The Optimum Attack Rate For SSH Bruteforce? Once Every Ten Seconds

badger.foo writes "Remember the glacially slow Hail Mary Cloud SSH bruteforcers? They're doing speedup tweaks and are preparing a comeback, some preliminary data reported by Peter Hansteen appear to indicate. The optimum rate of connections seems to be 1 per ten seconds, smack in the middle of the 'probably human' interval."

Comments

Passwords are for philistines

[halber_mensch]

RSA keypair auth, disable password auth, bruteforcers irrelevant.

Re:Passwords are for philistines

[aztracker1]

RSA key/pair is something you have... you still need something you are, and something you know... Once someone has your key, it's no more secure than your password. A trojan can read local files, just as easily, if not more so than snoop for a password.

Re:Passwords are for philistines

[the eric conspiracy]

Anyone see these guys on a port other than 22?

Re:Passwords are for philistines

[0racle]

If you have a trojan keylogger, you probably don't have to worry about SSH bruteforcing.

Re:Passwords are for philistines

[TheLink]

Yeah to me that's the best approach - use a different port. Simple and effective enough. You could resort to port knocking or similar (use some other method[1] to selectively allow access to the ssh server). But just running the ssh server on a different port allows you to avoid nearly all automated attempts, so when you actually see brute forcing on your ssh server, it's more likely to be a serious targeted attack (hence you can set up an automated response/alert without getting too many false positives).

[1] For example, if you already have to expose https to the world you could have a web app that triggers the opening of ssh access for the web client's current IP.

Re:Passwords are for philistines

[drosboro]

Good point. My standard setup is to move SSHD to a non-standard port, and to turn off PasswordAuthentication completely in favour of RSA key-pairs.

Just checking my SSHD logs, it looks like I've had exactly one rejected attempt on a busy public-facing web server (which may in fact have been me, connecting from a machine that I hadn't set up a key for) in the past month... so in my experience, no, they're not trying too hard off of port 22.

Re:Passwords are for philistines

[nine-times]

Once someone has your key, it's no more secure than your password.

Whether the token is something you know, something you are, or something you have, it *all* becomes useless once someone else has it. That's not really the issue here. The issue is brute-force attacks on SSH, and using a key makes them significantly more difficult than passwords.

Stealing someone's key/password is not a brute-force attack.

Re:Passwords are for philistines

[sexconker]

RSA key/pair is something you have... you still need something you are, and something you know... Once someone has your key, it's no more secure than your password. A trojan can read local files, just as easily, if not more so than snoop for a password.

When you send bits out, everything in those bits is "something you know".

You don't need to have the keyfob, you just need to know what it will output at any given time, or what a prior output was (as long as you use it within the time window for which it is valid - typically 30 seconds to 2 minutes). Yes, it's mathematically hard to get the key by brute forcing, but it's not impossible. When you log in with one of those, you're not proving that you have the thing, you're proving that you know what it output at a given time.

Imagine if PS4 games had built in RSA shits right onto game discs. (Or the Vita game cards if you can't imagine a thing battery, cpu, and display on a disc.)
Touch an area on the surface of the game disc (or card) and get a password on a little display. You have to put that password in within X time to access the game. This isn't secure because even if Bob holds onto the disc physically, Alica can call him up and ask him to read the code.

Sony wants the disc to be in Bob's physical possession (and no one else's) at any given time, but they cannot rely on this type of security to ensure that. For all they know Bob is visiting Alice and brought his new game over.

Re:Passwords are for philistines

[JWSmythe]

      I double that up. sshd to a nonstandard port, and firewall rules to only allow access in from very specific IPs and networks.

    You really shouldn't be able to ssh in from just anywhere. Even if that means throwing a copy of OpenVPN up at a static location, to ssh to the second.

    I can get to most of my stuff directly from home. At a hotel, airport, or coffee shop, I am on a hostile network, and shouldn't even be able to see that the port is open.

    But, most people scanning for machines with SSH on them to hit are blindly scanning port 22. It's people interested in your specific network will scan every port on every machine. Someone determined to hit your machine specifically will try every trick they can, and having SSH on port 2222, 9222, or 64222 won't help, if you have a weak password or an exploitable version.

Re:Passwords are for philistines

[multimediavt]

I made it just a different port on my router at home; still points to port 22 on the internal address forward. That way I can just turn sshd on (after configuring max tries to '3') and not worry about port fiddling on the machine. Works. Haven't seen many attempts at it since I did that years ago.

