Is the interweb a safer place or...

[hexjunkie]

Re: Is the interweb a safer place or...

I wonder what ISP hexjunkie is using?

To answer the question:

Home account under Comcast
Backup Web Server under Frontier DSL
Mobile web under Cricket Mobile

Firewall logs on Comcast are much much less than what I see on my Frontier DSL firewall (Same configuration of route all port 80 and 443 traffic to DMZ where the web servers sit and block all other incoming.)

I saw around 3000 blocked attacks/portscans on Comcast
Around 140,000 including Slammer Worm being blocked on Frontier.
All of my networks support a web server (Mac OS X Server on comcast and CENT OS on Frontier)

My cricket mobile card is unusual and I'll post that elsewhere the things I'm noticing with that.

Hope those observations help.

[streaker69]

Re: Is the interweb a safer place or...

Well, it's a pity you aren't closer then. I could hang it off my network, and you'd be staggered with the number of alerts. I can tell you that there is still Slammer out there, for example, and then there are all those botnet attempts at compromising my ancient slackware box (which for some crazy reason looks like winders).

That's why I'm really thinking there's something else wrong with it. I'm going to go pick it up from the field this morning and do a fresh configuration on it just to make sure I didn't miss something initially. I just doubt that the internet has tumbleweeds blowing across all this time.

[shrdlu]

Re: Is the interweb a safer place or...

I'm actually working on this right now, as I still don't believe that it's working completely right. I've been through a couple of different compile options, still no luck. It just doesn't seem right, I'm not seeing any TCP alerts at all. So far, my research hasn't turned up anything useful.

Well, it's a pity you aren't closer then. I could hang it off my network, and you'd be staggered with the number of alerts. I can tell you that there is still Slammer out there, for example, and then there are all those botnet attempts at compromising my ancient slackware box (which for some crazy reason looks like winders).

[Thorn]

Re: Is the interweb a safer place or...

Heh, I thought I messed up my settings... I was on ATT dsl two weeks ago, then they pissed off my wife, now we're on time warner cable. On ATT my firewall was actively blocking about 50 to 70 ip addresses over a two week period. Then it'd release them and start over. So far, I'm blocking 2. I'm sure it will go up, but so far, it's a lot quieter on this network.

Comcast is still quiet.

On the other hand, a client switched over to a 20mbps fiber line recently, and they've been typically getting 2000-3000 attempts per day. Last Tuesday, they logged just under 49,000 attempts in one 24 hour period.

[streaker69]

Re: Is the interweb a safer place or...

I'm actually working on this right now, as I still don't believe that it's working completely right. I've been through a couple of different compile options, still no luck. It just doesn't seem right, I'm not seeing any TCP alerts at all. So far, my research hasn't turned up anything useful.

[barry99705]

Re: Is the interweb a safer place or...

Heh, I thought I messed up my settings... I was on ATT dsl two weeks ago, then they pissed off my wife, now we're on time warner cable. On ATT my firewall was actively blocking about 50 to 70 ip addresses over a two week period. Then it'd release them and start over. So far, I'm blocking 2. I'm sure it will go up, but so far, it's a lot quieter on this network.

[streaker69]

Re: Is the interweb a safer place or...

The sensor as been at it's second location for approximately 24 hours now. It's detected 51 attacks so far. All the ones from the wild were all the same type of attack from different IP's.

This is troublesome because it's hard to determine if it's working or not. Yes, it's picking up some stuff, but I feel as though it really should be detecting more. I'm open to ideas to try and prove that it is indeed working properly.

[streaker69]

Re: Is the interweb a safer place or...

Four of my connections are on Comcast Business accounts, one of them is on an Embarq DSL. I just got back after moving the sensor to the Embarq site and got Snort running just a few minutes ago, as I forgot to make some changes to the server here to accept connections from the new IP. I haven't seen any attacks on it yet, but I'll keep checking on it.

The reason why this was concerning me was with the absence of attacks, I was wondering if the sensor is working at all. It is passing traffic across the bridge just fine and I stress tested it with way more traffic than any internet connection it's going to be on could deliver.

