Slashdot Mirror
The Hail Mary Cloud and the Lessons Learned
badger.foo writes "Against ridiculous odds and even after gaining some media focus, the botnet dubbed The Hail Mary Cloud apparently succeeded in staying under the radar and kept compromising Linux machines for several years. This article sums up the known facts about the botnet and suggests some practical measures to keep your servers safe."
You cannot be serious !! Linux owned ?? Never !!
I think this article points to the fact the author is retarded.
There is nothing you can do he proclaims after exhausting ALL efforts! How about not permitting SSH at ALL except from known trusted source ip/subnets?!?!?!
Move your SSH port off from 22 TCP to 8222 or something high, since most automated brute force attackers won't spend time port scanning every host, they will go after the well known ports like 21, 22, 1433, 5060, etc (as evidenced by all the noise in my logs). Just use a DNAT rule in your FW.
Even better, use a VPN/IPSec concentrator approach where anything that access those resources on administrative ports must connect via the tunnel. Use really strong PSK's, or x.509 certs...
Then the obvious help for us all, don't permit root logins via SSH! How did this article even make it to Slashdot?
The solution to low-frequency brute force attempts is Denyhosts. It just blocks any host with repeated failed login attempts. I've been using it for longer than I can remember, probably longer than this "Hail Mary" botnet has been in existence. I'm not sure why this author seems to have never heard of it.
1^2=1; (-1)^2=1; 1^2=(-1)^2; 1=-1; 1=0.
This is about the low-intensity password brute-forcing via ssh that's been going on for years -- the only difference between this and any other password brute-forcing via ssh is that fail2ban and such scripts are ineffective, because the attempts are so low-frequency that it's practically impossible to distinguish them from users fumbling their passwords.
The simple solution is to disable password authentication for all users, and make them use keys -- this renders you 100% safe from this botnet. If that's infeasible, be damn sure you've disabled password authentication for root (i.e. "PermitRootLogin no" or "PermitRootLogin without-password" if you still want key-based root logins). If you do allow password logins for any or all users, enforce strong password requirements.
"I'm not really in a mind to offer help or advice to the people running those scripts, but it might be possible to scan the internet from 255.255.255.255 downwards next time."
Yes, start with all the multicast addresses. That'll work for them! ;)
We really need to record all bytes txmitted and then review the dumps when we get core files. Forward to Kaspersky for analysis. Stick it to them.
"I've managed to get my name on slashdot a lot"
"Use key auth instead of passwords"
"My references are my own blog posts"
There's nothing interesting to see here. Don't allow password logins to your system, because you can't trust people to use good passwords. It's 2013, there's no cake for pointing this out.
I am writing this on a BSD machine, but this guy is a disingenuous SHILL. If you have a computer connected to the interwombs, just USE A FUCKING STRONG PASSWORD: NOT: Anna123, PeterPan, Fuckme, dumbass, microsoft, sleaze, shill, whore, foss USE: 767.211.856.543. Too much work for you ? Then don't have an ssh port open on the interwombs. Please don't reproduce either, because you are simply too retarded to get the obvious fix (strong password).
oh wait, this article is about Linux....
He actually mentions port knocking, but I think he mis-understands it. He makes a mathematical argument, without addressing the fact that the sequence of ports can be as long as you want. He seems to think port knocking is used to grant access, when most of the users I know who use it do so only to start sshd so that they can then log in via secure means.
But having to log in from a multitude of places is pretty common. Less common these days than in the past is having to log in from some random machine. Everyone has a cell phone or tablet or laptop. With those, you can store your private keys, and then totally disallow password logins via ssh.
You can then decide whether to allow root login via ssh or not as a separate issue.
Sig Battery depleted. Reverting to safe mode.
STOP USING PASSWORDS FOR AUTHENTICATION! why not only allow connections in authorized_keys??? if you feel so inclined, add a password on top of the authorized key.
there is only so much programmers can do to make it user friendly and secure.
Anons need not reply. Questions end with a question mark.
Pick a host from our pool, assign a user name and password (picked from a list, dictionary or pool)
Implies that each host will, from a predefined directive, try certain user names. I have seen ones better coordinated than that, where they are going through the list alphabetically across a large number of systems. To me this implies a tighter degree of central control on the attack.
...). Any sane admin has root disabled for ssh access, in particular, so the number of attempts they make on that is irrelevant; and the rest shouldn't be allowed much of anything, ever.
That said, the list of users that they try are almost always first names only, aside from the usual collection of system names (root, toor, admin, oracle, games
At any rate, my point remains: this is an old game they've been doing. Interesting that we now have assigned a name to the botnet but otherwise not really news. It would be interesting to know more about the systems that are part of it, but they mostly come from the usual collection of countries and hence your likelihood of getting useful information on them is pretty well zero.
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
Here is the guide we provide to the SSH users at our University: https://it.wiki.usu.edu/ssh_description
Some of the major points:
Ow please.. This is so old.. haven't allowed pasword logins in the last decade or so..
Why on earth would anyone have allowed password logins for the last 10 years? Or: Ever?
Someone that's savvy enough to get a shell account is savvy enough to use a key pair.
It's 2013. I mean, seriously, PASSWORDS? for SSH?? You must be joking.
-f
I guess this guy never reads his own blog posts. Otherwise he'd see that the log files that he's included are cut off after about 59 characters making them useless for the reader.
Yeah we always don't allow root login with a password, only with a key. In sshd config:
PermitRootLogin without-password
I wish the argument were named differently. I think some people have been scared that would allow roologin with no authentication . "require-secure-key" would more accurately describe what it does.
Sorry but what a (looong) and useless article. Thank you captain obvious.
You can do the same with iptables on Linux using the module "limit". See the manual page for "iptables-extensions" for the details. DenyHosts may have it's good points, but mostly it just complicates things. There is already a lot of functionality in the packet filter that you can use, whether on Linux or BSD.
However, what I see now, in contrast to years ago, are slower paced attacks. These come in steadily but at a rate that just passes under the threshold. One of these days I ought to look at what is blocked to see if it's just the slow ones getting through or if all the probes are now timed that way.
Beta is broken and the link to classic doesn't work. Stop wasting our time or there won't be anybody left here.
You don't see the bots trying a million passwords with user "jeleay", they are trying "root", so not allowing root via password is significant.
I don't advise that anyone else do as we have done, however. If everyone starts reading log files and defending themselves the attackers will stop being simple minded and try harder.
"Be a good sport and take the fall for the herd", eh? :-)
This is impossible. Everyone knows that Linux is so great because this can't happen. It is open source and there are no holes that allow thing like this because of the "many eyes" thing. This only happens on WinBlow$ boxes. ~