Got my first script kiddy

Comments

• irotsoma@lemmy.blahaj.zone ⁨8⁩ ⁨months⁩ ago

  My servers that have been around for a while get thousands of scans per day. In fact I am going to move away from crowdsec because I exceed the free limits on log entries within the first day of the month usually, sometimes just an hour or so. I mean it still works and blocks stuff, but the web portal is basically useless for any research into what I need to give attention to. That and the fact that you can no longer delete decisions on the web portal with the free account.

  source
• uzay@infosec.pub ⁨8⁩ ⁨months⁩ ago

  I think a lot of peope understandably misunderstand this post because it doesn’t really explain the situation. After reading OP’s comments I gather that OP put a new server onlibe (not on AWS) and was immediately port scanned by a host that is on AWS. Since OP did not consent to being port scanned, they filled out an abuse complaint with AWS, the hoster the scan came from, out of principle, knowing that it probably won’t do much. Which is totally fine if that is how you want to spend your time.

  I think what most commenters thought is that OP was hosting with AWS and complained to them that someone else scanned their server. This does not seem to be the case.

  source

  • dgdft@lemmy.world ⁨8⁩ ⁨months⁩ ago

    Absolutely not — the issue here is OP knowingly submitting false abuse reports.

    Port scans of public hosts are not considered abuse per the CFAA or Amazon’s AUP without other accompanying signs of malicious intent.

    aws.amazon.com/aup/

    Amazon may take action against egregious mass-scanning offenders per the “…to violate the security, integrity, or availability of any user, network…” verbiage, especially if they’re fingerprinting services or engaging in more sophisticated recon, but OP’s complaints are nowhere near meeting that threshold.

    source
• TwiddleTwaddle@lemmy.blahaj.zone ⁨8⁩ ⁨months⁩ ago

  Trying to learn here, are these SSH login attempts on the root user? If not, is it just the firewall logs?

  source
• cmnybo@discuss.tchncs.de ⁨8⁩ ⁨months⁩ ago

  Switch to IPv6 only and the port scans will go away. The address space is so big that port scanning is difficult, so the usual bots don’t bother.

  source

  • KairuByte@lemmy.dbzer0.com ⁨8⁩ ⁨months⁩ ago

    Sure but there are just some things you can’t run over ipv6

    source

    • cellardoor@lemmy.world ⁨8⁩ ⁨months⁩ ago

      Such as?

      source

      • -> View More Comments
• cellardoor@lemmy.world ⁨8⁩ ⁨months⁩ ago

  If I showed you my WAN-side firewall logs you’d have a panic attack. I have a /29 block and about 10 scans tap one IP or another every second. It’s part of being on the internet.

  Your domestic home router experiences the exact same thing. Every moment of every day.

  Will you report every scan? Every Chinese IP? Every US IP? It’s completely common place to have someone ‘knock on the door’.

  Get off IPv4 anyway and onto IPv6. Good luck to them finding you by chance in there.

  source

  • Clearwater@lemmy.world ⁨8⁩ ⁨months⁩ ago

    I ran a Tor relay on one of my spare servers for a while, and my god did that thing get port scanned. Even two years after I stopped hosting the relay, it was still getting pinged every 5-10 seconds (while my other servers tend to get pinged “only” once ever 20-30 seconds).

    source
• Schwim@lemmy.zip ⁨8⁩ ⁨months⁩ ago

  It wasn’t a script kiddy. It wasn’t even a human. You are going to be a very busy individual if you decide to report every port scan you find.

  source

  • MightBeFluffy@pawb.social ⁨8⁩ ⁨months⁩ ago

    That’s what automation is for

    source

    • sugar_in_your_tea@sh.itjust.works ⁨8⁩ ⁨months⁩ ago

      Or just close off the most common vectors, such as disabling root ssh login, doing key-only SSH auth, and block traffic from regions of the world you don’t need to support.

      source

      • -> View More Comments
• remon@ani.social ⁨8⁩ ⁨months⁩ ago

  Haha, I get one of those every other day.

