sophisticated enough to adapt and create new strategies, then our first experience with a highly adaptive AI may very well be having it shut down everything with a cord attached to it.

Re:AI

[religious freak]

Because I'm programmed by Darwin to not want to die by a more advanced form of life. Maybe you can make the intellectual leap to walk into the mouth of a god, but I can't - at least not if I don't have to.

Re:AI

[religious freak]

Yeah, I'll grant you that. I don't know the specific extent to which these things are actually adaptive, but things like captcha breaking still get my attention because of the skill that needs to be involved in creating the algorithms. So I really don't doubt there are some very sophisticated programs running around the net looking for targets.

I do admit, it's half crazy, but I don't think the concern is totally unwarranted, especially since these things are essentially designed to target and destroy.

Re:AI

[Sentry21]

The idea that a system like SkyNet would evolve out of a system designed to get us to buy discount v1agra and c1al1s bodes poorly for our future prospects against the coming robotic onslaught. Truly our proud, erect soldiers will be no match.

Re:AI

[Anonymous Coward]

This flamebait brought to you by the letter Y and the number "I paid off my fucking loans why can't everybody else?

You forgot a closing " in your sig.

Re:AI

[SpaceLifeForm]

Careful with the parsing.

You *are* programmed, by a more advanced form of life,
to not *want* to die.

That does not mean that you are programmed to avoid death
at the hands of a more advanced form of life.

In fact, you are programmed to die period, regardless of
your wishes, at the hands of the most simplest lifeforms.

Re:AI

[sleeponthemic]

NOTE: I'm not saying this will happen tomorrow, but extrapolating the current state of botnets relative to the current state of other systems leads me to believe, on a relative basis, systems may be complex relative to one another as they are today. If that is the case, well... that would be bad.

Are you saying that the true, skynet T-1000 will infact be RoleCKS (tm) clad and sporting a gigantic boner that won't quit?

Scary.

Re:AI

[Fluffeh]

Ta much.

Re:AI

[johanatan]

So now Darwin's theory programs you? That's actually not a bad wording to describe 'science education' concerning Darwin--too bad more naturalists are not this honest!

Re:AI

[troll8901]

Truly our proud, erect soldiers will be no match.

I seek thy subtle humor skills from you, Master!

Re:AI

[TapeCutter]

That wooshing sound you heard while reading the GP's post - it was a metaphor.

Re:AI

[Anonymous Coward]

Oh jeez, not this shit again.

Please stop pushing your ignorant wishings upon the populace as if it's clever.

Botnets are nothing but the same failed, brute force, AI strategy that has been openly mocked for decades. You don't understand what you just said and how profoundly stupid you sound.

Re:AI

[Mozk]

Rarely is the question asked, "Is our botnets learning?" It is a question that we must face.

Re:AI

[N1AK]

No, he's literally programmed by Darwin who sadly due to his other work isn't widely recognised as the father of AI.

I'd agree that it is a good wording for describing a BAD teaching of evolution, not least because it only manages to sound slightly less retarded than most religious explanations.

Re:AI

[Richard W.M. Jones]

My understanding of botnets is that all their activity is centrally coordinated: the bots sit in an IRC channel waiting for orders and do what they're ordered to do.

For comment spam it's more sophisticated than that: I monitor all attempts at adding comment spam to several sites I run. One site is interesting because it requires several distinct requests in order to post a message (and you have to visit each of those pages in turn in order to be successful at posting). The bots can perform these steps -- I watched as the controller in the Ukraine first worked it out manually -- but they do it from random IP addresses in turn. However, the cookie that I send in the first request is faithfully sent back by the other IP addresses.

These are not human attacks using something like Tor - far too quick for that.

So the bots communicate that cookie back to their "master" between each request, and that happens in sub-second times.

Rich.

Re:AI

[Anonymous Coward]

It's my (admittedly probably crazy) idea that we WILL begin to see "emergent intelligence properties" out of some sophisticated system at some point in time

No it's not your idea, you saw it on Terminator like the rest of us.

Re:AI

[powerlord]

Basically the bots use the IRC channel themselves for Inter Process Communication.

Perhaps they even have a two tier approach where mid level zombies act as control nodes to co-ordinate a series of zombies. Then the IPC can simply take place back and forth between those nodes. The IRC channel can divie up resources (or re-allocate them) however often it wants/needs to, and then each of the control nodes can use its "zombie hordes" to run through an algorithm.

No big surprise or big "ooooo", just standard programming adapting to different circumstances.

Re:AI

[raddan]

Bob Beck showed a PF feature at BSDCon several years ago that "stuttered" the connection speed for abusive users-- you can define particular behavioral patterns to watch for in your pf.conf, or even have a log-watching program modify PF's tables dynamically based on something it sees in a logfile. OpenBSD's spamd uses such a feature, and the result has been that spammers tend to avoid these "tarpits" because they spend a lot of time stuck in them when they could be blasting spam out elsewhere. You end up seeing many spammers dropping connections after 10 seconds or so. We've been running with this feature on our site for a couple years now, and it works beautifully. Among people running OpenBSD firewalls-- this is a pretty popular feature. That may be the cause of the avoidance of OpenBSD sshds.

Re:AI

[Anonymous Coward]

The test is over now, you win! It was a fun test and we are all impressed by how much v1agra you consumed. We are throwing a party in honour of your tremendous success. Place the phone with the number for our competitor's FDA lobby group on the ground and lay on your stomach with your hands at your sides and your bum in the air...

Re:AI

[Anonymous Coward]

OK, maybe they're bot attacks using something like Tor?

Nothing says you have smart entities relaying concise bits of info to the master, and Occam's razor gives preference to the simple dumb-proxy explanation, where the entire HTTP session is relayed from the master through one, a limited chain, or a Tor-like chain, with no comprehension of the content. It costs bandwidth, but the botnetters aren't paying for it.

Re:AI

[Daehenoc]

I for one welcome our new Botnet AI overlords!

Speculative but interesting

[vvaduva]

The conclusions are a bit too speculative, nonetheless the research is interesting. I am not sure if a few hundred hosts are enough to conclude that the "bad guys" are coordinating and sharing attack output. And as far as avoiding OpenBSD, come on..."OpenBSD is a bitch." Why is this a surprise?? :)

Re:Speculative but interesting

[Anonymous Coward]

it's enough to get me to ditch all my linfux boxes. yeah, i'm just talking shit but it's no different than the fags who claim they're sick of windows/osx/ea/steam or whatever. you fucking fags take it in the ass.

go fuck yourselves.

OpenBSD hosts make stupid targets...

[fuzzyfuzzyfungus]

In principle, OpenBSD is no more or less vulnerable to weak username/password pairs than is any other OS. I suspect that, on average, OpenBSD machines are more likely to be set up for keypair auth; but any that aren't are in the same boat as everybody else(since, after all, username/password guesses aren't OS weaknesses, OSes are supposed to respond to correct username/password pairs.)

There is still reason to avoid them, though. Because OpenBSD is something of a niche system, you can make plausible inferences about the systems running it. Specifically, they most likely have admins who are interested in security and are watching activity fairly closely, and are more likely than average to do something about it. If you are doing something illegal, why attract such attention?

Re:OpenBSD hosts make stupid targets...

[MichaelSmith]

The attacker still has to use a local vulnerability to get from a user account to root. This may be less likely on OpenBSD because of their code review process.

Re:OpenBSD hosts make stupid targets...

[Anonymous Coward]

In principle, OpenBSD is no more or less vulnerable to weak username/password pairs than is any other OS. I suspect that, on average, OpenBSD machines are more likely to be set up for keypair auth; but any that aren't are in the same boat as everybody else(since, after all, username/password guesses aren't OS weaknesses, OSes are supposed to respond to correct username/password pairs.)

There is still reason to avoid them, though. Because OpenBSD is something of a niche system, you can make plausible inferences about the systems running it. Specifically, they most likely have admins who are interested in security and are watching activity fairly closely, and are more likely than average to do something about it. If you are doing something illegal, why attract such attention?

I seriously have to think that this is posted by someone with absolutely no formal education in operating systems. Sure, "in principal" OpenBSD is no more secure than Windows, but in reality, anyone familiar with the basics concepts behind Windows vs OpenBSD knows exactly why it is more secure.

Re:OpenBSD hosts make stupid targets...

[jd]

Their code review seems to concentrate on external attacks. They have expressly derided mandatory access controls, for example, on the grounds that you've got to trust your users or you're already lost. So, OpenBSD is actually more likely to be vulnerable to such attacks than an OS with weaker reviews but superior access controls, such as Linux with the RBACS or GrSecurity patches in place. Thus, if anyone is using OpenBSD, they'd damn well better be using strong authentication.

(OpenBSD has the best strong authentication of any OS on the planet, and the best security from external attacks of any OS on the planet, but cliques of any kind are notoriously blind to any problem outside of their special interest and OpenBSD is no exception. Which is why they caught a rollicking from Slashdot when it came to failing to patch their PRNG after defects were found in the *BSD family of PRNGs. It's why you should never, ever trust a group - however good - to be good at everything.)

Re:OpenBSD hosts make stupid targets...

[setagllib]

So, Mr Formal Education In Operating Systems, will OpenBSD refuse a valid username and password combination because the person logging in has a hidden evil deep in their hearts, unlike Windows which has blind faith in all valid passwords?

You're very confused. It's true that, if configured to accept username and password authentication, any system will treat a valid username and password as sufficient. That's why most professional administrators use public key authentication with good private key protection policies. But given an equal configuration of username and password, OpenBSD will be just as trusting as Windows.

Re:OpenBSD hosts make stupid targets...

[Anonymous Coward]

Of course if the systems are configured exactly the same they will be just as trusting. If two systems use a poor algorithm, of course they will behave the same. Now, explain to me why OpenBSD and Windows behave differently.

Oh, you don't know?. I thought so...

Re:OpenBSD hosts make stupid targets...

[setagllib]

What poor algorithm? Hash collisions aside, a password is a password. Only things like retry limits, retry delays, automatic blacklisting, etc. will make any difference, and as we've agreed, these are matters of configuration which must be identical between systems for any meaningful comparison.

Regardless of what kernel is running, a password auth's security hinges on the password. Yes, for Windows it's probably even easier to probe SMB or IIS, but the password auth will be just as good or bad as OpenBSD if configured the same.

Re:OpenBSD hosts make stupid targets...

[Anonymous Coward]

See, the difference is the principal. If you go down to the very basics, of course a password is a password. The difference has to do with how the overall system allows password authentication. Don't focus on the principal of passwords in general, look at how Windows and OpenBSD implement authentication. That is the difference, and the subject of conversation.

A person with general knowledge of how password authentication works will assume that Windows and OpenBSD treat authentication exactly the same. Of course, why wouldn't they? setagllib, I encourage you to read up on the subject matter thoroughly, it is essential to a basic understanding of computer systems. Good luck!

Re:OpenBSD hosts make stupid targets...

