Subj : Port 23.
To   : Joseph Larsen
From : mark lewis
Date : Mon May 22 2017 01:20 pm

 On 2017 May 21 23:52:22, you wrote to All:

 JL> I want to run my board on port 23, but I keep getting unwanted connections
 JL> to it. Mostly from Chinese hackers, I presume.

nope... most likely they are MIRIA trying to figure out if your BBS is a DVR, a 
(not so) smart TV, an IP Camera or a vulnerable router... my old school 
frontdoor mailer shows their connection attempts to me all the time... it is 
why i was one of the very first to raise alerts to them and also be able to 
develop detection rules for the IDS software that i run... some of the 
connections attempt logins and issue busybox commands while others just sit 
until the mailer times out and drops them to the BBS where they will sit until 
the BBS times out or they start their login attempt and get booted...

in fact, i just caught another new variant using PEIN instead of MIRAI as their 
watchword... so far my system is tracking at least 17 known variants... each 
using a different watchword to detect the end of their command execution 
attempts...

 JL> Anyone know a way to solve this, with iptables or the like?

there is some majik that can be cast that way but i prefer to run an intrusion 
detection system with an automatic reaction tool... but i do this on my 
perimeter firewall instead of on any of the BBS or server machines...

anyway, janis has some iptables recipe that she's using on her port 23 to try 
to mitigate this... or she did... i have a brain cell kicking me and saying 
that she did move from port 23 like so many other folks have done...

)\/(ark

Always Mount a Scratch Monkey
Do you manage your own servers? If you are not running an IDS/IPS yer doin' it 
wrong...
.... Yellowknife - Many are cold but few are frozen.
---
 * Origin:  (1:3634/12.73)

.