A simple experiment you can do is buy a server, set up a website with nothing on it, then look at the access logs. All day, every day, there are random systems just blasting vulnerabilities at every device on the internet. Analysts call it "background noise", executives call it "cyber attacks".
Comments
That's all.
I first put it in to look after SSH.
but if your domain gets enough traction, caught in some public cert registry, etc you can still expect to get scanned of course.
https://sourceforge.net/projects/wampserver/
Works great! And you are right about the noise.
We always need to do better about our cyber security, because they never stop coming for us?
Some of originators call themselves "legitimate security scanners", but it's (with very few exceptions) BS.
Like WTH!
That’s ignoring nsa/ the poms/ everyone else and actual non state actors
You can keep tracing, but it's often a large chain of hosts spread across international borders.
Investigating a botnet is essentially a juice that's not worth the squeeze.
Luckily, these attacks leave a VERY large trail, so they're very easy to detect!
Hundreds of port scans every day
When they discovered an open port 3000 login attempts per hour
Every hacker everywhere is constantly looking to gain access
Usually china
Can't imagine how bad it is now.
Some take the buckshot approach, they'll try to exploit, for example, a Wordpress bug without bothering to check Wordpress is set up.
https://labrea.sourceforge.io/Intro-History.html.
You set up a bot-friendly endpoint (wp-admin.php), then when something hits it, the response then tries to keep their connection 'on hold' as long as possible to waste their resources.
#made #hacky #folk
I like to think it just makes it easier for those collecting malware info.
I was wondering why it's the case with this social media site, that I can do that. Admittedly - I know nothing about he pros and cons of why, I just found it interesting and cool that I was able to.
And it isn't even just bots blasting stuff. On some days a big percentage of the traffic browsing my site seems to come from Russia. I have no idea why, but I don't think they're serious shoppers!
https://loyaltshirt.myshopify.com/
"Always be plugging," according to John Hodgeman. 😉
https://loyaltshirt.myshopify.com/
Btw, in Russia hacking isn't illegal if you only hack stuff in foreign countries.
Admittedly, that was before I installed fail2ban which limits the amount of consecutive login attempts.
In less than an hour there'd be at least 4 different user-agents looking for php files and configs
There was nothing except an empty page
The purpose of the webserver was to confirm that port-forward worked (had to host a server for a game)
If I were to host a website with a database and such, it'd require maintenance that I don't have the time for anymore, not to mention updates and things randomly breaking because of them
It's why things like shodan and censys exist.
I got my words mixed. Yes, decried is a much, much more useful statement.
Even a small increase in annoyance can have a dramatic impact on incidence.
WAS THIS YOU?!?!?
During the peak of Mirai, they were scanning so aggressively OpenSSH would reach its unauth connection limit. 🤦
(OpenSSH has logic to reduce the DoS, and it's gotten more advanced since then.)
Definitely not just automated scans looking for unpatched vulnerabilities.
I'm always still kinda nervous though. I'm not super versed in network security i just have openwrt firewall and anything with exposed ports runs in containers on updated Ubuntu and then i pray lol
There is always some risk but that’s part of the fun with a lab. Playing, praying, and learning something along the way 😂
A fun thing I saw once is someone set up wp-admin.php to redirect to a 1GB test file in Nginx to give the bots the finger.
I wrote scripts to produce & install new binaries on my firewall(s)as the snapshots at https://openbsd.org change but with a 73 hour lag..
On average, they were under attack within 45 minutes. The record was ten, and this was in 2006.
Facebook started pushing video ads back then and their analytics were showing massive conversions but our actual inquiry forms dropped off a cliff.
It is amazing what differences you see with the access attempts. It's like the second one doesn't exist.
Then, at the beginning of each new week we reloaded and began to watch again. Fun times!!!
Hackers use them too, in reverse.
Otherwise, yeah you need to be thinking about security
But yes, definitely security is crucial for a comment section, especially sanitising the inputs
https://github.com/fail2ban/fail2ban
Or a commercial solution with lots of those IPs in the blacklist.
And I like the idea of redirecting them to a big file download or something.👍
I can't imagine it's gotten better.
Caught some well written nasty things.
The background was noisy indeed
Many of these exploits intent to hack into the target and stay undetectable.
badly behaved web crawlers. Get a couple of them scraping some image heavy sites and I'm DOSed off my own link
Somehow they didn't realize that disabling those services would have been more effective (or restricting them with the firewall)
😳😳😳. Can I just say I appreciate all of you who have a clue and I mean that sincerely.
I like the background noise idea, it's exactly how it feels.