More Than 40% of Global Log-in Attempts Are Malicious (infosecurity-magazine.com) 61
More than 40% of global log-in attempts are malicious thanks to bot-driven credential stuffing attacks, according to the latest report from Akamai. From a report: The cloud delivery provider's latest State of the Internet/Security report for Q4 2017 comprised analysis from over 7.3 trillion bot requests per month. It claimed that such requests account for over 30% of all web traffic across its platform per day, excluding video streaming. However, malicious activity has seen a sharp increase, as cyber-criminals look to switch botnets from DDoS attacks to using stolen credentials to try to access online accounts. Of the 17 billion login requests Akamai tracked in November and December, over two-fifths (43%) were used for credential abuse. The figure rose to a staggering 82% for the hospitality industry.
I'm sorry (Score:3, Funny)
I keep losing my post-it notes.
Re: (Score:3)
Post-it notes cannot be hacked via the internet.
Re: (Score:2)
Misleading (Score:1)
These figures don't paint the full picture. One brute force attack can account for multiple lifetime logins for a single application. We should be measuring by frequency of attack, per application - or find another metric that tells a more wholesome story.
Re: (Score:2)
I have data for about 20â... of porn sites (Score:2)
Once upon a time close to 50â... of adult sites which had logins used my login system I designed. These days it's probably down to 20â... or so, but still a lot of sites. What exactly would you like to know?
Bottom line is this - sites are attacked all day every day.
99% on my vm (Score:5, Informative)
Re: (Score:1)
Comment removed (Score:4, Insightful)
Re: (Score:2)
Re: (Score:2)
I got sick of the spam in my ssh and http logs and also installed fail2ban. It doesn't totally make the problem go away, but it did cut way down on my log file growth rate. I also found increasing the duration of the ban and lowering the number of failed attempts helps, and using a white list for known system admin.
The servers that I have on Comcast IP block get hit harder than the ones I have on Hurricane Electric (co-location business), so it seems likely that these bots/zombies are scanning some ranges o
Re: (Score:2)
Same problem . My mail server sees over 99% of logins as malicious, and fail2ban is very busy. Some of the credentials move from IP to IP within milliseconds, not simultaneous attacks, but sequential from one host to another. My web server logs 8 WordPress login attempts per hour from a specific country, changing every few days. They are fairly clever with the credential tries, but I use a surprising admin login name which I thought would be discreetly obvious, and so far not. General web server attacks are
Re: (Score:2)
Re: (Score:2)
Well, any personal use device is going to have a small number of legitimate logins, so of course it will be utterly swamped by malicious ones in comparison. I see the same thing, but I don't allow passwords for SSH (must have RSA key), and my firewall limits things down to the few places I normally log in from. Everything else is tunneled over SSH.
Re: (Score:2)
Re: 99% on my vm (Score:2)
I run login nodes for an HPC system at work and it is just like my personal severs frankly. Fail2ban cuts it down a lot, but I now rate limit the number of new SSH connections from an IP address at the firewall.
Re: (Score:2)
Same thing at home on my Tomato router... even if I change the SSH port to some random number, quickly there is dozens of try per day, from bots, strangely enough about all the IP addresses comes from USA.
Restrict SSH by IP (Score:3)
If you want some peace (and peace of mind), restrict SSH logins by IP range. Even if your address is dynamic, your ISP only has a certain range of addresses. Find out what that range is, and set your server to only accept login attempts from those addresses. With AWS, this is part of the security setting outside the VM. Your hosting service may differ, of course...
Also in the real world non-standard ports work (Score:3)
Restricting by IP range is a great idea - as long as you'll still have a way in when your ISP suddenly gives you a completely different range.
Also, in theory, attackers could try all ports, so it doesn't matter which port you use. In the real world, most attackers use the standard ports, so choosing a random port below 1024 greatly reduces the number of attacks. That doesn't work against theoretical attackers, but it works against most real ones.
Re: (Score:2)
Is port knocking still a thing?
It is. Kinda a hassle (Score:2)
People still use it. It's effective, despite the fact that theory says attackers *could* try combinations of ports. Personally, I don't use it. Non-standard ports get most of the benefit - reduced attack attempts, and either way it still needs to be secure after an attacker connects to the port.
