Slashdot Mirror
More Than 40% of Global Log-in Attempts Are Malicious (infosecurity-magazine.com)
More than 40% of global log-in attempts are malicious thanks to bot-driven credential stuffing attacks, according to the latest report from Akamai. From a report: The cloud delivery provider's latest State of the Internet/Security report for Q4 2017 comprised analysis from over 7.3 trillion bot requests per month. It claimed that such requests account for over 30% of all web traffic across its platform per day, excluding video streaming. However, malicious activity has seen a sharp increase, as cyber-criminals look to switch botnets from DDoS attacks to using stolen credentials to try to access online accounts. Of the 17 billion login requests Akamai tracked in November and December, over two-fifths (43%) were used for credential abuse. The figure rose to a staggering 82% for the hospitality industry.
I keep losing my post-it notes.
These figures don't paint the full picture. One brute force attack can account for multiple lifetime logins for a single application. We should be measuring by frequency of attack, per application - or find another metric that tells a more wholesome story.
I have a VM with a hosting service where I run Ubuntu to host some things like svn and other small services. According to the ssh logs, where bots are trying to log in constantly, and the apache logs, where bots are constantly trying to access admin pages for services I don't run, I'd say that more than 99% of login attempts are malicious on that host. That's without advertising the IP or hostname anywhere; the bots just found it over time. I do run fail2ban, so they eventually get blocked, but there's an endless supply of them.
Create a new AWS account, and create a new AWS instance. Allow normal login (not just SSH), and don't do any sort of IP restriction. Watch your logs. Your instance will be noticed very quickly, and will be flooded by bots attempting to brute-force a login. FWIW, the bots are all from Eastern Europe and Asia, or at least they were the last time I tried this (a few years ago). It's pretty crazy.
I don't know about other cloud services, but I wonder about AWS policies. You can set a warning when your monthly spend exceeds a threshold, but you cannot actually set a hard spending limit. This means that, if someone manages to hack into one of your servers (or, better, into your account), they can use as many resources as they want, until you notice and stop them. If you don't notice, they can run up massive bills, which AWS will want you to pay. Seems like a good racket, no wonder those bots are lurking...
Enjoy life! This is not a dress rehearsal.
I'd say more like 99% of attempts are malicious.
I don't know how the number could possibly be that low. A bot can iterate through many accounts per second. Oh, sure, timeouts, but any competent bot must surely try to log into many different places while waiting for timers to count down on the ones it has already tried.
See subject & I see you're still butthurt I cornered you for your bs lie you can't backup https://it.slashdot.org/comments.pl?sid=11776765&cid=56174209/ & now you're attempting to impersonate me too you obsessed lunatic!
* I loved how you had to EVADE backing up your bullshit that "2 billion people depend on your 'work'" bullshit & your "work" is trolling (no, they do NOT depend on your trolling as it's not an actual useful program like mine that even /.ers use & like)!
HOWEVER, I must admit - I truly DO depend on YOU - how? I depend on YOU to always make ME look GOOD & yourself like the lying bullshitter you proved you are, lol!
APK
P.S.=> GROW UP... apk
I see all sort of attempts to login through my firewall---even attempts via telnet, of all things.
CUR ALLOC 20195.....5804M
Typically a user will make 1-3 login attempts per log in (>1 only if they have trouble typing) where as malicious login attempts would be much greater when trying to brute force/ use password lists. So is this 40% distinct IP attempts? If not I would expected a much higher percentage.
Comment removed based on user account deletion
I turned on all email notifications for fail2ban and I was receiving some 3 to 4000 emails a day.
Then I moved my imap, smtp, and ssh servers over to non-standard ports, and I receive maybe an email a week from fail2ban.
I'm god, but it's a bit of a drag really...
And who the fuck gave Akamai permission to track this? The users sure as hell didn't -- which is why the Akamai stuff is on my blocklists in my browsers.
And 40%? That sounds like an incredibly low number, since by now the only reasonable conclusion is the interwebs are populated with millions of assholes all trying to break into things.
The hackers you can't really stop, but the entire business model of analytics companies should be made illegal by having real functioning privacy laws which say "no, we don't give a fuck about your business model, tracking people isn't something we're going to accept".
You might get that someplace sane, but the US will never do that -- passing laws which curtail the assholes who run corporations would be an unforgivable sin in the oligarchy.
We walk around all day in an environment filled with various organisms and diseases that are all trying to feed on us. That's why we have skin ( think firewall ), and an immune system, as well as other defenses. All computing systems should be built such that they could survive and do their jobs safely while directly connected to the Internet. Even though we put them behind firewalls, we should understand that it's a jungle out there. Build them to trust only them selves, and then have a backup defense.
You live and learn, or you don't learn much.
Is there anyone on /. that APK doesn't start a war with? What a fucking tool.
The guy has a lot of energy, I wish he'd spend it on something constructive instead of being crazy.
ZIP
I think this headline should have been:
"Only 40% of Global Log-in Attempts Are Malicious"
(this is offended to the end of comments you post, 120 chars)
If you want some peace (and peace of mind), restrict SSH logins by IP range. Even if your address is dynamic, your ISP only has a certain range of addresses. Find out what that range is, and set your server to only accept login attempts from those addresses. With AWS, this is part of the security setting outside the VM. Your hosting service may differ, of course...
Enjoy life! This is not a dress rehearsal.
Is there any time on /. that APK doesn't post as Anonymous Coward to feign support for himself. What a fucking looser.
That guy has such a bad personality that no one wants to defend him, I wish he'd take that excess energy and work on improving his personality.
ZIP
Restricting by IP range is a great idea - as long as you'll still have a way in when your ISP suddenly gives you a completely different range.
Also, in theory, attackers could try all ports, so it doesn't matter which port you use. In the real world, most attackers use the standard ports, so choosing a random port below 1024 greatly reduces the number of attacks. That doesn't work against theoretical attackers, but it works against most real ones.
Once upon a time close to 50â... of adult sites which had logins used my login system I designed. These days it's probably down to 20â... or so, but still a lot of sites. What exactly would you like to know?
Bottom line is this - sites are attacked all day every day.
People still use it. It's effective, despite the fact that theory says attackers *could* try combinations of ports. Personally, I don't use it. Non-standard ports get most of the benefit - reduced attack attempts, and either way it still needs to be secure after an attacker connects to the port.