0

I'm not at this point yet, thankfully, but being prepared means knowing the answer before the issue arises, so here goes...

You're looking through your firewall / website logs...

And you notice a large number of requests. Someone appears to have portscanned you, or run sqlmap or DirBuster, Nessus, metasploit or whatever. Apart from breaking out in cold sweat and making occult sacrifices to the Internet gods, what are good steps to take at this point?

I'd assume you'd:

  1. go through other logs more carefully than usual, looking for derivations from the norm,
  2. (if it's only from one IP) do a reverse DNS query on them to see if they are associated with any domains, and, if they are, contact webmaster@, abuse@ and other RFC2142 addresses then, if they don't respond within 24 hours contact their ISP.
  3. (if it's from multiple IPs) check if they're using IPs from known anonymizing networks, and if they are, block those anonymizers (as much as possible).
  4. (if egregious enough / a clear attempt to break in or DOS, and not simply reconnaissance) contact the FBI (if any of the IPs are across state lines). Not sure what other law enforcement agencies you'd contact.
  5. Temporarily block ssh logins from non-essential users while the storm is being weathered (so your attack surface is smaller).
4

I would do the 1st item only. Additional logs analysis is clearly prudent to make sure no real compromise has occurred.

Blocking IPs is of minimal effectiveness. Most cyber-criminals aren't breaking into machines from their home network, they're using another compromised machine or a proxy to hide their identity. Blocking their jumping off point may slow them down, but that's really just a cat and mouse game. Maybe they'll get bored and give up, so I suppose it has some value, but if you start blocking a lot of IPs, you might be blocking legitimate traffic (customers, for example).

Contacting law enforcement is something I'd save for after being certain that a compromise has occurred and that there is both substantial evidence and I can demonstrate a financial loss. Otherwise, there's not much they're likely to do. Prior to an actual compromise, even if that may technically be illegal, LE is so overworked that it's unlikely they'd have resources to even look at it.

My personal server gets portscanned, dirbustered, etc., multiple times a day. I don't even blink at those reports, it's just noise at this point.

  • 1
    "My personal server gets portscanned, dirbustered, etc., multiple times a day. I don't even blink at those reports, it's just noise at this point." +1 To this statement. This sort of thing happens on a continual basis. You will put yourself into an early grave if you try to proactively investigate and block every person who scans your network. – k1DBLITZ Jul 11 '14 at 15:48
  • @k1DBLITZ Especially when today's network is absolutely abuzz with bittorrent/gnutella/freenet/darknet peer discovery, skype hole-punch misses, random kids who just found nmap, etc. 24 hours a day. – zxq9 Oct 5 '14 at 13:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.