I'd hate to think I wasted my time with putting this little box together and find that I don't really need it now (just kidding). If anyone is interested, I'll be bringing it to Shmoo with me. For the money, it makes a nice remote sensor.

[shrdlu]

Re: Is the interweb a safer place or...

It's early (for me), but I could not resist this. Is it safe? It may seem that way from the few local datapoints that you and others are reporting, but I can say that you'd find greater entertainment deploying that same remote sensor off my own network. Currently, my local high points are the continuing background noise of automated ssh scanners (no new 0 day that I could see, just the same-old same-old), and serious attempts hammering at port 80, even when the machine in question has nothing there (and the port is not open)...

I have no firewall (because I think they're stupid, and a waste of time, and because it would cut down on my entertainment), but I do have an actual router (it's a Cisco 1800 something or other, remember I said it was EARLY).

I'm actually in a backwater as far as attacks go, which makes the ones I do see more interesting. It *does* make me think that it is the ISP (as streaker69 had suggested) that is blocking things for you, since I'm still seeing the slammer and various SQL attacks against the windows machines on the network, and we KNOW how long ago that was.

I wonder what ISP hexjunkie is using? I already saw that others were using Comcast (aka the cable company NOT running the risk of bankrupty right now).

[Thorn]

Re: Is the interweb a safer place or...

Now that you mention it, something caught my eye last night. After hitting that sensor with an namp scan*, I happened to check my own firewall logs. As it turned out, there has been a marked decrease in attacks on my externally facing IPs. My ISP is also Comcast.

Oddly enough, some of my clients have seen increases. Last night one client's firewall got hit with 19,959 attempts on Telnet and RDP from one IP.


* I'm one of the people helping streaker with this project.

[hexjunkie]

Re: Is the interweb a safer place or...

Until you mentioned it.. I hadn't really noticed. Going though my own logs it would appear that my private network on Comcast is much quieter than it was same time last year. Maybe there is something to that. And the trending seems to have started somewhere around October in the decrease of the sweeping (non-targeted) attacks that I usually see. (please verify if this is what you guys are seeing too)

If I had to guess today, I'd say that the ISPs are blocking traffic based on rule, and then implementing only rules that have a very low False Positive Rate. Infer what you wish; but I have no proof of anything, its speculation based on trending. There could be any number of reasons for this (ex. "hacking" isn't as sensationalized as it was in the 90s and in the early 2000's, ISP Censorship, sophistication of attacks have surpassed the standard SNORT rule set, or there was a Script Kiddie Holocaust (no offense intended) over the last few months)

[streaker69]

...are ISP's doing some filtering in the background that they're not making users aware of?

A few years ago when I first started working with Snort whenever I'd deploy a box, it would be no time that I'd be seeing all kinds of attacks from all over the world. Within minutes you'd see some of the nastiest stuff possible come across.

I haven't had a Snort box running for quite some time because of some changes to the infrastructure here, but recently built a new remote sensor out of an Alix2d3 with FreeBSD installed on it. My goal was to get a working remote sensor that could run Snort and Ntop and report back to a central server for data collection. I'll be deploying up to 8 of these throughout our WAN.

So my first one goes in yesterday after spending the weekend testing it on the local LAN to make sure it is actually detecting attacks. It appears to be, so I take it out in the wild to see what it can do. The Alix2d3 has 3 LAN ports, so the way it's configured is two of the ports are configured as a Transparent Bridge with no IP bound to the bridge. The third LAN is connected to the private side of the router to send it's information back to the collector.

It's now been running for 24 straight hours, with nothing between it and the wilds of what used to be the internet. In those 24 hours, it has detected exactly 17 attacks, 15 of which were generated by myself and another person on purpose. The other 2 came from an unknown source.

So, here's the question. Has level of broad attacks and scans across the internet decreased or are ISP's doing some filtering at a higher level? My plan is to move this device to another location that's on a different ISP and see if more attacks are detected. Unfortunately, I only have accounts on two of the ISP's in the area, but it would be interesting to see what kind of attacks would come from the other big player in this area.

What do you guys think is going on?