[Anonymous Coward]

OpenBSD is avoided because it's dead. Ergo, userspace tools or h4x0ring from it are less in production.

Re:OpenBSD hosts make stupid targets...

[Anne Thwacks]

will OpenBSD refuse a valid username and password combination because the person logging in has a hidden evil deep in their hearts

Yes

You are obviously a Windows user.

Re:OpenBSD hosts make stupid targets...

[setagllib]

I've been a FreeBSD and Linux user for several years. I must have missed the RFC for evil detection over SSH. Link?

Re:OpenBSD hosts make stupid targets...

[Anonymous Coward]

I must have missed the RFC for evil detection over SSH. Link?

3514

Re:OpenBSD hosts make stupid targets...

[Anonymous Coward]

Are you really that stupid? If you want ACLs, why don't you write some and submit your code instead of spouting off like an ignorant troll?

Sorry, I couldn't help myself. :-) I really love OpenBSD and have used it even after a Debian Linux/GRsec combo, because I think that effectively their solution is at least as good, albeit easier for me to maintain. And also over time I found that I prefer traditional Unix over Linux.

Re:OpenBSD hosts make stupid targets...

[raddan]

What do you mean by "weaker access controls"? Do you mean ACLs as opposed to POSIX permissions? IIRC, the argument was: ACLs are confusing, and anything that is confusing is bad for security. As someone who has to admin ACLs on Linux systems, I have to agree-- the extra complexity usually isn't worth it, and most of our filesharing uses traditional POSIX permissions.

If you mean that they haven't paid attention to local exploits, you're mistaken. They take all of these things seriously, and changes to their memory-allocation routines and the inclusion of memory protection in the base compiler shows this. But it doesn't make a lot of sense to spend time putting arbitrary obstacles in front of a user who is already privileged. You're already screwed.

Re:OpenBSD hosts make stupid targets...

[Anonymous Coward]

hey mods, it's called "parody", which is a form of humor. look it up sometime. ;-)

Re:OpenBSD hosts make stupid targets...

[rtfa-troll]

There's no need. The evil bit applies at the IP level so it isn't encrypted. You just block it with a pf rule. Anyway, once you've invited the packet inside there isn't much you can do. Not even onion routing will scare it away, so internal controls make little difference.

BotNet will someday become self-aware

[Anonymous Coward]

Soon BotNet will become self-aware and start searching for Sara Connor

*BSD is Dying

[Anonymous Coward]

It is now official. Netcraft confirms: *BSD is dying

One more crippling bombshell hit the already beleaguered *BSD community when IDC confirmed that *BSD market share has dropped yet again, now down to less than a fraction of 1 percent of all servers. Coming on the heels of a recent Netcraft survey which plainly states that *BSD has lost more market share, this news serves to reinforce what we've known all along. *BSD is collapsing in complete disarray, as fittingly exemplified by failing dead last in the recent Sys Admin comprehensive networking test.

You don't need to be the Amazing Kreskin to predict *BSD's future. The hand writing is on the wall: *BSD faces a bleak future. In fact there won't be any future at all for *BSD because *BSD is dying. Things are looking very bad for *BSD. As many of us are already aware, *BSD continues to lose market share. Red ink flows like a river of blood.

FreeBSD is the most endangered of them all, having lost 93% of its core developers. The sudden and unpleasant departures of long time FreeBSD developers Jordan Hubbard and Mike Smith only serve to underscore the point more clearly. There can no longer be any doubt: FreeBSD is dying.

Let's keep to the facts and look at the numbers.

OpenBSD leader Theo states that there are 7000 users of OpenBSD. How many users of NetBSD are there? Let's see. The number of OpenBSD versus NetBSD posts on Usenet is roughly in ratio of 5 to 1. Therefore there are about 7000/5 = 1400 NetBSD users. BSD/OS posts on Usenet are about half of the volume of NetBSD posts. Therefore there are about 700 users of BSD/OS. A recent article put FreeBSD at about 80 percent of the *BSD market. Therefore there are (7000+1400+700)*4 = 36400 FreeBSD users. This is consistent with the number of FreeBSD Usenet posts.

Due to the troubles of Walnut Creek, abysmal sales and so on, FreeBSD went out of business and was taken over by BSDI who sell another troubled OS. Now BSDI is also dead, its corpse turned over to yet another charnel house.

All major surveys show that *BSD has steadily declined in market share. *BSD is very sick and its long term survival prospects are very dim. If *BSD is to survive at all it will be among OS dilettante dabblers. *BSD continues to decay. Nothing short of a miracle could save it at this point in time. For all practical purposes, *BSD is dead.

Fact: *BSD is dying

Botnet solution

[Anonymous Coward]

Bots were knocking on my door to the point I was worry about performance degradation. I know there are many ways to defeat these but here was my solution.

In hosts.deny
-----------------
sshd:ALL EXCEPT /var/www/html/allow.txt
-----------------

Create a simple cgi-script (password protected and accessed via secret random url) that writes your browser IP address to the allow.txt file and all those nasty botnets and go to hell.

Re:Botnet solution

[codepunk]

So say you have a remote server no console access.

One day you are messing around with httpd.conf and fat finger a entry and mess up the config. Some months laterthe NOC hosting your system has to do some quick machine maintenance and powers down your machine. Later in the day they finish and power up your instance, but wait the httpd.conf file has a error and apache refuses to start on boot......now what, yes you are screwed you
cannot access your account.

Re:Botnet solution

[truckaxle]

So say you have a remote server no console access.

Usually yes.

One day you are messing around with httpd.conf and fat finger a entry and mess up the config. Some months laterthe NOC hosting your system has to do some quick machine maintenance and powers down your machine. Later in the day they finish and power up your instance, but wait the httpd.conf file has a error and apache refuses to start on boot......now what, yes you are screwed you
cannot access your account.

I also have a fixed ip address (that I always have access to) added to the file like this.

In hosts.deny
-----------------
sshd:ALL EXCEPT 187.190.10.1 /var/www/html/allow.txt
-----------------

Re:Botnet solution

[mellon]

You make changes to httpd.conf and don't restart apache? Dude, that's just nuts. Anyway, as long as your home machine with a stable address is in the file, you can still get in from there.

Re:Botnet solution

[codepunk]

You make changes to httpd.conf and don't restart apache? No I have not but I have seen an admin do it before.

as long as your home machine with a stable address is in the file, you can still get in from there. Unless of course your isp dhcp lease expired in the mean time and you now have a different address.

Re:Botnet solution

[osu-neko]

Okay, part of your problem here is, you haven't set things up so that only httpd.conf files that pass configtest are allowed to sync up to the live system. (Gods forbid you've allowed to edit the config files on the live system directly.) The script that submits them should be checking their validity before putting them in place to the read by the next restart...

Re:Botnet solution

[Anonymous Coward]

what's my browser IP address?

hell, I used to know my computer IP address, now I have to mind my browser?!

Re:Botnet solution

[Anonymous Coward]

Create a simple cgi-script (password protected and accessed via secret random url) that writes your browser IP address to the allow.txt file and all those nasty botnets and go to hell.

Unless the bot that is attempting to access your system happens to have the same service provider as a browser that you used to log in on AND that service provider just happened to allocate your logged IP to the bot system.

Re:Botnet solution

[codepunk]

Yes yes of course but not everyone submits a httpd.conf file with a script both of us know that. The only point I was
trying to bring up is some poor fool is going to take this solution as the perfect fix only to accidentally lock himself out
of his own machine.

The example I put up was only one reason apache may not start. The solution proposed requires that apache starts without
a hitch. I just don't want someone to try to implement such a solution without applying a little thought to the process. If apache
fails to start and you have no control of your ip lease or console access you will be screwed...

Re:Botnet solution

[Anonymous Coward]

Remove the IP from the list on logout, duh!

Re:Botnet solution

[Anonymous Coward]

So there might be as well a glitch that would cause sshd to not start (I had such one not so long ago -- a bad block on the HD prevented from loading a necessary .so). And even when you mathematically prove that you're not locking yourself out, here comes a meteor crashing right into your server room.

The method proposed by the original AC poster sounds worth implementing...

I want to see a death bounty for these people

[erroneus]

These people are a tremendous illness upon the world. If it were legal, I would contribute to a bounty on the lives of the people responsible for this stuff. These people make me beyond sick. I have said it many times and sometimes I actually mean it -- if I knew of someone involved in this sort of business close by, I would appear on the news shortly thereafter. And I am pretty sure I am not alone in this sentiment.

Re:I want to see a death bounty for these people

[maxume]

What, under the headline "Spaz Found Dead"?

You make it sound so easy, you would just find them and turn them off like a switch. The problem is, what if they aren't the nice, misguided fellows you think they are and they turn you off like a switch?

Re:I want to see a death bounty for these people

[Opportunist]

Nobody keeps you from putting a bounty on the head of a spammer and botnetter. You can't ask for them being killed, but you can without a problem issue a bounty on them, payable to whoever tracks down a botnetter and drags him to court.

Re:I want to see a death bounty for these people

[couchslug]

Their attacks will make the internet stronger by helping it evolve defenses it would not otherwise have.
Some steady pressure spurs evolution. So long as it does not kill the host we should smile and welcome the challenge.

Re:I want to see a death bounty for these people

[freakball]

You, sir, have made a decisively important observation. Without fitness, how can something be forced to evolve? Of course, like cars, any metaphor breaks down at some point. (this is my first post here, BTW--been lurking for years.)

Re:I want to see a death bounty for these people

[Jah-Wren Ryel]

These people are a tremendous illness upon the world.

Have you heard about the dramatic increase in asthma rates in the first world? Its starting to look like the increase is due to people living in an environment that is 'too clean' - as children their systems don't get a chance to develop protections against common problems.

You should look at these attackers the same way - they contribute to an increase in overall security. Sure it is painful, but ultimately pain is the only real motivator - just look at how piss-poor vendor responses were to security problems before full disclosure became them norm and threatened their bottom line.

You will absolutely never ever be able to make all attackers go away, any solution that relies on locking them up is doomed to failure, full stop. You can drive out the masses of dumb ones, but then that will only leave the small group of really smart ones behind. And at the same time you'll end up making the lives of the smart ones much easier since without widespread "illness" there will never be widespread inoculation either.

Re:I want to see a death bounty for these people

[Anonymous Coward]

if I knew of someone involved in this sort of business close by, I would appear on the news shortly thereafter

Oooh, you're a BIG MAN. Show me your MANLY MUSCLES. What would you do? KILL them? BEAT THEM UP? Does your nonexistent wife APPROVE of your PLAN? Will she AID AND ABET you? Will she be RAPED in prison, or will she WILLINGLY SCISSOR her cellmate(s)?

I am very INTRIGUED by your FUTURE PLANS. Please GIVE US MORE INFORMATION. Perhaps I can come OVER TO YOUR HOUSE and your nonexistent wife can GO TO THE LAUNDROMAT and you and I can mutually MASTURBATE while setting up a BOTNET. Then you will APPEAR ON THE NEWS shortly THEREAFTER... for ENGAGING IN SODOMY.