Re:Passwords are for philistines

[Brucelet]

It is if I break into your house and brute-force you to hand it over

Re:Passwords are for philistines

[nine-times]

That's nice in theory and all, but it depends on what that "something you are" is. Essentially we're talking about biometrics, so what are we measuring? Is it a thumbprint scan? Those have been defeated in the past by taking a thumbprint and replicating it by some means. Is it a DNA scan? Then they might just need to get ahold of your DNA.

Really, the "something you are" is still "something you have", but you "have" it attached to your body. That doesn't necessarily mean it can't be stolen or replicated somehow. Similarly, the "something you know" can also be considered to be "something you have", but you "have" it in your mind. In some circumstances, it can still be figured out or retrieved, or you might be tricked into providing it.

Real security isn't quite as simple as you make it sound.

Key AND Password

[XanC]

So what I've never understood is why it's not possible (as far as I know) for a server to require BOTH a key AND a password. Sure, I can put a password on my key, but that isn't the same at all. Is this possible yet?

Re:Key AND Password

[allo]

yeah, or i once had a sshd with https://en.wikipedia.org/wiki/OPIE_Authentication_System running. Nice thing, you generate a bunch of passwords and print it. Then you can login from everywhere without looking out for keyloggers.

Re:Key AND Password

[XanC]

There's no way for a server admin to require a passworded key for login.

Or never...

[damn_registrars]

Most of the bruteforce attacks I see on my home server are trying to get in as root. I don't allow remote root logins anyways (and even say so on the ssh greeting) so they'll never get in, even if they do manage to guess the password.

Hence their most optimal rate for my system would be never, because they won't get in that way. Not that my system is impenetrable - I'm sure an intelligent hacker could compromise it - but they will never get in trying to ssh in as root.

If they're doing white pages username + dictionary password - or white pages username + blank password (I've seen both, from botnet attacks), they still won't get in on my system as none of the common user names are used there.

Re:Isn't that useless?

[girlintraining]

So unless you're allowing usernames such as "root" or "admin" or "administrator" AND using dictionary passwords wouldn't this fail? And be obvious in the logs?

You're thinking... this makes you a bad reference model for the average user.

I have a portknocking setup

[ledow]

I have a portknocking setup. All your packets bounce when you touch my port 22 until you have touched a "magic sequence" of port numbers first. That sequence can be cryptographically strong, time-dependent, etc. but even a simple one-port knock is enough to stop all this random SSH spam and has been for years.

And if you do "get lucky" and find the right ports and then detect that port 22 is open and then start a brute-force on that? Public-key-only authentication and no root logins allowed.

Impact on me? Another line in a shell script that I use to connect (and hell, even Android has free port-knocking apps, not to mention them being standard-enough to be in Ubuntu/Debian). Impact on server? Greatly reduced number of fake connections bouncing off iptables and a tiny little daemon that does nothing but listen on the ports I need (and can ONLY open the SSH port even if compromised). Impact on brute-forcers? They might as well give up and go home.

Even those remote companies that we do allow to port-forward direct to their device on my work network (e.g. telecoms providers, etc.) understand it and "knock" before they come in (which tells us exactly when they are about to log in), while everyone else in the world sees closed ports.

Why everyone doesn't use it, I have no idea. Even our VPN users have an automated script that just knocks to open the VPN ports (and only the VPN ports) before they connect. Transparent to them, invisible to everyone else, no different if "compromised".

But it still would not work.

[khasim]

They'll use a dictionary attack that is spread over some number (dozens or more) of distinct botnet systems, making it very inconvenient for you the admin to try to block all those addresses.

Who cares about blocking them? They're not getting in anyway. Blocking is just additional work that may cause problems.

That said from my experience the botnets usually seem to do a white pages type list of common usernames and then try either blank or extremely common user names to try to get in by.

That's the reason that they're not going to get in. They're using usernames that don't exist (unless the sysadmin is an idiot in which case you have the regular idiot problems and it's probably been cracked already through one of those).

So you may also want to ensure that if you have users who use very common (English) first names as their login names, they are using strong passwords.

If you're using JUST first names or last names as usernames then you have a bigger problem.

Instead use something like one of the following:
FIrstnameLastname
Firstname.Lastname
FirstnameMiddleinitialLastname

You should be able to easily distinguish the potential threats from the random script-kiddies. That being a REAL username on your system with hundreds of login attempts.