Well, duh... (Score:5, Informative)
Create a new AWS account, and create a new AWS instance. Allow normal login (not just SSH), and don't do any sort of IP restriction. Watch your logs. Your instance will be noticed very quickly, and will be flooded by bots attempting to brute-force a login. FWIW, the bots are all from Eastern Europe and Asia, or at least they were the last time I tried this (a few years ago). It's pretty crazy.
I don't know about other cloud services, but I wonder about AWS policies. You can set a warning when your monthly spend exceeds a threshold, but you cannot actually set a hard spending limit. This means that, if someone manages to hack into one of your servers (or, better, into your account), they can use as many resources as they want, until you notice and stop them. If you don't notice, they can run up massive bills, which AWS will want you to pay. Seems like a good racket, no wonder those bots are lurking...
Re: (Score:2)
Pretty much Eastern Europe, Poland has been hitting me lately, but I'm sure these are compromised or rented hosts. Asian hosts are so bad I've got permabans on most of the .cn allocations, since I have virtually no legitimate China demand. EU hosts are random. US hosts are surprisingly infrequent, and the rest of the world seems to not even try much, 2% maybe.
I once permabanned .ru, .by, .cz, .ee, .ht, .mk, .pl, .rs, .si, .sk, and .ua. I turn these off occasionally to see what is actively obnoxious and upda
That high? (Score:5, Interesting)
I'd say more like 99% of attempts are malicious.
Re: (Score:2)
Yup. I wrote a script to spot those slow attackers trying to stay under the threshold and hit me every 30 seconds or so. Some did it for months, 24x7. Sort of like the old war dialers, trying not to trigger a response.
These are annoying, but also predictably using dictionary and alphabetic attacks. I'm not worried, of these attackers, 1% ever guess a nonobvious login name, much less password, and I've toyed with fiddling with scripts and trying to encourage attacks on nonexistent credentials just to keep th
Seems unlikely (Score:1)
I don't know how the number could possibly be that low. A bot can iterate through many accounts per second. Oh, sure, timeouts, but any competent bot must surely try to log into many different places while waiting for timers to count down on the ones it has already tried.
Re: (Score:2)
In that situation it is actually very very hard to hold as many idle connections as you could create. Even if you build a custom linux kernel to handle that many, it won't be reliable. Intermediate routers will also turn out to have per-host cache tables, and they'll start silently dropping your connections if you have that many.
In reality I can just look at my logs and see the pattern; each IP only does a few tries per minute, and usually appears to be part of a cluster of IPs that schedule attempts togeth
Believable... (Score:3)
Distinct Or Not (Score:1)
Typically a user will make 1-3 login attempts per log in (>1 only if they have trouble typing) where as malicious login attempts would be much greater when trying to brute force/ use password lists. So is this 40% distinct IP attempts? If not I would expected a much higher percentage.
Use nonstandard ports, tada! (Score:2)
I turned on all email notifications for fail2ban and I was receiving some 3 to 4000 emails a day.
Then I moved my imap, smtp, and ssh servers over to non-standard ports, and I receive maybe an email a week from fail2ban.
Re: Use nonstandard ports, tada! (Score:2)
I moved SSH to a none standard port made no fricking difference.
I have two issues with this ... (Score:1)
And who the fuck gave Akamai permission to track this? The users sure as hell didn't -- which is why the Akamai stuff is on my blocklists in my browsers.
And 40%? That sounds like an incredibly low number, since by now the only reasonable conclusion is the interwebs are populated with millions of assholes all trying to break into things.
The hackers you can't really stop, but the en
The Internet is like the environment (Score:1)
Re: (Score:3)
Obligatory XKCD. [xkcd.com] I think Steve Gibson called this "Internet background radiation," which always seemed like a fairly good way to describe the constant noise of scanners and probes that anyone can see attacking *every* system on the net, non-stop.
got it wrong (Score:1)
I think this headline should have been:
"Only 40% of Global Log-in Attempts Are Malicious"