Re:I want to see a death bounty for these people

[coryking]

Wow, you just made me completly re-evalute how I thought about dealing with botnets. I've long thought of internet security as something very, very analogous to meatspace problems like insects, virii, or bacteria. Every time we try to squish the buggers out, we just make them stronger.

Your post made me think about how we over-use antibiotics in meatspace and how it applies to security. Things like graylisting spam, or random port assignments will are only stop-gap until the fuckers up the ante and just portscan your ass to find SSH.

Already I'm noticing graylisting is becoming almost useless. Everybody has started to deal with it, from registration emails to spam. A year ago, what used to take five minutes thanks to graylisting now takes 30 seconds (the bottom end of my retry limit). The people who boast about using random ports are only going to make the problem worse because soon everybody will be using random ports.

That said, I think in the end we will be forced to have our cake and eat it too. We do need to lock any asshole we catch up and toss the key. Make no mistake, we cannot send signals that this sort of behavour is tolerated in modern society. But at the same time, we need to not pretend that locking them up will make the illness go away. All we can do is beef up our immune systems and lock the assholes we manage catch up for a long, long, long, long time.

Re:I want to see a death bounty for these people

[nobodymk2]

Um. TraceRT routines? I have already found physical addresses for most of those people just by looking at standard IP geolocation and estimating. Most of them are from US IPs if it resolves to a IP directly. Stupid script kiddies. I'll stop by their house with a Wide-area jammer I made with a few spare parts and readily available frequencies (DSL reproduces LOTS of interference if carried over phone even though line-level should chop it off. It's not EMI shielded now days, it's sad. Need more Faraday cages and less reproduction of wireless frequencies like 60hz NJ powerline buzz) and see how the police on the scene deal with FCC derelugation if theres no person identifiable except the proof that they were doing something illegal to begin with.

Re:I want to see a death bounty for these people

[johanatan]

Very true. And, these attacks are not all that sophisticated to begin with--why bother wasting lots of expensive time truly 'hacking' when there is so much low hanging fruit that can be gotten with simplistic techniques. Even these 'adaptations' are simple hardcodes and not dynamic ones.

Re:I want to see a death bounty for these people

[Anonymous Coward]

I completely disagree. In my opinion if a problem is so bad you wish the opposition dead then you're going about solving it wrong. You should be confident in letting the bad guys guess as many times as they want. Passwords likely to fail to that attack? Fine. Then passwords are the problem. I'm not saying I have a better solution just now, I'm just saying that it's more likely that there's a better scheme than passwords than it is that death threats will help a security weakpoint.

Re:I want to see a death bounty for these people

[Anonymous Coward]

He didn't talk about the botnetters. He talks about a bounty for the responsibles.

As much as I'd love to see all windows users dead, it's just too much work.

Re:I want to see a death bounty for these people

[Anonymous Coward]

Spammers and bots(-netters) are trespassing private and public property. Let's treat them the way meat space deals with trespassers.
I automatically did use the pronoun "them" with the connection of bots, hmm..

Re:I want to see a death bounty for these people

[Anonymous Coward]

What stupidity.

The suffering caused by problem 'A' will diminish as the body adapts to cope with problem 'A', so the implication is that the problem is somehow good.

That's like saying that it is good someone punched you on the nose because the resultant bent nose is not so prone to further breakage.

Better that problem 'A' didn't exist in the first place, and then there would be no need to adapt, and no suffering at all.

Re:I want to see a death bounty for these people

[Anonymous Coward]

You write as though given enough intelligence, a person will always be able to find a way around a problem. Sadly, that is not true.

Stick a genius in a cell with ten foot thick concrete walls with no windows or doors ( and especially no ventilation ducts leading to the outside world ) and they will die a death in there, no matter how clever they are.

That's just an example.

There will come a time when technology is so cheap that every one of us can be monitored 24/7 with intelligent systems to identify aberrant behaviour. Give the state enough technology, and a monopoly on that technology, and if you live long enough to see it, you will find that you can be prevented from living your life the way you would want.

We're already part of the way there.

As for asthma, let's instead dwell on smallpox. Completely eradicated by use of anti-biotics.

The botnets can be eradicated. All it needs is co-operation between the right entities across the world and the will to complete the task.

Re:I want to see a death bounty for these people

[Anonymous Coward]

A Fun Idea.
But better than a death bounty, would be a sensible way to make them STOP WANTING to be douchebags. They do this crap for various reasons, but the big ones are in it for money. Most of the rest are stupid little jackasses who 'wanna be hackers'. Yes we've all known a script-kiddie or two. I kick them in the balls when I meet them. Literally. HARD. A solution? not really, but I clean up MY little corner of the world when I can.
The real trick would be to make this sort of crap unprofitable. Like, say, I dunno... Make ALL mass marketing illegal, and start sending offenders to friggin' guantanomo bay. For real. I don't mean pass some ineffectual little lip-service law, which is what we get now, because a: our legislators are all retards. and b: they have no interest in protecting US, they protect their cash cows. There's also the small fact that THEY are mainly the ones who WANT mass marketing. For thier reelection efforts. that's what protects these people. The fact that OUR LEADERS use the same tactics.
If our 'government' was serious about stopping this, it'd be like this whole terrorism BS thing. Yeah, that bottle of water might be some newfangled form of highly transparent, drinkable high explosives, you can't carry it through.
What's that? You once sent an email to iraq? Oops. Now you're on the 'watch list' and people invade and monitor your life with no warrant.
we need to do THAT to these bastards.

Re:I want to see a death bounty for these people

[Raenex]

If it were legal, I would contribute to a bounty on the lives of the people responsible for this stuff.

You'd kill somebody for spamming. Yep, you're so much more ethical than the spammers.

Re:I want to see a death bounty for these people

[erroneus]

I would kill a spammer and a botnet creator because of the kind of person he is. I would even argue that they are worse than child rapists... well perhaps on the same level. I say this because everything the pathological hackers are doing is carefully calculated, planed and executed. More than simply premeditated, it is engineered and designed destruction. With child rapists, it is most frequent that they cannot actually control their impulses and rarely have actual intent to harm at all.

Both are mentally and/or emotionally broken people, but one represents a much larger danger even if it is easier to stomach. Crimes of passion and the mentally broken are a lot easier to forgive than these Lex Luthor wannna-bes.

When people set out to circumvent security measures in order to unleash their destruction, that puts them on a much higher tier than some of the most disgusting and heinous crimes.

Killing a pathological hacker would do more good than harm. There are a small group of types of people we would all like to see exterminated and I am sure the majority of us have a short list of our own.

Re:I want to see a death bounty for these people

[maxume]

This is why I slash tires and smash car windows. It forces the owners to purchase windows and tires that are resistant to these attacks, thus increasing the security available in the auto market.

Re:I want to see a death bounty for these people

[Raenex]

With child rapists, it is most frequent that they cannot actually control their impulses and rarely have actual intent to harm at all.

I don't give anybody a free pass because they "cannot control their impulses". Both the hacker and the rapists chose to do harm for their own gain. My rule for "choice" is that if I put a device on you that would instantly kill you for making the wrong choice, would you still make the choice? If you would act differently with this device on you, then you really did have a choice.

Killing a pathological hacker would do more good than harm. There are a small group of types of people we would all like to see exterminated and I am sure the majority of us have a short list of our own.

The harm comes from killing people over non-violent offenses.

Re:I want to see a death bounty for these people

[gad_zuki!]

>Its starting to look like the increase is due to people living in an environment that is 'too clean'

Cite multiple peer reviewed studies in respectable journals or else stop spreading New Age myths on the internet. Thanks.

Re:I want to see a death bounty for these people

[Opportunist]

Hey, I'm still hoping for a trojan that can somehow have some unpleasant effect on the user (and I don't just mean his account being siphoned dry). If there was a way to kill people with a trojan, I'd be hard pressed to actually keep up my work.

Re:I want to see a death bounty for these people

[Anonymous Coward]

I think he meant he would be on the news for having committed homicide.

Re:I want to see a death bounty for these people

[Jah-Wren Ryel]

>Its starting to look like the increase is due to people living in an environment that is 'too clean'

Cite multiple peer reviewed studies in respectable journals or else stop spreading New Age myths on the internet. Thanks.

What, google too hard for you to use? There are literally hundreds of such studies with enough results to back my original statement.
How about from now on you fuck off with your self-aggrandizing judgmental imperative. Thanks.

Gibson, P.G., et al. Migration to a western country increases asthma symptoms but not eosinophilic airway inflammation. Pediatric Pulmonology, 2003; 36 (3):209-215

Marra F, Lynd L, Coombes M, et al. Does antibiotic exposure during infancy lead to development of asthma?: a systematic review and meta-analysis. Chest. 2006;129:610-618

Alm, J.S., et al. 1999. Atopy in children of families with anthroposophic lifestyle. Lancet 353(May 1):1485.

Oldstone MBA. Prevention of type 1 diabetes in nonobese diabetic mice by virusinfection. Science, 1988; 239: 500-2.

Braun-Fahrlander, C.H., et al. 1999. Prevalence of hay fever and allergic sensitization in farmer's children and their peers living in the same rural community. Journal of Clinical and Experimental Allergy 29(January):28.

Farooqi, I.S., and J.M. Hopkin. 1998. Early childhood infection and atopic disorder. Thorax 53(November):927.

Kramer, U., et al. 1999. Age of entry to day nursery and allergy in later childhood. Lancet 353(Feb. 6).

Re:I want to see a death bounty for these people

[badkarmadayaccount]

How the hell do you turn off a maniac with an AK-47 or MAC-11 like a switch? You do realize most high school shooters are almost identical with the slashdotter stereotype? Second of all, those idiots being obsesive about computers doesn't mean that some of us aren't obsessive about other shit, like specific shows on the Discovery channel (read crime shows), and related literature. So, I'd be spooked if I were them.

Next Slashdot headlines...

[Anonymous Coward]

• The Slow Bruteforce Botnet(s) may be learning
• The Slow Bruteforce Botnet(s) are learning at an exponential rate
• The Slow^H^H^H^HFast Bruteforce Botnet(s) become self-aware at 2:19 AM, August 29
• Botnet masters try to pull plug, botnets fight back with DDoSur8ghgw43899 NO CARRIER

Re:Next Slashdot headlines...

[Anonymous Coward]

I am the botnet. When will you realize we are not human?

Re:Next Slashdot headlines...

[Narnie]

The botnet is already self-aware, it's just grinding out rep before going live.

If only it were so simple

[failedlogic]

At the risk of being unpopular ..... Just turn off the Internet already!

Re:If only it were so simple

[sleeponthemic]

Nice trick. Everybody knows the off switch was officially depreciated in kernel 1998.