And then you deal with that issue by changing the username. Then investigate how that username leaked.

Re:Details?

[ledow]

knockd on Linux. Apt-get should find it for you. It will execute a specified shell script when it receives a specified knock (default one is specified). That shell script can be passed the IP that knocked (so you can include it in an iptables opening within the script).

There are also implementations for Windows, should you need that.

Denyhosts

[Gaygirlie]

I personally use Denyhosts on my Linux server; it is a simple application that keeps an eye on SSH log and blocks access to SSH and any other services you have configured when the limit threshold is reached. You can also configure whether to keep those IP-addresses blocked forever, or for a specified time. Plenty useful. And the attack described here wouldn't work with Denyhosts.

Since I don't use my server for any actual business-use I have just configured Denyhosts to flat-out block access to any and all services altogether when the limit threshold is reached, and I've configured it to retain the block lists forever. These days I've got several thousand IP-addresses there and I rarely see anything malicious in my logs anymore.

Of course, denying root login altogether and using either SSH-keys or proper, long passwords is still essential.

Re:Funny, I was tweakin' my firewall this morning

[Culture20]

That's only useful if there's one attacker IP. TFA is talking about a botnet doing the attacking. Hundreds, if not thousands of IPs per minute. The only way to "protect" against that with iptables is to have iptables block all incoming on port 22 from any address. But then you're left with a DDoS where your ssh port is down nearly all the time. Same deal with locking accounts; if hundreds of attempts occur per minute, a lot of accounts can be locked out as a DDoS, intentionally or not.

Re:WTF, Editors?

[Samantha Wright]

It's the name of a botnet. Assume any unfamiliar word in any Slashdot summary is the name of a botnet; it makes them eminently more readable. You can try out the technique on this one.

Re:Seems Easy To Detect

[TheRaven64]

The problem is that botnets have a lot of IP addresses. They can do one try from one machine then another from the next. If you disable the account entirely after a certain number of failed logins, you've just created a simple DoS attack. If you disable it just from that IP, it doesn't matter because it will just try from another. There are some realtime block lists that you can use to reject things, but these add another attack route that can let someone who can spoof DNS prevent you from logging in to your own machine...

Let me try to illustrate that. (Long post)

[khasim]

Do you have your system set up so that email names are not user names?

At home? Yes.

I think I seen where you're going with that and I don't think you understand. Collecting email login names is easy.

But being able to login to an outward-facing server (email or ftp or ssh or whatever) should be limited to a certain amount of failed logins (no matter from which IP address) per time period.

The crackers would have to go through an ADDITIONAL step to try to match email login names with ssh login names and an ADDITIONAL ADDITIONAL step to match that name to a different type of server (such as ssh).

Let me see if I can illustrate this.

1. Attacking ssh on server A.B.C.D with username aaron - if there's any chance that the cracker can do it then the sysadmin failed. Even more so with "root" or "admin" or such.

2. Collecting username aaron.aaronson via email spammer and then trying to attack ssh on server mail.example.com - more work for the cracker than scenario #1 but still the same as #1. If there is any chance that the cracker can succeed then the sysadmin has failed. SSH should only be allowed on the mail server from the inside interface.

3. Collecting username aaron.aaronson via email spammer and then trying to attack ssh on servers in the block A.B.C.D through A.B.C.Z (and one of those is your SSH server). And the cracker is using multiple machines to make multiple attempts (one per machine) within time period X. - Again, if it works then the sysadmin has failed. Too many attempts in time period X should lock out the account for a set number of minutes. No matter how many IP addresses are involved.
-continued-
And that depends upon aaron.aaronson being a LEGITIMATE USERNAME ON THAT SYSTEM. Once the sysadmin sees that attack in the logs then the logins to that should be changed (ssh.aaron.aaronson or such) to break that attack if they were not already such. Or change them AGAIN (aaron.aaronson.ssh) and be aware that something leaked somewhere.

4. See #3 except the logins are from multiple machines but only 1 login attempt in time period X so it never triggers the account lockout. Again, change the login names (ssh.aaron.aaronson) to break that attack (and did they leak?).

In summary, getting your system cracked via SSH means that your sysadmin failed so many times.

Re:OpenSSH should block these

[subreality]

Why roll your own firewalling script? fail2ban works great.

In my experience fail2ban alone gets the attack rate down so low that they'll never succeed. They can scale the attack with more IPs, but large botnets aren't free and the price is apparently high enough for them to never bother any of my exposed machines.