  Image

  source

  • MightBeFluffy@pawb.social ⁨8⁩ ⁨months⁩ ago

    The sad reality of the Internet. Being the first for this new server feels like a “Welcome to the Internet, glad you are here” kind of message

    source
• darcmage@lemmy.dbzer0.com ⁨8⁩ ⁨months⁩ ago

  Remember to also report ssh login attempts and unauthorized wordpress access (even if wordpress isn’t installed).

  source

  • MightBeFluffy@pawb.social ⁨8⁩ ⁨months⁩ ago

    For SSH it will have to be attempted connections. Ain’t no way I’m putting a forward facing SSH. I’ll deal with any downtime that comes from not being able to access my server remotely

    source
  • markstos@lemmy.world ⁨8⁩ ⁨months⁩ ago

    Also, all spam messages.

    source
• scrubbles@poptalk.scrubbles.tech ⁨8⁩ ⁨months⁩ ago

  Uh sorry dude, but no this isn’t a script kiddy, these are bots that scan every IP address every day for any open ports, it’s a constant thing. If you have a public IP, you have people, govs, nefarious groups scanning it. AWS will tell you the same as if you were hosting it locally, close up the ports, put it on a private network. Use a vpc and WAF in AWS’ case.

  I get scanned constantly. Every hour of every day dark forced attempt to penetrate our defences.

  source

  • MightBeFluffy@pawb.social ⁨8⁩ ⁨months⁩ ago

    Not on AWS and yes I know I can’t stop port scanning and bad traffic is a thing. Doesn’t stop me from filling out the form. I think to piss off you and the other commenters, I’ll write a script to auto fill out AWS abuse forms. Also script kiddy or bot, all the same to me, their hosting provider is getting a message from me

    source

    • Reggie@discuss.tchncs.de ⁨8⁩ ⁨months⁩ ago

      I’ll write a script to auto fill out AWS abuse forms Sounds like you are the script kiddie here

      source
    • i_am_not_a_robot@discuss.tchncs.de ⁨8⁩ ⁨months⁩ ago

      Port scanning isn’t abuse but automatically filing frivilous abuse reports is.

      source
    • Randomgal@lemmy.ca ⁨8⁩ ⁨months⁩ ago

      This is some cartoon-villain type unhinged behavior.

      source
    • remotelove@lemmy.ca ⁨8⁩ ⁨months⁩ ago

      Good luck with that, I suppose. Botnets can have thousands, if not hundreds of thousands of infected hosts that will endlessly scan everything on the interwebs. Many of those infected hosts are behind NAT’s and your abuse form would be the equivalent of reporting an entire region for a single scan.

      But hey! Change the world, amirite?

      source

      • -> View More Comments
    • scrubbles@poptalk.scrubbles.tech ⁨8⁩ ⁨months⁩ ago

      I mean go for it? They literally can’t do anything, you might as well complain that fire is hot though. It’s part of being in the Internet. They provide safety gloves, via VPCs and fireballs, but if you choose not to use them then… yeah I mean youre probably gonna get burned

      source
    • irmadlad@lemmy.world ⁨8⁩ ⁨months⁩ ago

      Not on AWS and yes I know I can’t stop port scanning and bad traffic is a thing. Doesn’t stop me from filling out the form.

      On occasion, if they end up in recidive, I’ll report them to AbuseIPdb. If I did it for all attempts, I’d be as busy as a squirrel in a nut factory, because the bots are thick out in the ether. Like every minute of the day they’re out there throwing rocks at the castle wall. I had to start logrotating because logs were getting so big it was difficult to review and audit. Every so once in a while, they’ll break out the trebuchet and lob something significant, but I’ve had no breaches to date.

      My servers are single user only, so buttoning things down is a little less complicated for me.

      source
• irmadlad@lemmy.world ⁨8⁩ ⁨months⁩ ago

  I am reminded of a Richard Pryor skit in which he tells about a football player he knew who bit the fingers off of an opponent who was trying to gouge his eyes through his helmet. When Pryor asked him why he bit the guy’s fingers off he said ‘Everything outside the mask is his. Everything inside the mask is mine.’

  source
• atzanteol@sh.itjust.works ⁨8⁩ ⁨months⁩ ago

  You contacted Amazon over a port scan?

  source

  • MightBeFluffy@pawb.social ⁨8⁩ ⁨months⁩ ago

    Yes. Don’t port scan my shit.

    source

    • atzanteol@sh.itjust.works ⁨8⁩ ⁨months⁩ ago

      “Good luck with that.”

      I realize you’re inexperienced and excited, but this is truly no big deal. Port scans are quite common and aren’t even always malicious. You can use nmap to scan systems yourself - just to see what’s out there or to test if your firewalls are woking, etc.

      source

      • -> View More Comments
    • non_burglar@lemmy.world ⁨8⁩ ⁨months⁩ ago

      Umm…

      You know how that works, right? Like, if you don’t want to expose ports, just… don’t expose them. But you can’t prevent port scanning.

      I would love to see the support request from AWS for this.

      source

      • -> View More Comments