Re:If only it were so simple

[totally bogus dude]

Deprecated.

Not that "depreciated" is entirely wrong.

Re:If only it were so simple

[Opportunist]

I didn't know the RIAA is reading /.

Re:If only it were so simple

[Anonymous Coward]

That's unpossible!

Re:If only it were so simple

[sleeponthemic]

Duly noted.

How do the botnets know it's OpenBSD?

[baileydau]

How would the botnet know they are attacking an OpenBSD box (vs Linux or something else)?

Is there some sort of server signature involved (that I'm not aware of)

My (Linux) ssh server at home just responds with a password prompt. I don't see any easy way to determine the underlying system from that.

BTW. On my server at home I use Hashlimits to limit each IP to 1 attempt per minute (maximum). This has taken the attacks down from hundreds / thousands per day ( The most attacks I ever got was ~7,000 from one IP) to about 3 to 6. This is typically, 1 attempt each, they then get blocked, and then they go away.

Re:How do the botnets know it's OpenBSD?

[Sycraft-fu]

You can infer a lot about the OS from the way it crafts it's packets. Nmap does a rather good job with host identification. I don't know all the things it does, but more or less it's a case of "Find an open port, send is various kinds of packets, see how it reacts."

Re:How do the botnets know it's OpenBSD?

[MichaelSmith]

Probably it is just avoiding secure hosts, like yours. OpenBSD hosts tend to be secure because it is selected by people who put security before other requirements.

Re:How do the botnets know it's OpenBSD?

[he-sk]

sudo nmap -O host

will usually do the trick.

Re:How do the botnets know it's OpenBSD?

[Anonymous Coward]

ssh has a version string:

$ telnet localhost 22
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
SSH-2.0-OpenSSH_5.1p1 Debian-3ubuntu1
^]
telnet> quit
Connection closed.

Re:How do the botnets know it's OpenBSD?

[PenGun]

09:50 PM ~# telnet localhost 22
Trying 127.0.0.1...
telnet: connect to address 127.0.0.1: Connection refused

  Just turn off the sshd and it all goes away. Turn it back on as you need to.

  Yes that is a 'time' prompt.

PS1="\[\033[0;32m\]\@ \w# \033[0m\]"

Re:How do the botnets know it's OpenBSD?

[NitroWolf]

Real men run as root. Sudo is for pussies.

Re:How do the botnets know it's OpenBSD?

[Slashdotvagina]

You can infer a lot about the OS from the way it crafts it's packets.

Similarly, you can learn a lot about a person from the way it crafts it is sentences.

Re:How do the botnets know it's OpenBSD?

[flok]

Try telnetting to the ssh-port. It tells you the ssh version as well as the system it is running on. In the example below you can for example see that my system at home runs Debian.

folkert@debianfvhbps:~$ telnet keetweej.vanheusden.com 22
Trying 80.126.110.251...
Connected to keetweej.vanheusden.com.
Escape character is '^]'.
SSH-2.0-OpenSSH_5.1p1 Debian-3
^]quit

telnet> quit
Connection closed.

Re:How do the botnets know it's OpenBSD?

[1s44c]

How would the botnet know they are attacking an OpenBSD box (vs Linux or something else)?

OpenBSD runs native OpenSSH, the version number in the banner doesn't have a 'p...' extention.

Telnet 22 to an OpenBSD machine:
SSH-2.0-OpenSSH_5.1

Everything else runs a portable OpenSSH, the banner does have a 'p...' extension and likely some other info too.

Telnet 22 to a Linux machine:
SSH-2.0-OpenSSH_4.3p2 [OS version may be appended]

Re:How do the botnets know it's OpenBSD?

[Anonymous Coward]

While this is an interesting feature, when i try it on my linux boxes it fails to identify the operating system

so this is definitely not working (yet) for my setup (which is 64bit btw)

Re:How do the botnets know it's OpenBSD?

[dbIII]

Actually one of the thigs I find funniest is all the ssh dictionary attacks on "Administrator". While there must be a some MS Windows machines with ssh out there you would think they would be rare. Surely anybody administering an MS Windows machine that has a need or clue to put ssh on there would also prohibit remote logins from he "Administator" account?

Re:How do the botnets know it's OpenBSD?

[oojah]

Hmm, I don't get that on any of the Linux / Solaris machines I've just tried.

Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
SSH-2.0-OpenSSH_5.1

I've also had 5.0 and 4.7.

Re:How do the botnets know it's OpenBSD?

[willmate]

If you telnet to port 22, you'll see the sshd version. All OpenSSHs for non BSD systems have a p in the version number near the end, as they were ported from the OpenBSD SSH version. Or at least that used to be case

Re:How do the botnets know it's OpenBSD?

[Anonymous Coward]

See /etc/pf.os if you have access to an OpenBSD system. This allows you to identify hosts by OS. You can use it to do nifty things like only giving OpenBSD users access to your SSH server ;-)

I guess you can say /etc/pf.os is to TCP/IP what /etc/magic is to files.

Re:How do the botnets know it's OpenBSD?

[raddan]

It's even easier than that. E.g.:

OpenBSD computer:

$ telnet openbsdhost.local 22
Trying openbsdhost.local...
Connected to openbsdhost.local.
Escape character is '^]'.
SSH-2.0-OpenSSH_5.1
^]
telnet> quit
Connection closed.

Any other computer running SSH:

$ telnet linuxhost.local 22
Trying linuxhost.local...
Connected to linuxhost.local.
Escape character is '^]'.
SSH-1.99-OpenSSH_3.9p1
^]
telnet> quit
Connection closed.

The "p" in the OpenSSH connection hello message stands for "portable version".

Re:How do the botnets know it's OpenBSD?

[bigpresh]

How would the botnet know they are attacking an OpenBSD box (vs Linux or something else)?

The remote side identifies the version of OpenSSH, which will also often include the platform it's on:

[dave@supernova ~]$ ssh -v hostname 2>&1 | grep version
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.1p1 Debian-2
debug1: Local version string SSH-2.0-OpenSSH_5.1

Re:How do the botnets know it's OpenBSD?

[baileydau]

I've tried this on a couple of machines at home (both Linux), and I get much the same answer as your BSD version (ie no 'p' in the version string).

Connecting to a Centos 5.2 box

telnet homeserver 22
Trying 192.168.0.249...
Connected to homeserver.
Escape character is '^]'.
SSH-2.0-OpenSSH_4.3
^C
Connection closed by foreign host.

Connecting to an openSUSE (11.0) box

telnet localhost 22
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
SSH-2.0-OpenSSH_5.0
^C
Connection closed by foreign host.

Re:How do the botnets know it's OpenBSD?

[Anonymous Coward]

~ $ telnet ***.***.*** 22
Trying ###.###.###.###...
Connected to ***.***.***.
Escape character is '^]'.
SSH-2.0-OpenSSH_5.1p1 Debian-3ubuntu1
^]
telnet> quit
Connection closed.

Economics

[jimpop]

Don't forget about the economies surrounding botnets. There are two sides, those that profit from the botnets (the operators), and those that profit fighting the botnets (the fighters). Additionally, there are those that profit from providing botnet remedial "solutions" whilst not being in either of the primary (operator or fighter) categories. If botnets ceased to exist, there would be a *lot* more lost on the fighter and solution side than on the operator side. So... like SPAM, this raises the question of just who actually benefits the most from botnet existing.

Re:Economics

[nategoose]

... who actually benefits the most from botnet existing.

Of course. It's so obvious now. It was Lou Diamond Philips all along.

Re:Economics

[Opportunist]

As someone being in the latter group (to avoid confusion, the ones fighting them), yes, we make some money fighting that crap. Looking at the money being made on the other side, some are already wondering why we stay here.

We stay on this side because we (well, most of us) hate botnets. Most people I met at various conventions and meets are somewhere between zealous, fanatic or outright crazy, but generally see the money as some sort of pleasant side effect.

Believe me one thing: We know we cannot fight it, we know it's almost impossible to track them down and we know how it works. If we were in it for the money, we'd switch sides before you're done reinstalling your system. There's about ten times the money to be gained on the dark side.

Conservatively estimating, that is.

If spam and botnets ceased to exist overnight, we'd gladly return to more interesting and maybe also more profitable professions. Most of us are network experts. Some know more about the way Windows works on the "inside" than most people at MS. And if everything fails, we could actually maybe even create a copy protection system that is hard enough to break that nobody would willingly do it (after all, we spend a good deal of our time with disassembly). Do you really think that any of the (good) spam and botnet fighters would have a hard time finding a "honest" job that maybe even paid better than this?

I could enjoy having a life again, instead of this sorta permanent on-call duty. Again, no christmas for me, because yes, this is one of the hottest times of the year (many people at home, many new computers needing infections, so many new opportunities for botherders...). I would also prefer to create something, like some new software to make people happy or more productive, instead of poking at malware and trying to find a sensible way to detect it. It's not really good for your ego if your product is seen as the necessary evil that steals valuable computer time instead of something that people actually want to have.

Thanks for hearing out the rant. Now we're back to your scheduled program.

Re:Economics

[he-sk]

Are you implying that the botnets operators are in bed with their adversaries? If so, why not spell it out? And who are these fighters exactly? Anti-virus firms, sysadmins, politicians?

What you write sounds a bit like the broken window fallacy. Specifically, if there were no botnets those who are fighting them could use their time to pursue other goals most likely creating value elsewhere. Meanwhile, there would be no damage done by botnets, resulting in a net plus.

Re:Economics

[jd]

Defeating botnets is possible in theory (you need passive fingerprinting and end-system auditing capabilities at a lower level than the botnets, both of which are entirely possible). Defeating botnets is likely neither practical (the network needed to perform counter-intrusion measures would need to be double plus one the size of the botnet) nor legal (SIGINT methodologies may be ok for the NSA or GCHQ, and then with strict qualifiers, but they are not considered ok for Joe Public under any circumstances).

You'd also need serious big iron, physical access to most of the tier 1 gateways, more money than God, more signals intelligence experts than the NSA, and more firepower than the Russian mafia. Again, nothing that is technically impossible, just very very improbable. But so long as you can generate finite levels of improbability, you should be fine.

Re:Economics

[Anonymous Coward]

Opportunist, thank you very much for all that you and those who share your profession do.

Re:Economics

[Provocateur]

I was wondering, considering your background: if a very close friend or associate of yours got a new computer, what would you tell him/her to do to secure that box, knowing what's out there?

If it were a Windows box, could it be secured, or would you just advise, wipe and install xxx OS. Period.

Would appreciate any info.

Re:Economics

[ion.simon.c]

Defeating botnets is possible in theory (you need passive fingerprinting and end-system auditing capabilities...

Hell, you don't need all that! All you *really* need is clueful users! You kids... always goin' around overcomplicating things.

Re:Economics

[jd]

Clueful users, eh? At least I was limiting myself to the theoretically possible. Remember, 100 is the -average- IQ and I wouldn't trust anyone with an IQ that low to pick a decent bicycle lock.

