A commendable attack data dump, lightly analyzed.
In the morning hours (CEST) of April 17, 2024, I found in my social media stream a reference to an Ars Technica article titled UNDER SIEGE — Attackers are pummeling networks around the world with millions of login attempts.
NOTE: A version without trackers but “classical” formatting is available here.Articles about recent or ongoing attacks are not uncommon, but this time I was delighted to see that the report included a link to the actual data, provided by Cisco subsidiary Talos Intelligence.
When I downloaded the data approximately 09:15 CEST, the data
consisted of
5243 unique IP addresses
2105 unique user names
71 unique passwords
I was initially a bit annoyed that the each group of data had apparently not been sorted, so I was a bit worried about possible duplicate entries, but closer inspection showed that I had not needed to worry.
Returning readers will be aware that at nxdomain.no (aka bsdly.net) we have been collecting data on attacks and attackers for some time already, as described in Badness, Enumerated by Robots (also available with nicer formatting but with trackers here) and various material linked from that article.
So naturally my impulse was to see whether there was any overlap between the data Cisco provided and the data collected here.
A few quick rounds for sorting and diffing (or very close equivalents), the results were clear:
of the 5243
unique IP
addresses, none were in the currently
trapped ssh
bruteforcers set or the
historical pop3
gropers set.
of the 2105
unique user
names, a total of 1595
were not
already included in the existing spamtraps list
of the 71 unique passwords, 34 or almost half of the total were not already in the spamtraps list.
If the last item made you chuckle, I am not surprised. But I have also observed at various times that bot herders (or possibly bot feeders) have managed to feed the data the wrong way around to their charges.
The biggest surprise here is that there was no overlap in hosts participating in the campaign against the Cisco customers and hosts that had participated in password guessing against my (for all practical purposes) honeypot system.
One possible explanation could be that the attackers here were targeting only specific products, possibly based on previous intelligence gathering. An alternative explanation could be that they were specifically avoiding certain hosts, such as those running the rather security oriented operating system OpenBSD that we use at this site.
The overlap in user names and passwords mistakenly used as user names with previously collected data here is less surprising.
After this very lightweight analysis, I went to the next logical step
and added the offending IP addresses to the bruteforcers list and
appended a @bsdly.net suffix to the user names and
passwords, and added them to the spamtraps list.
I would like to thank Cisco-Talos for sharing the data on this incident freely.
If you found this article useful, interesting or even annoying, I would like to hear from you.
Good night and good luck.
NOTE: If you follow the references in the various other articles, please keep in mind that the command examples there were written from an OpenBSD perspective. Details of command syntax may be different from the implementations on other Unixlikes.
Posts
