Constant port scans on my router WAN (Afrihost on Openserve)

JerryMungo said:
@OP - you just live with the port scans, it's background noise... it's going to be research scanners (Shodan, Censys), botnets and compromised hosts. They're all connected to the web. Just keep your device up to date and preferably use a trusted device.

I see someone mentioned Ubiquiti... Have a listen here first:

darknetdiaries.com

Ubiquiti – Darknet Diaries

Nickolas Sharp worked for Ubiquiti, a company that makes networking equipment. He noticed that there were some security problems at work. He tried to point them out, but didn't feel like he was being listened to enough. What do you do when the company you work for isn't securing their software...
darknetdiaries.com darknetdiaries.com

TLDR:


I'm more a Mikrotik guy, but there are many good devices out there and many I wouldn't touch... Cudy, Totolink, Tenda... (among others)
Click to expand...
Disgrunted infrastructure guys can do a lot of damage. These days, I think the bulk of the disgrunted guys will just sell the 0-days on the dark-web and we almost never find out.

Make sure your people are happy and healthy. You can only do so much to protect the business from the people "with the keys to the kingdom". Its probably your best security policy.

At least Ubiquity found out and had some logging. I don't think we could say the same from the developers that make and customise the firmware going on the next DP-Link or Huawaddy router bundled by ISPs even have a security team reviewing code.
 
rustypup said:
Some ISPs insist on the having their kit in the loop, which can be aggravating.

AISURU was over 300k hacked devices at its peak....
Click to expand...
There are forums that keep lists of configuration and explain how to capture their PPPOE and Radius authentication with Wireshark. You can then spoof their authentication, so you can put your own router on their network.
 
Gimli_ said:
This weekend I spent a good couple of hours staring at my live firewall logs. What I saw was constant port scans from IPs all across the world (Bulgaria, America, Netherlands etc.) Not even scanning random ports, just going down the list like 39000, 39001, 39002 etc. I disconnected for a while to force a new IP address but that did not change, just the source IPs changed.

My firewall drops the packet, it doesn't block the packet (there is a difference).

My question is, should we just live with it and trust our CPE? Or should we be asking our ISPs to implement some algorithm to identify port scans and block them so that they can't even reach us?
Click to expand...
That constant scanning noise in the logs is normal. Dropping the packets is usually the right call since blocking can sometimes consume more resources.
 
Defiler said:
Pretty much the norm, which can be a bit disconcerting if you are watching your logs like a hawk...

I have, however, definitely noticed an uptick in port scans/SYN attempts to certain ports over the last year or so, so I explicitly drop any packets destined for those ports. Port scanners get added to a 30-day blacklist and then dropped at the pre-routing level.

Things are a bit empty at the moment since I did a firmware update on Friday, but most months 10k-15k unique IPs end up in my blacklist...
View attachment 1927089

View attachment 1927090

View attachment 1927091

View attachment 1927092
Click to expand...
Yeah - bot activity is crazy. I fired up a new VPS yesterday and it's already banned 16 users

Status for the jail: sshd
|- Filter
| |- Currently failed: 0
| |- Total failed: 243
| `- Journal matches: _SYSTEMD_UNIT=sshd.service + _COMM=sshd
`- Actions
|- Currently banned: 1
|- Total banned: 16
`- Banned IP list: 92.118.39.14
 
Speedster said:
Yeah - bot activity is crazy. I fired up a new VPS yesterday and it's already banned 16 users

Status for the jail: sshd
|- Filter
| |- Currently failed: 0
| |- Total failed: 243
| `- Journal matches: _SYSTEMD_UNIT=sshd.service + _COMM=sshd
`- Actions
|- Currently banned: 1
|- Total banned: 16
`- Banned IP list: 92.118.39.14
Click to expand...
Yeah, it's nuts! Even after reconnecting my PPPoE session and getting a new IP, the connection attempts and port scans start rolling in 10 seconds later.

Maybe when I'm bored one of these days, I'll fire up a honeypot in docker for sh1ts and giggles and some greater insight...
 
Defiler said:
Yeah, it's nuts! Even after reconnecting my PPPoE session and getting a new IP, the connection attempts and port scans start rolling in 10 seconds later.

Maybe when I'm bored one of these days, I'll fire up a honeypot in docker for sh1ts and giggles and some greater insight...
Click to expand...
1787321854734.png
 
That's just the internet...

Malware on millions of devices around the world always scanning for open ports then ssh to those ports trying to guess credentials, then there is devices part of botnets attacking networks and IP's

Most of these IPs are from people that doesn't even know their devices are compromised.

There was a video on youtube I think with a guy that said let me host a mysql data base server with both username and password as root on a random port with fake/dummy data in it and see what happens.


Non stop port scans and once the port is discovered the attack started and eventually after 2 hours they got access. Backed up all the data and wiped the database with a note to pay bitcoin to get their data back or it will be posted on the internet.
 
cavedog said:
That's just the internet...

Malware on millions of devices around the world always scanning for open ports then ssh to those ports trying to guess credentials, then there is devices part of botnets attacking networks and IP's

Most of these IPs are from people that doesn't even know their devices are compromised.

There was a video on youtube I think with a guy that said let me host a mysql data base server with both username and password as root on a random port with fake/dummy data in it and see what happens.


Non stop port scans and once the port is discovered the attack started and eventually after 2 hours they got access. Backed up all the data and wiped the database with a note to pay bitcoin to get their data back or it will be posted on the internet.
Click to expand...
Yeah, I remember setting up my first home PABX that had ports forwarded with ICMP enabled for a handful of remote extensions without any whitelisting, and I got random calls throughout the night lol. Now everything is over L2TP with IPsec, strong passwords, and IP whitelists, and firewall rules on the PABX... oh ya and disabled ICMP.
 
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter
X