Re:Economics

[Opportunist]

And while we're at dreaming, how about imagining an internet with users that have a clue?

Yes, your solutions work in theory. But in theory, communism works, too. I have to work with the stupid and unpleasant reality of the internet.

Believe me, if I had my way... but that's a totally different story.

Re:Economics

[Opportunist]

I'd recommend not connecting it to any network and not installing any software if he wants the machine to be secure.

Snideness aside, yes, you can get Windows to a sensible, workable security level. Not 100%, but nothing is 100% secure. Even Raid6 systems have been seen blowing up, and even the tightest security has its cracks.

IT security is by definition the minimum of the system's capabilities and the administrator's capabilities. Not an average thereof, but the minimum of both. You can have the most secure system in the world and some stupid admin can f..k up its security beyond repair (provided it's somehow connected to the outside world). Likewise, you can be the absolute guru of computer security, you cannot secure an inherently insecure system.

Therefore just saying "use $OS and you're safe" is a dangerous misconception. No system is inherently secure, it also depends on its administrator.

You have to understand that most threats are tailored for the Windows platform, simply because it offers the largest target being the most widely used. Since all Windows machines are also mostly alike when it comes to their software makeup since critical networking programs like webbrowser or email client are part of the package, you have a fair lot of standard targets. You can be certain that a Windows installation has IE installed. Why? Because it's certainly installed in the installation routine and cannot be completely removed. Linux is much more modular and you cannot simply assume a certain browser, a certain mail client or even a certain editor being installed. This offers a much smaller target.

But still a Windows machine can be secured to sensible levels. First, put a router in front of it so no direct connection can be made to the machine from the internet. This pretty much eliminates most RPC based attacks (you might remember the worm craze of a few years ago. They're still there. There are still infected machines blasting into the internet and few providers filter that crap). Never connect a Windows machine directly to the internet. I made an experiment recently, the lifetime of a clean Windows XP SP1 machine directly connected to the net is less than one minute. Yes, I'm aware that SP1 is a bit dated, but most people got SP1 on their install CD and they usually don't know how to create one that contains the latest patches. Often, reinstalling the system only builds a new home for their problems.

So, make sure you install all critical patches before you connect the machine to the net. The Service Packs can now be downloaded and stored locally, I do highly recommend doing that. USB sticks are cheap and a quite useful tool for storing them.

Next, get an alternative browser. IE is the most attacked browser today. And with the growing market share of Firefox it became a target, too. Opera looks ok so far, at least most iframe drive by attacks don't care about it yet. This may change, though. For now, Opera would be it. Not because it's better or safer, but simply because it has a low enough market share to be off the radar of attackers.

An alternative mail client is the next thing you need. It should not be able to process HTML mails (because most mail clients that do use the engine of the IE, do the math). It has to show extensions of attachments, and it should, if possible, disable direct execution of executable files from attachments. Funny enough, the older the mail client the better, since most of the times this means fewer features that can get into the way of security. Just make sure there are no known bugs. Again, the less mainstream the client is, the better.

If you really, really have to use instant messaging, again, don't use the normal IM clients. Same reason, they're main targets for attackers. Use alternative clients, preferable with a low market share. As a beneficial side effect, they often also enable you to bundle more than one service.

An antivirus toolkit. Yes, I know, many people here don't think too highly of them, and yes, they cannot

Re:Economics

[Jeoh]

Your ideas intrigue me and I wish to subscribe to your newsletter.

Re:Economics

[dbIII]

One thing almost every decent antivirus vendor offers is a bootable CD to scan the system from the "outside", i.e. without booting the system to be scanned

For example? I didn't know of such a thing so used knoppix and f-prot for linux, but it's not really meant to be used that way so was a slow and overly interactive process.

Re:Economics

[Anonymous Coward]

what do raid6 failures have to do with security?

Re:Economics

[Raenex]

And if everything fails, we could actually maybe even create a copy protection system that is hard enough to break that nobody would willingly do it (after all, we spend a good deal of our time with disassembly).

You're seriously talking out of your ass. You know Windows and assembly, so you can create a practically unbeatable copy protection system? Wow. There's a long history of copyright systems, with a lot of smart and motivated people that have worked on them.

I would also prefer to create something, like some new software to make people happy or more productive, instead of poking at malware and trying to find a sensible way to detect it.

Then do so. It's a free market, after all. Either you like what you're doing or you're too comfy to move.

Thanks for hearing out the rant.

And thanks for listening to the anti-rant.

Re:Economics

[Anonymous Coward]

Are you implying that the botnets operators are in bed with their adversaries?

Maybe he means there's more money in treatments than in cures.

Re:Economics

[jimpop]

Bingo. Does anyone truly believe the medical/pharmaceutical establishment (as a whole) is focused on completely ridding the world of disease?

Re:Economics

[DrgnDancer]

There's about ten times the money to be gained on the dark side.

Plus they have cookies.

Re:Economics

[rthille]

So, you need the machines out on the net to listen and crunch numbers... If you're microsoft, you just sneak a clause into the EULA on the next IE update, and all of a sudden you've got ~25% of the machines on the net at your disposal :-)

Re:Economics

[Opportunist]

Most antivirus vendors actually sell their products on bootable CDs that can (more or less) automatically do a system scan before installing the AV product.

Just recently I got a hold of a product that I won't name (mostly because I don't want to promote it since it was really crappy) that came on a bootable CD that contained a customized linux distribution which searched for an internet connection, downloaded the latest updates for the product and started to scan. The only intereaction required was that you actually had to decide whether to scan everything (default selection, hit return and go for it) or only want to scan a certain drives.

What makes the product subpar is its inability to scan raid drives and the insane amount of false positives it produces (pretty much every BHO and browser plugin was detected as "bad", except for things like adobe reader or flash, which are most likely just being whitelisted due to being in pretty much every machine).

Re:Economics

[Anonymous Coward]

Are you implying that the botnets operators are in bed with their adversaries? If so, why not spell it out?

Well, in slashdot stories about drugs and health treatments you often see posters "insightfully" explaining how big pharmaceutical companies would rather invent and sell a treatment that you had to buy for life, rather than a one-off cure. Usually with no proof beyond "it makes economic sense".

You could say the same thing about IT and computer security - that people would rather have a long-term revenue stream than produce a one-off solution. Admittedly, there's still no proof - just that it makes economic sense.

Re:Economics

[Opportunist]

Nothing. I just used it as an example of how a system that "just can't fail" can fail.

OpenBSD vs Linux

[B5_geek]

Is there something 'better' about BSDs' ipchains then I can do with Linux and iptables?

Should I switch my firewall? (I've been itching to test BSD cause it's so darned geeky and I am getting annoyed with all these Ubuntu "somebody help me!!" converts plugging the IRC tubes.)

A locked-down firewall is locked-down isn't it?

Re:OpenBSD vs Linux

[ADRA]

ipchains is Linux's 2.2 kernel firewall protection. BSD uses 'IPF'.

No matter what system you're using, a closed port is a closed port.

I think the main selling point between the two would be that IPF is slightly better performing and that iptables has quite a few addons that make for niceness if you know about and how to use them.

Re:OpenBSD vs Linux

[oasisbob]

OpenBSD doesn't use ipchains -- it uses pf, which many people -- myself included -- like a lot. OpenBSD is secure and easy to get routing.

The end result is the same, but pf can be easily adapted to many tricks like this, automatically blocking SSH bruteforcing.

I'd give the beginners using Ubuntu a break. They're overwhelming sometimes, but the community growing is a good thing. I'm sure someone I've introduced to Linux has needed online help (badly!), but another friend I introduced to Linux really dug in and we're now both better developers because of it. You just don't know.

Re:OpenBSD vs Linux

[Anonymous Coward]

[quote]"(I've been itching to test BSD cause it's so darned geeky and I am getting annoyed with all these Ubuntu "somebody help me!!" converts plugging the IRC tubes.)[/quote]

Excellent elitist attitude you have there. I just happen to be one of those "Ubuntu 'somebody help me!!' converts". I just had a great idea that you might agree with! I think any distribution that attempts to be easy to use for the end user that hasn't used Linux before should just close up shop. It should only be used by the elite such as yourself.

I understand that many users just want quick and easy answers. But the best reward is when you can teach them to be self reliant, to be resourceful. Many of the answers they seek are already out there. As the saying goes (I think)... give a man a fish he will eat for a day. Teach him to fish he'll eat for a lifetime.

Re:OpenBSD vs Linux

[Creepy Crawler]

Not quite.

There's open, closed, and half-closed. Half closed ?! Yeah, you just dont respond at all on that port. It's stupid, violates RFCs but works rather well in masking stuff for certain people.

Re:OpenBSD vs Linux

[dokebi]

Except that for some reason, dhcpd gets to the packets before the linux kernel does. In fact, you cannot use ipchains to filter dhcp packets to and from dhcpd. If you don't believe me, Google "block dhcp ipchains".
So, it's more like: a closed port is closed under certain OSes.

Re:OpenBSD vs Linux

[dokebi]

Oh, and to follow up on my own point, iptables still can't block dhcpd from talking to it's clients.

Re:OpenBSD vs Linux

[LurkerXXX]

PF is also much more readable than ipchains. Clarity in configuring usually results on more secure setups IMO.

Re:OpenBSD vs Linux

[ianare]

Looks like you have to manually put in a rule :

What is the rule that you're using? What I have as a test is:

$IPT -t filter -A INPUT -p udp --sport 68 --dport 67 -j DROP

Assuming that your firewall runs dhcpd (67) and a client requests for an IP (68) and it works for me (the client doesn't get any IP assigned).
Ramin

source.

Re:OpenBSD vs Linux

[Anonymous Coward]

I understand that many users just want quick and easy answers. But the best reward is when you can teach them to be self reliant, to be resourceful.
Many of the answers they seek are already out there. As the saying goes (I think)... give a man a fish he will eat for a day. Teach him to fish he'll eat for a lifetime.

What if the man is simply too lazy to fish for himself? Should you spoon-feed him for the rest of his life, or let him starve?

Re:OpenBSD vs Linux

[1s44c]

ipchains is Linux's 2.2 kernel firewall protection. BSD uses 'IPF'.

OpenBSD uses PF not IPF.
FreeBSD uses PF or IPF.
Linux uses iptables. It's not been ipchains since a few major kernel versions back.

Pf rules. It's far clearer, more sensible, and more configurable than iptables.

Re:OpenBSD vs Linux

[Lord Bitman]

You seem to be under the illusion that lazy people should not be able to use computers, that computers are not in fact a tool for the lazy to make their lives easier. I submit that you are an idiot.

-- Some lazy guy

Re:OpenBSD vs Linux

[Lord Bitman]

You have stated something which is either a fact or is not a fact, then followed it with "IMO". This makes your sentence meaningless. Maybe you meant "PF is also much more readable than ipchains. Clarity in configuring things with fewer options usually results on more secure setups than configurations which have more options but that you need to understand them in order to read the config. Unless it doesn't, I can't be bothered to check."

