Hacker News Reader

Hacker News

Comment by blueflow | Hacker News Reader

Full thread

blueflow

I've analyzed the logs of failed login attempts to some SSH server of mine. The most common source AS'es are:

- AS9808 China Mobile Comms, China

- AS4837 China Unicom, China

- AS132203 Tencent, China

- AS211252 Delis LLC, US

- AS209605 Host Baltic, Lithuania

- AS4134 China Telecom, China

- AS16276 OVH, France

- AS134963 Alibaba, Singapore

- AS45102 Alibaba, China

"china bad" or not, i have hard data that most of this spam orginates from chinese or chinese-controlled ASes.

View on HN

Same. 70% of SSH scanners we see is from some (red-)Chinese network. Distant seconds are Russia, Belarus, India. Sometimes, rarely, one sees some Western cloud provider or hoster, but there the activity is typically short-lived due to working abuse-handling.

Sibling comment mentions proxying, which would be an explanation. But still, there is absolutely no working abuse handling on Chinese or Russian networks. Either they do not care or are complicit.

On the one hand, blocking Chinese and Russian IP addresses is and has for a long time been a very efficient way of drastically reducing intrusion attempts. Like it really works.

It's not perfect though: Botnet activity isn't going to come from any particular ASN, but a wide array of unpatched smart fridges and compromised enterprise routers all over the world, so it doesn't crop up in this type of analysis.

Yup same here. I actually wrote a script to visualize this like 10 years ago, had to cap China because the circle would have occupied all of Asia :P

https://files.mastodon.social/media_attachments/files/022/47...

Bet there is someone on Chinese HN commenting the same, but with the location set in America

Check answers to this thread later, i asked a friend from Peking and he will grab some logs during the weekend. Will post the new list of AS'es here.

Or is proxied through them.

There’s pretty much no reason not to proxy through multiple international jurisdictions to avoid detection. Each hop raises the cost of investigation and delay by an order of magnitude.

When I did itsec work we joked that the #1 indicator of an attack from Russia was a sudden dropoff of connections from Russia. I immediately assume that traffic origin has been spoofed

This means very little beyond those hosts being potentially compromised as well.

Yes and no. In movies people talk about using proxies around the world, but network latency quickly gets terrible if you ever actually did this.

It’s inconvenient enough to suggest most western hackers attacking western targets would choose something else if they had the option. Thus either China’s cyber security is terrible and or these attacks are coming from Asia.

Isn't most of the malware these days mostly automated? If so, why would the attackers care about latency? All they have to do is wait for a ping.

Even for automated systems, latency lowers throughout when you’re mostly opening and closing lots of connections.

I thought that hacked machines usually used not as proxies for traffic from origin attack hosts but rather than large fleet of cheap throwaway attacking traffic origins themselves. There's a used to be fashionable definition "fog computing" for using computer resources like that. Except it criminals used this approach before definition emerged.

And as an attacker you couldn't care less about latency when you schedule a job of scanning bunch of ip addresses for vulnerabilities to one of thousands throwaway hacked home pcs in your fleet.

High latency still makes those machines less efficient to both compromise and them use to scan a bunch of ip addresses. ie US hackers hacking Chinese machines to then hack US machines is really inefficient.

Latency doesn’t prevent such things from working, but your better off hacking local resources and then using those resources to scan locally. So all things being equal either there’s a huge surplus of especially vulnerable Chinese machines or a surplus of Asian hackers.

To be clear there could just be a huge surplus of easily hacked Chinese machines, but that itself would be noteworthy.

That's because you have a server in a western country. Would be surprised if the stats were the same for a server in China.

Nope. Overseas offices in those regions still get attacked from the same locations in "the East". There is only a small local component, e.g. because some local ISPs filter SMTP on external gateways, but not internally, e.g. in South America.

Reply on news.ycombinator.com