Item — HN Reader

The source of the wired piece was posted 6 days ago here[0] along with the bleeping computer analysis (better than wired's, IMO)[1]. It was also posted again 3 days ago [2], when I also posted it until I noticed it was a dupe (the dupe detector doesn't seem to work on the guardicore URL).

I've been watching this specific botnet since April, almost 6k attempts/server so far.. it's slow and wide (rarely repeat IPs, max rate was 2/minute, but it's more like 8-20/day now) so most detection approaches won't work (search your logs of sshd for "Received disconnect from", "Did not receive identification string from" and "Connection closed by"). It's also everywhere.. a lot of digital ocean, but also AWS, google, Azure. Government IPs, consumer IPs, IPs reported as part of backbones

[0]: https://news.ycombinator.com/item?id=24217592

[1]: https://news.ycombinator.com/item?id=24208873

[2]: https://news.ycombinator.com/item?id=24245824

3 comments

Looks like none of those submissions got much discussion, so we'll keep this one but change the URL to the original source, from https://www.wired.com/story/a-new-botnet-is-covertly-targeti.... Thanks!

Ars Technica were the ones who reported the story first:

https://arstechnica.com/information-technology/2020/08/new-p...

Are you sure? Bleeping Computer (BC) has a publish time of 2020-08-19T06:00:00-04:00, while Ars Technica has a publish time of 2020-08-19T13:00:16Z.. looks like a 3 hour lead.

Interestingly Guardicore reports 2020-08-19T09:50:36+00:00 suggesting BC (a) can produce a quality article in <9 minutes, (b) there was a prior article (c) BC got a heads-up

> search your logs of sshd for "Received disconnect from", "Did not receive identification string from" ...

This is not reliable advice; many SSH port monitoring solutions (including where I work) will do half-connects like this to determine network availability, leaving these log entries by the thousands.

Half connections to determine availability/existence of SSH is exactly what botnets/nefarious actors do. If you know why you have incomplete connections in your logs, then you can filter/ignore them.. those should only be from known IP blocks which you can filter out, but it's unwise to write all off that traffic as "known"

I agree. My comment was clarifying that your blanket statement implied "if this is seen, it is a problem" and I was providing contradictory evidence that no, it does not always indicate a problem. I personally have been known to telnet to ip:22 while debugging "why doesn't this work"; half-connects are just a part of life, used for both good and evil.

Here's another one I submitted 5 days ago:

https://news.ycombinator.com/item?id=24217477