3

Are there any dangers to seeing small amounts of botnet/malware associated traffic crawling your public facing infrastructure? For instance seeing the same malware associated IP making different connection attempts to over 1000 public facing IPs.

I'm aware of DDoS types of attacks, but that's not happening here. My initial thought is that it's just routine scanning activity, but I'd like to get some different perspectives to see if there's something simple I'm missing.

  • 2
    The internet is scanned constantly. This is normal and everyone sees it. – André Borie Apr 7 '17 at 12:43
  • 2
    there is the obvious danger that they actually end up finding something (usually an unpatched system or a system with default credentials), but indeed such traffic is very common – niilzon Apr 7 '17 at 12:45
2

This sort of traffic is pretty normal, and very hard to suppress. You could try to set up an automated system to drop connections from domains / IP addresses that you have no association with, but nowadays, a lot of the attacks are coming from cloud providers that you probably have other critical connections to.

I'd use this traffic as an impetus to review your externally facing systems and confirm that they're patched and as secure as you can make them. If you have the time and the resources, you could consider setting up a honeypot, to help get more info on what type of probes and attacks are being attempted against your systems - that can help you better protect your systems.

And keep reviewing your logs!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.