4

With so many internet attacks out there, I just think it would be convenient (and quicker and wise) if there is a way to automatically harvest the hacked hosts that are used to launch internet attacks/probes. For example a SSH host could install DenyHosts and/or implement hosts.deny. From failed authentication data we can collect all the IP addresses of those hosts, and automatically (or semi-automatically, if that would be better) report to the site admins that their machines have been hacked. Is there any tool or online service like that? This would allow hacked machines to be squashed in a speedy manner.

This would be analogous to spamcop.net for spams. But now there are many more hacks and attempts, it does not make sense to mail site admins manually.

Improve this question
2
  • Please clarify. Are looking for an automated way to notify ISPs that a host on one of their IP addresses is compromised or intentionally abusive. And perhaps cause the ISPs to take action? Or are you instead looking for a service that you can participate in to create a blacklist?
    – 700 Software
    Dec 20, 2011 at 16:28
  • OK. I guess you are right. I don't know about security stack exchange before. I am interested in automatically reporting such abuse to ISPs so they can take action (e.g. take down the compromised computer).
    – Wirawan Purwanto
    Jan 13, 2012 at 23:11

2 Answers 2

Reset to default
2

You may want to check out http://www.dshield.org/

They have been providing this type of service for quite sometime. You can integrate with firewalls, tcp wrappers or other methods.

I for one don't find this approach too useful for security. I find anomaly and behavior based methods provide better results with less fuss.

Improve this answer
3
  • I would like to know what you mean by anomaly and behavior based, and how they are different than what is described by the OP.
    – 700 Software
    Dec 19, 2011 at 18:49
  • 2
    If I understand correctly, the OP is looking for a blacklist of hosts. These are IPs of hosts known to cause issues. Behavior/anomlaly based methods look at patterns that are indicators of abuse rather than specific items. See windowsecurity.com/articles/…
    – jeffatrackaid
    Dec 19, 2011 at 19:07
  • I asked the OP for clarification. He is not looking for a blacklist as much as he is wanting to notify the ISPs so they can take action.
    – 700 Software
    Jan 13, 2012 at 23:38
0

The problem with your proposed solution is that I don't trust someone else's IP blacklist that I can't independently verify somehow.

Let's say a system exists where you can report to a common database servers that are running scripts trying to break into ssh with common usernames/passwords.

System admins submit parts of logs like /var/log/auth.log:

Feb  4 09:15:04 quarkonia sshd[12414]: Invalid user webadmin from 129.2.145.XXX
Feb  4 09:15:04 quarkonia sshd[12414]: pam_unix(sshd:auth): check pass; user unknown
Feb  4 09:15:04 quarkonia sshd[12414]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=XXX.student.umd.edu 
Feb  4 09:15:07 quarkonia sshd[12414]: Failed password for invalid user webadmin from 129.2.145.XXX port 39505 ssh2

and then the IP address 129.2.145.XXX gets added to the common blacklist. But it would be pretty trivial to submit fake logs with IP addresses of users you are trying to DoS; preventing legitimate users from logging using ssh to servers that subscribe to this blacklist.

This is slightly different than say reporting to doing a whois on 129.2.145.XXX 

OrgAbuseHandle: UARA-ARIN
OrgAbuseName:   UMD Abuse Role Account
OrgAbusePhone:  +1-301-405-8787 
OrgAbuseEmail:  [email protected]
OrgAbuseRef:    http://whois.arin.net/rest/poc/UARA-ARIN

to find the abuse contact and say the IP address 129.2.145.XXX appears to run scripts that attempt to break into machines through ssh.

A system administrator can then look into the issue, possibly (a) finding a compromised system under the control of a remote hacker (and then remove the malware; e.g., reinstall the OS), (b) a script kiddie who doesn't know what they are doing trying to break into random sites (and threaten legal action to stop the kid) or (c) nothing after a quick investigation and ignore the false alarm.

There are blacklists of the IP address blocks assigned to countries where this stuff is more rampant (China, Russia, Nigeria, Eastern Europe) and that may never need to login to your server. Personally I'd run whois on all of them to double check, if you were to do this method; and make sure that its ok for your website/ssh server to block all traffic from those countries; and don't worry about the rare event of IP blocks getting reassigned to a different region.

But I just tend lock down number of AllowedUsers in ssh to one, change the ssh port (yes, security by obscurity) to something else under 1023 (so only root could control the port), prevent port scanning with a psad, mitigated automated attacks with fail2ban and using a complicated passphrase (normally through ssh key).

Improve this answer

You must log in to answer this question.