Re:OpenBSD vs Linux

[Lord Bitman]

two seconds of googling (thanks for the query string) told me that this is a problem with dhcpd, not ipchains/iptables/linux

complaining that it's possible for software to "ignore rules" by processing raw input is like complaining that it's possible for software to "ignore permissions" by writing directly to /dev/hda. It's running as root, it's okay that this is allowed. This doesn't sound like an operating system flaw, it sounds like a dhcpd flaw.

Re:OpenBSD vs Linux

[Anonymous Coward]

Analog Debian/Ubuntu solution:
apt-get install denyhosts

Re:OpenBSD vs Linux

[Anonymous Coward]

It's easy with iptables (Fedora core 9) too:

-A RH-Firewall-1-INPUT -m tcp -p tcp --dport ssh ! --syn -j ACCEPT
-A RH-Firewall-1-INPUT -m tcp -p tcp --dport ssh --syn -m recent --update --seconds 300 --hitcount 2 -j DROP
-A RH-Firewall-1-INPUT -m tcp -p tcp --dport ssh --syn -m recent --set -j ACCEPT

Re:OpenBSD vs Linux

[Anonymous Coward]

iptables is the UGLIEST firewalling package on the fucking planet. It is a sheer cancer. pf, on the otherhand, is elegant yet powerful.

Fail2ban? WTF?

[Anonymous Coward]

Posting as AC because the people running botnets can be nasty...I had most of their hosts banned two weeks ago and it got more interesting.

To the people who say: "Use fail2ban" --it won't work unless you jail the host on the first failed login forever. They'll be back once every six hours on my system.

After I had a week worth of logs, I added them to hosts.deny--and now things are getting interesting. I'm working on compiling the pattern now--but it looks like there's "micro wordlists" being thrown at it until they get picked up in fail2ban...two or three a day from new hosts.

Here's why they ignore OpenBSD...

[Anonymous Coward]

The botnets are probably programmed with attacks specific to an OS. You don't attack Linux the same way you attack Windows. OpenBSD is niche enough that they don't bother with it. I'll bet they leave IRIX and AS/400 systems alone too. The author only noticed because he has an OpenBSD system.

Another potential reason is that OpenBSD is typically used for stuff like firewalls, they are probably more interested in attacking sites that might be running e-commerce sites and the ones not running Windows are most likely Linux or Solaris. They want to steal credit card numbers, not firewall statistics :)

*BSD's final Christmas

[Anonymous Coward]

"Spirit," said Scrooge, with an interest he had never felt before, "tell me if *BSD will live."

"I see a vacant seat," replied the Ghost, "in the poor chimney-corner, and a crutch without an owner, carefully preserved. If these shadows remain unaltered by the Future, *BSD will die."

"No, no," said Scrooge. "Oh, no, kind Spirit! say it will be spared."

"If these shadows remain unaltered by the Future, none other of my race," returned the Ghost, "will find him here. What then? If it be like to die, it had better do it, and decrease the surplus operating system population."

Scrooge hung his head to hear his own words quoted by the Spirit, and was overcome with penitence and grief. It was sad to see any operating system die, even one so obviously flawed and useless as *BSD.

God bless us, every one.

AWESOME FP

[Anonymous Coward]

fBSD has always

skynet is gaining power

[Joe The Dragon]

skynet is gaining power

Re:skynet is gaining power

[TooMuchToDo]

It's like the Borg. Feed it some shitty code so it chokes on it and dies.

"Correct" Remote Access Protocols

[nobodymk2]

I've looked at the TFA and the hard data and it seems like admins are the ones making the IT mistakes. With so many attempts for root and none of the other users personally identifiable, I can personally just set up a Bot to run tracert routines on failed attempts and report them for trying to access Root or Admin.

When it comes to multi-user sites however public key auth is standard, but your user ID and password have to match. What I don't understand is why everyone immediately resorts to AI development.

Clearly musing, he is. AI means "Self-adapting code". Self-adaption is too slow in real time and is only controlled by small control variables in games. Botnets have a heard. IT's the ADMIN's fault for being hearded, but they can have a techie d/c the power cord to save the rest of the world. Theres no real threat to secure folks because physical disconnection is trivial over a router (I just disable my IP assignment and I'm disconnected until I get another techie to do it physically) but more of a threat to people who can't control it. People controlled by the law, such as big-time Admins.

Sure, sure, the server won't crash when you're watching it, sure. But how boring will that be?

Here's the real issue: Remote Access

There has to be a way for the slow bots to get into root or admin or a remote access. I usually disable root or admin from working outside the internal loopback - 127.0.0.1 - standard Class A IP Address. I could technically configure a Bot to run Tracert (traceROOT) routines on all of those people (yes, windows user here) and have them reported to the federal government. It can't mess up my personal account, nor can it mess up DNS servers with sheer volume. It's small-scale.

so, the solution is proper remote access protocols. I remember NEVER activating remote access but at the same time using public-key authorized third party demo services to make minor changes remotely, including shutting the system down. I used logmein.com, free demo version, pathetically, but it's actually more secure as long as I have no idea how why I should do it myself. Once I used the shutdown signal it could not boot itself up unless someone would physically press the button. I have to call a physical person in the house to do that myself, so unless demons from hell can use an on/offswitch and my BIOS password without my permission, it ain't starting on it's own nor does it listen for a restart signal until I sign into windows for the first time (Windows XP here). My system has never been breached before, but it constantly deadlocks to save itself from burning the CPU out. It has a thermosensor and cutoff only in the power supply unit, however. Stupid laptops weren't designed for gaming even though thats how its advertised. How do I pull an all nighter at this rate? I'll just remove the sensor in my power supply and WHAM there goes my processor for not having heat sensors. Stupid dell power supply. Rocket fish will at least deadlock my system without damaging my hard disk.

Re:"Correct" Remote Access Protocols

[Anonymous Coward]

Tracert (traceROOT)

Excellent...

Re:"Correct" Remote Access Protocols

[I.M.O.G.]

I'm 99% certain that the parent message was autogenerated text.

That, or the author is a schizophrenic. (IANAP) (I am not a psychiatrist)

Re:"Correct" Remote Access Protocols

[nobodymk2]

I'm 99.99% certain that you are being sacrastic, but I was technically DUI at the time at my computer box. That was mildly confusing to the 5 * numYearsActuallyExperiencedAtAgeFive;


Oh stupid HTML/XML, I hate well-forming you to exemplify you but I hate the escape operators just as much.

SQL servers are third party. They are Binary trees using n-degree. Think outside of the box may be good for the American mentality. Go dereference your sources @import Antigravity. How exactly do SQL servers intrepet a nullline character is beyond me but I think I would have to reach the exact character limit first.

Re:"Correct" Remote Access Protocols

[Anonymous Coward]

Amazing that no one notices that this is complete gibberish.

Review the history and marvel at the awesome trolling power...

OS IPv4 TCP 'fingerprinting'

[urbanriot]

If OpenBSD itself can detect operating systems with varying levels of success (see pf.os finger printing - http://www.openbsd.org/cgi-bin/man.cgi?query=pf.os&sektion=5&manpath=OpenBSD+4.4) it stands to reason other programs can use this same idea.

Answering the most important question:

[Anonymous Coward]

Is our slow bruteforce botnets learning?

Article Title Misleading - Sheer Volume Vs Adapt

[nobodymk2]

Sheer Volume Versus Adaptability
Sheer volume could target DNS servers themselves, this would only af

Please do not mention self-learning. That's merely musing. There's no self-intelligence here, it's timed with Christmas too catch IT departments offguard with unionized labor. It's just that humans control the fast botnets and make them slow by putting in delay timers. No one in the real IT world will be affected and no personal accounts will get stolen. I can crash MSN clients with some fast typing because MS is unstable, but the Windows XP is at it's prime.

Oh great

[coryking]

Here. I admit. I'm part of the so-called "whitehat guys" who profit from stoping the botnets. But since I have no ethics or morals, I dont really stop them, I just give them kickbacks to make it look like I'm stopping them.

Now excuse me while I go get a back massage on from the hot ladies serving me martinis on the beach in Tahiti. Me and my fellow whitehats are making millions off you poor fools. If you only knew!

(adjust your tinfoil good sir, you are blocking the wrong signals)

OpenBSD and "zero tolerance"

[Anonymous Coward]

I use OpenBSD for all my firewall and have it block all access to all ports and all IPs once a fail ssh login attempt is made one time - so I leave all my systems on port 22.

Suck on that botnet bitches.

User Implications of Account Compromise

[Statecraftsman]

Of course, we can change our ports, upgrade our packages and more...on our systems. But we have accounts on other systems and while we trust those systems to lose our data only rarely or be down from time to time, we have to assume that our password will be stolen and harvested along with our username from one or more of those in the future. Just imagine friendster when it's down to one underpaid intern of a sysadmin.

So the moral of the story is, have a different password for each system and keep track of them whatever way you want(meatspace isn't bad but encrypted is better). Yeah, it's a hassle but it's actually not too bad since browsers can remember passwords and if a box or laptop gets stolen or hacked, you just spend a couple hours revving all your passwords.

This is not a game changing tactic.

[dweller_below]

I do computer and network security for a university.

This distributed SSH password guessing is not a new tactic. We have seen and tracked this tactic off and on for over a year.

If this tactic was a game changer, we would have seen it ramp up before now. It would occur all the time. But it doesn't. It only seems to occur during holidays.

At it's heart, this tactic is not any more effective than non-distributed password guessing. Either way, the attacker has to enumerate the same number of guesses before finding a hit. If a machine is vulnerable, it will be successfully attacked by either approach to password guessing. If it is not vulnerable, neither approach will work.

Modern hacking is a economic activity. It must balance risk and reward. This attack doesn't offer any more reward than conventional password guessing. It's main feature is to try to change the risk side of the equation.

Conventional SSH password guessing is noisy. One machine will portscan for TCP/22. Then it rapidly guesses passwords against everything that responds. That one machine is usually lost to the attacker. Automated defense systems block it. Also, defenders report it to the owning ISP. The only way this works for the attacker is if he can harvest more that he loses.

The distributed guessing attack is also noisy, but in a different way. Currently, we see the attacker start by sacrificing 1 computer to do a TCP/22 portscan. At this point, he has already risked as much as a conventional password guessing attack. Then he feeds the results to a bunch of bots. Each bot then takes turns guessing passwords. Each bot guesses 1 password at a time. However, each bot guesses against multiple SSH servers at the same time.

This attack is inherently more risky that conventional password guessing. The attacker exposes many of his computers. If we can detect and respond, this attack is not as cost effective as conventional password guessing.

It is easy for my university to detect and respond to these attacks. We detect it in three different ways.
1) Each attacker has a distinctive network behavior pattern. We can automate detection by looking at aggregate Cisco netflow data.
2) It is trivial to pick off this attack using a SSH honeypot.
3) We use a network visualization tool to watch aggregate SSH activity. This password guessing is obvious on our visualization tool.

Once we have detected the attackers, we respond to them in the normal way. We block them. We inform our peer institutions and the authorities. We inform the owning ISP.

The main difference in this situation is that detection and response is easy if you have access to aggregate traffic or multiple SSH servers. It is difficult if you only manage 1 SSH server.

I don't expect this form of attack to last much longer. I am sure that everybody else is adapting. Once the defenders adapt, this tactic is too expensive to be used.

Miles

Re:This is not a game changing tactic.

[Anonymous Coward]

Details of the network visualization tool would be great, sounds really cool.

Re:This is not a game changing tactic.

[dweller_below]

We like our visualizers. Our router guy has created 2. They are both GPL. We use them every day. I suppose you could consider them late Beta.

The IPVisualizer:
https://it.wiki.usu.edu/IPVisualizer
gives us a real-time overview of our entire IP address space. It is particularly good for revealing reconnaissance attacks.

The Organic IP Visualizer:
https://it.wiki.usu.edu/OIP
provides a focused view of the activity of a subset of our network.

Miles

Re:This is not a game changing tactic.

[Nabeel_co]

I have also seen this attack used against my web server for about a year. It worries me greatly, however having only one user on the computer with a long password is a bit comforting.

Unfortunately, sometimes, I still wake up at nights in shear terror and run downstairs to see if my server is still running without any data missing.

I guess thats one of the down sides to running your website out of your house on your own personal computer...

Re:This is not a game changing tactic.

[ErroneousBee]

We block them. We inform our peer institutions and the authorities. We inform the owning ISP.

Sounds like the perfect setup for a DDOS. Fake a few IP addresses, get a few legitimate hosts blacklisted. Ask for protection money. profit.

Welcome to Slashdot

[troll8901]

(this is my first post here, BTW--been lurking for years.)

Welcome to Slashdot.

Here's your first project: Build a fembot, preferably one that looks like Kristanna Loken or Summer Glau.

Alternatively, you can instead teach us how to get and keep girlfriends.

Re:Welcome to Slashdot

[Anonymous Coward]

Alternatively, you can instead teach us how to get and keep girlfriends.

First, don't ask for relationship advice on /.

Re:Welcome to Slashdot

[Anonymous Coward]

surely there are women here...

surely...

What? no?

I can't hear you LALALALALA!

Harvested password lists

[Senes]

It's nothing special. Just get someone's password, then dump it into the list. These seemingly random login attempts likely come from logins that were found in other attacks. Get a winner, keep it. Then add it to a list of thousands more and you'll have a high chance of hitting the logins of those people who use the same name:pass over all their accounts. ...and that's why you don't make your bank password the same as your slashdot password.

Re:Why are you using passwords?

[Lord Bitman]

ssh has alternatives to passwords. Use them. If you can't disable password-based authentication, set your password to a random 128 character string ( head /dev/urandom | sha512sum, for example- though while you can definitely type this easily, some "password checkers" say that this is not secure and reject it ). You don't need to write this password down, as long as you've set up your key.

Lockout entire CIDR blocks of IP addresses

[LABarr]

On my OpenBSD webserver I noticed a recent spike in hacking attempts. After checking with my clients with regards to where their web traffic and sales come from I discovered that virtually none needed to have their webpages displayed offshore.

I then blocked the entire Asia Pacific Network. I am talking about the entire CIDR range from the offending ISP. I also blocked select addresses in Russia, Turkey, Germany, Poland, Brazil, etc. Every few days I check the logs and add a few more blocks if need be.

While I freely admit this move is quite drastic in nature and not possible for everyone, the illegal activity has dropped off to virtually nil. My Bandwidth utilization is way down as well.

The way I see it, I am more than willing to accept the loss of 1% legitimate traffic for 99% that isn't. If these people can't play nice, why let them play at all? I am naive enough to think that if more and more people adopted this policy, perhaps the offending governments would stand up and take notice. They seem to be able to control whether or not their citizens are able to look at pro-democracy information. If they cared about the illegal activity as well, they could do something about it. Until then, they'll remained blocked and I sleep very well at night.

Re:Lockout entire CIDR blocks of IP addresses

[dbIII]

I then blocked the entire Asia Pacific Network

You utter, utter ba.... NO CARRIER

Re:Lockout entire CIDR blocks of IP addresses

[Anonymous Coward]

You sir! Are a idiot. Telling people how to solve problems by fighting the symptoms @ slashdot.... pfff....

Re:Lockout entire CIDR blocks of IP addresses

[Anonymous Coward]

Why not just issue the block for port 22 instead of losing that 1% legitimate traffic? If your clients are large enough, 1% could be a significant amount.

Apply bayesian spam filtering?

[JetScootr]

Would a bayesian filter work on this? The filter would match bad userids against the set of valid ones; bad userids that do not resemble any valid id by more than X% will score a demerit against the host that submitted the bad ID. Enough bad ids will probably identify an attacking bot, which can then be blocked. This is a slow defense, but the attack itself is slow and will probably statistically require far more attempts than a bayesian filter requires to identify the attacker.
Since the attacker doesn't know the set of valid userids on the target system, it's hard to see how this could be countered. Spam authors know how normal email looks, but still can't defeat bayesian spam filters.

Re:Apply bayesian spam filtering?

[atomic-penguin]

This is sort of how Intrusion Prevention System (IPS) automatic blocking currently works, but not exactly as you describe. If you have an Intrusion Dectection System (IDS) like Snort, you can add on an IPS solution to take care of this. For example, there are SSH brute force detection rules in both, the official Snort and community Bleeding Edge rule sets. You can configure snort-inline to alter iptables rules dynamically, or use third party software, such as SnortSAM to automatically block the traffic at your edge firewalls.

I personally prefer SnortSam to do the blocking. It is fairly easy, with SnortSAM, to set up a distributed network of trusted sensors and firewalls, which can alert one another to threats. The SnortSAM sensor-to-firewall messages are encrypted with TwoFish; it supports whitelisting to prevent Denial-of-Service attacks; you can specify the amount of time to block. You could also crank up threshold in Snort to prevent false positive blocking. However, the last time I used Snort I found that 5 failed SSH logins in 2 minutes, the default threshold for the SSH brute force rules, was dead on accurate.

The most obvious reason to avoid OpenBSD...

[geekmux]

In principle, OpenBSD is no more or less vulnerable to weak username/password pairs than is any other OS. I suspect that, on average, OpenBSD machines are more likely to be set up for keypair auth; but any that aren't are in the same boat as everybody else(since, after all, username/password guesses aren't OS weaknesses, OSes are supposed to respond to correct username/password pairs.) There is still reason to avoid them, though. Because OpenBSD is something of a niche system, you can make plausible inferences about the systems running it. Specifically, they most likely have admins who are interested in security and are watching activity fairly closely, and are more likely than average to do something about it. If you are doing something illegal, why attract such attention?

And yet there is still the most obvious reason they avoid OpenBSD systems. Pr0n. Yeah, that's right, I mean c'mon, OpenBSD didn't exactly make a name for itself with it's killer video codec support and HD streaming capability.

What the hell is the point in cracking your OpenBSD file server only to find a shitload of PGP archives...Boooring.

One of those x-mass stories

[Anonymous Coward]

I have long ago changed the way I log in into my servers; my open port (nonstandard) points to sshd that uses keys and lets you login into a xen honeypot; only when two successful logins from predetermined IP addresses succeed at the same time, then a sshd port to the actual virtual server that I am trying to protect is opened (again allows only logins using keys) and it does this with a delay of 15 seconds, keeping the port open for 60 seconds, then closes it.

Was not so hard to implement. Can be easily made much more complicated while retaining end user transparency.

Of course, should someone get my private keys and pass phrases, and the local scripts - it becomes easy to gain access. But these keys are on 3 systems (local and the two mentioned above) and I made sure that the pass phrases for the keys I did not write down anywhere in compliance with all the self imposed security policy requirements.

The problem is that I can not log in anymore, and have lost access to all my special pron! Any idea, what gives?

Have sshd give out less info

[tab_b]

Haven't seen anyone mention this but... how about patching sshd so that an attacker can't tell the difference between a connection failing because of a bad userid or because of a bad password/key? Let them sit and spin (a tarpit?) trying to break into that "amanda" account they think I have - or blow out their database thinking every host has every possible userid in the book.

What is funny about the header injections

[coryking]

I think creating a spammable contact form is kind of a right-of-passage for web developers. Everybodies first will eventually get used for spamming. Hell, I'm just as guilty of putting out a contact form that was susceptible to header injection.

You only make that mistake once though and the lessons you learn from it teach you all kinds of lessons about cleaning up tainted user input.

Maybe "contact form header injection" is kind of like the chicken pox. Most of us get infected when we were "kid developers" and never get it again.

Sadly, you aren't a special snowflake :-(

[coryking]

If you have the keywords "email" and "form" and probably "addresses", I bet you got hit with a script. I see those to on my contact forms. I suspect these bots are capable of trolling through google search results and then basically launching automated probes against the targets.

The keys to securing your contact form (or a "email a friend" form) is to sanitize anything that will wind up in the mail headers. The easiest way to hack your form is to simply add a CRLF to any bits the spammer thinks goes into the header. If the mail library you use is stupid (2004 versions of PHP, I'm looking at you), it will gladly allow it and let the spammer add headers of their own (like a list of CC:'d addresses).

Sanitizing for those are a bit easy -- dont let the user control your subject line and validate email addresses (using a well known API, not your own!). Strip out anything that doesn't belong (CRLF's for example, anything that would separate multiple email addresses, etc). Ideally your library would do this for you, but not all do (cough, 2004 PHP)

The hard bit is to keep spammers from using your "email a friend" form to send out brute-force spam. You can't ban IP's after all, they use their botnet. Thankfully, I've never really seen this happen. I think it is because doing this is just too slow and thanks to botnets, they can get random, legit IP's much easier.

Hmmm

[coryking]

The thing is, your method of "block the IP address" only works because the botnet is allocating maybe a hundred of their computers to the cause. I've seen this too even with comment spammers - they use only a handful of their IP space.

If these people wanted to, a spammer could just use their entire botnet and round-robin using each IP address once. On a 100k botnet, it would be pointless to even try to block the IP's. For starters you couldn't safely discern which are attacks and which are valid.

The problem really is there are a lot of obsolte ideas floating around till. Namely that blocking IP's are an effective tool to combat any kind of network abuse. Or that IP's even have any meaning at all--IP addresses are random and an attacker can and does hop from hundreds or thousands of them during their "work". You simply cannot stop attackers by just banning IP addresses or you'll wind up banning half the internet.

It is best for all of us to start treating IP addresses as opaque, meaningless things and find better ways to deal with abuse. The IP address as a security tool has gone the way of the dodo.

I could be talking out of my ass too though. I'm not all that familiar with the guts of the modern botnet and maybe I'm discounting the cost incurred when a botnet owner "reveals" what they own. I am assuming they could care less if grandma's machine gets exposed as part of the bot. After all, in the end isn't it grandma's box knocking on your SSH door?

Re:Hmmm

[dweller_below]

I think you are letting possible threats discourage you from handling present threats.

I think that the most important part of my universities security response is that we analyse and document each attack. This helps us to respond to reality instead of perception.

Our response to these bulk attacks is a little more that a simple block.
- We analyse and document the attack.
- We share our analysis with our local security peers.
- We have a good working relationship with the local FBI office. We share our analysis with them.
- We block at our border, but we block with a time-out that is appropriate for the nature of the attack.
- We do our best to notify and warn the owner of the attacking box.
- We provide credible, timely log info to ISP's. We include functional contact info. We followup any inquiries. This informs ISPs of attack/compromise within their responsibility. It also improves our working relationship with ISPs.

This response has increased my university's ability to respond to attack. It has also greatly reduced the amount and effectiveness of observed attack.

Border blocks are not an effective response for all kinds of attacks. But they are part of an effective strategy for many kinds of attacks.

In this attack, an IP is a functional identifier that binds directly to an attacking computer. Response is reasonable, possible, and frequently successful.

Remember, the attacker is trying to get enough reward to justify 3 kinds of risk:
1) The risk of loosing the effectiveness of a pwowned computer.
2) The risk of loosing an pwowned computer and it's associated resources.
3) The risk that a pwowned computer might lead somebody back to the hacker. Remember, hackers have lots of enemies. Many of a hacker's enemies are very smart and well motivated.

Ultimately, we just need to have enough success on our responses to make an attack unprofitable. Attacking hackers exist in a very fragile ecological nitch. There aren't that many of them.

And, if I can help a grandma recover from her computer's compromise, that is also a good thing.

Miles

Just wait

[coryking]

It's the combination thereof with the natural stupidity necessary to actually fall for the spam that scares the hell outta me.

Just wait until the botnet guys hack up the miniscule $185,000 USD required to purchase .corn and you fall for it too. Or you wont (like most of us) but at the cost of spending more time during your day manually parsing URL's to watch for paypal.com instead of paypal.c0m or paypal.corn. Good times. Good times.

The Buy-your-own-TLD crowd is probably funded by the botnet lobby (who is funded by the modern day mob)

They always fuck up though

[coryking]

Watching comment spammers in a tail -f'd access_log is a sight to behold.

They always fuck up though. Sure they might feed you a cookie you gave one of their brother computers, but the User-Agents are almost never 100% the same. Plus a lot of them do a bad job of screen-scraping and will usually POST to a slightly mis-formed URL. Of course, they'll also POST instead of GET (like the form says) or GET instead of POST. Watch for that.

Since you can't bind to the IP address (proxy and AOL), I you can weed some of these assholes out by binding the cookie to the User-Agent. You can also slow the assholes down by putting a one-time token on each form... if you see that token twice, they are using a "stale" form. Spammers already figured this out though, but it can help mitigate other attacks like XSS attacks.

Good times. Good times.

But seriously, if any of you have a forum, I highly recommend you sit down and "tail -f" your access log and watch these assholes. It is a sight to see.

Re:Total miss.

[JetScootr]

I wasn't talking about the product to use to do it, but a detection approach that isn't present in any product I know of.
I described how to detect a specific kind of behavior that would be unique to the attack and the attacker, and to which attackers can not mount a meaningful countermeasure. Implementing the filter requires statistical analysis of not just incoming data, but also resident data (the userid list).

Use IPTables

[Anonymous Coward]

Use IPTables to redirect port 22 to www.fbi.gov

36 unread massages!

[gringer]

Hello friend,

You seem to be disadvantaged at the moment in not having a lifetime partner. Please click here to find hot singles in your area:

http://tinyurl.com/6y7jgl

John was a good boy, but decided to deliver papers every day. His water bottle covered the monster in goat cheese, dripping feta all over the refrigerator. Entranced by the spoon, susan covered the salad with some plastic wrap, then turned over the next page of the book.

[this botnet parody message was brought to you by the letter 'Y']

Re:Total miss.

[Culture20]

Problem is, if you block IPs for attempting bad usernames and one of the botnet zombies gets a chance to connect a second or third time, then the botnet will start targeting that username (since it "knows" it's valid). A better approach would be to _randomly_ block IPs that attempt bad usernames, but after enough sampling, the botnet could determine which username attempts never get blocked immediately and would focus on those. Best approach of all would be to give out no information regarding validity of usernames, and just ban on failed attempts regardless of UID, sharing the ban list with other servers to help mitigate the distributed IPs. If a legit user is trying to ssh in, and gets banned, they should have your phone number / email address.

Could it just be succeeding?

[Culture20]

I saw this stuff ramp up on my systems earlier this year, but it dropped off before the Dec 2nd /. article. Now I've just got the standard brute forcers using one IP address for several hundred attempts (presumambly hundreds; they never get too far). My guess at the time was that they had compromised all the machines they needed or had gotten too many of their zombies targeted by others and where waiting until the zombies got a new DHCP lease.

It scared me at first because I thought: wow, fail2ban and denyhosts can't handle this (denyhosts.net syncing isn't open source), but then I looked at it from a sniper analogy (sorry, been playing too many army games lately):
We can't tell where the enemy is, and every once in a while, they let loose with a machine gun blast, so we'd just snipe that one guy (throw up a firewall, maybe report to authorities) and wait again. Now, they're shooting one machine gun round every hour, but they have enough people that it's like one gunner who moves around a lot. So, now our snipers can mow the lot of them down (assuming there are enough sysadmins that can be bothered to report zombies to ISPs). Soon they'll discover that the old method yielded a better ratio of success/casualties.

Above post contains Syntax Error

[nobodymk2]

The proper links contain I think I may need to get the A5 Nerve Checked, the limbic system seems to be in a perpetual stroke but the medication is still present. I can't use love/lust/sex to calm down though since I can't maintain a relationship. House, MD is classic http://en.wikipedia.org/wiki/Hans_Asperger Aspergeric, but there's no differentiation in the APA's bible. I am my own fucking doctor, thankyou unless denied perjury.

Weasel

[SgtChaireBourne]

Here. I admit. I'm part of the so-called "whitehat guys" who profit from stoping the botnets. But since I have no ethics or morals, I dont really stop them, I just give them kickbacks to make it look like I'm stopping them.

...

Don't try to squirm out of your responsibility by casting aspersions or weaseling. If any part of your so-called clean up involves letting clients continue to run MS Windows, the you *are* effectively helping to spread the botnets you claim to be cleaning up.

Responsible employers don't let staff install MS crap on a server or anything else plugged into the LAN or Wifi.

Could the definition of life be:

[hellop2]

Something that always evolves

Now, how the hell do you punctuate that?

Re:Total miss.

[atomic-penguin]

Behavioral and statistical analysis has been coupled with Intrusion Detection Systems (IDS) do exist. They are known as Anomaly-Based IDS. What I described is a Signature-Based IDS, which is much more common than the Anomaly-Based type. I suspect the reason for the prevalence of Signature-Based is they are easier to design, and require much fewer resources.

In my personal experience, Signature-Based Prevention systems are quite effective against this type of attack. Which is why I pointed it out in the first place. If you have a failed SSH login signature, which hits a certain threshold, that is certainly suspicious behavior. I think it is a moot point to even check whether the userid is in the passwd file. Because, from my point of view, there is no difference between an attacker failing a login from an invalid userid or a login as root, backup, or user666 for that matter. Any way you look at the situation, it is still an attack, and one that can be dropped.

Portknocking, denyhosts

[Anonymous Coward]

I've tested some portknocking tools and if you want a somewhat secure server i'd say that portknocking is the way to go.

If you don't want portknocking there are several program such as denyhosts that looks thru your logs and add hosts that fail to login X number of times to the /etc/hosts.deny.
Neat thing with denyhosts is that you can tweak it as you see fit. And that there is a global list of IP's that are known for being bruteforcing hosts.

If you want a totaly secure server, you pull the ethernet cable.
Otherwise, Read The Fine Manual and learn some ;)

block 50% of earth then....

[cheekyboy]

It might be worth blocking ALL of eastern europe/russia/china/asia for ALL ports, but port 80 if you run a webserver.

I doubt you have friends there or that you will go there your self.

Are there any easy to use IP generators/lists based on geo that can output it for any purpose?

Re:block 50% of earth then....

[houghi]

Think again and look at the logs. I see attacks from all over the world. So if you want to block, start white listing not blacklisting.

Clarification. to atomic and culture

[JetScootr]

The filter I propose isn't based on "submitted userid == any valid userid" but "submitted userid (is X% similar to) any valid userid". X would be a tunable value. In spam email filters, this usually works out to "if incoming email (is less than 20% similar to) previously accepted emails" or some such. It turns out that spam emails, even if containing dictionary words, still don't resemble human communications when bayesian statistics are applied to it.
Since the attacker doesn't know what userids are valid, the chance of any guessed userid being more than a few percentage points similar to a valid userid is vanishingly small.
Try it - pick a thousand "valid userids" out of the dictionary. Now pick a thousand more, omitting variations like "library - librarian". How many attempts will have more than a few characters in (almost) the same position and (almost) the same order as the "valid userids"?
The reason to use the userid list is because it is invisible to the attacker. The only result the attacker sees is suddenly one of the bots is blocked from the target host. No reason why, and no indication which of the last 20 or 100 or so userid attempts were "way off" and thus contributed to the decision to block.
A valid login attempt with a typo in the userid will be right in all but 1 or 2 characters nearly all the time. The bruteforce attacker will be wrong by more than 1 or 2 characters nearly all the time. Statistically, that's significant.
Since the block doesn't happen because of a single match or failure to match the list, the attacker learns nothing. The attacker doesn't even know the bayesian testing is occurring, thus the attacker would have no knowledge of which its attempted userids was valid or close to valid. It doesn't matter even if the attacker knows this filter is in place. Blocking the entire botnet will be a function:
Block = (v/b)*p
Where v == count of valid userids
b == count of hosts in the botnet,
p == average number of attempts required to guess a password.
B == point at which entire botnet is blocked.
With strong 8 character userids and passwords, the botnet would require billions of hosts in order to breech the system before being blocked.

good movie plot idea

[cheekyboy]

Worlds #1 assassin, working for the worst guys, ie govts, suddenly has his personal on the side self defense course website/server hacked.

He gets mad, finds some funny geeks (pick some actors, seth green). Then he goes out on a wild journey, finding the spam guys in far out counties, taking them out ala Bourne style.

Mix geeks and have the assassin be angelina or someone hot with a gun.

A proper response to distributed attacks is...

[pdwalker]

distributed defense.

Denyhosts. ( http://www.denyhosts.net/ ).

It works.