25 Oct
2016
25 Oct
'16
4:48 p.m.
Guys,
I basically had HILANT:: totally lose the plot because of these telnet botnets that are
hitting port 23/tcp all over the place.
Have any of you guys been affected? I have a feeling as I?ve got a Finnish IP address I
might be one of the Lucky Winners of Putin?s latest ragefest.
FYI, these scripts are smarter than the usual root/Administrator scripts - I logged in and
there had been over 49,000 attempts to log in to the SYSTEM account?
Anyway, I?ve changed the NAT forwarding to another port (if you happen to use HILANT:: via
Telnet it?s now at telnet://hilant.sampsa.com:2389.
Also, is renaming the SYSTEM account likely to break stuff? They seem to be targeting that
specific username so I figured I?d change it to STALIN or something?
Sampsa
25 Oct
25 Oct
4:53 p.m.
New subject: Botnet hits on 23/tcp
Hi Sampsa
I need to check this, *but*, all my ports are non-default, which are
likely to attract significantly less attention.
I'd try a non-default port first and see how you get on.
Mark.
On 10/25/2016 3:48 PM, Sampsa Laine wrote:
Guys,
I basically had HILANT:: totally lose the plot because of these telnet botnets that are
hitting port 23/tcp all over the place.
Have any of you guys been affected? I have a feeling as I?ve got a Finnish IP address I
might be one of the Lucky Winners of Putin?s latest ragefest.
FYI, these scripts are smarter than the usual root/Administrator scripts - I logged in
and there had been over 49,000 attempts to log in to the SYSTEM account?
Anyway, I?ve changed the NAT forwarding to another port (if you happen to use HILANT::
via Telnet it?s now at telnet://hilant.sampsa.com:2389.
Also, is renaming the SYSTEM account likely to break stuff? They seem to be targeting
that specific username so I figured I?d change it to STALIN or something?
Sampsa
4:59 p.m.
New subject: Botnet hits on 23/tcp
On 25 Oct 2016, at 17:53, Mark Wickens <mark at
wickensonline.co.uk> wrote:
Hi Sampsa
I need to check this, *but*, all my ports are non-default, which are likely to attract
significantly less attention.
I'd try a non-default port first and see how you get on.
Mark.
That?s what I?ve done, obviously.
But would changing the SYSTEM user?s name to something else break a lot of stuff?
Sampsa
5:01 p.m.
New subject: Botnet hits on 23/tcp
I'm afraid I can't do that Dave.
On 10/25/2016 3:59 PM, Sampsa Laine wrote:
On 25 Oct
2016, at 17:53, Mark Wickens <mark at wickensonline.co.uk> wrote:
Hi Sampsa
I need to check this, *but*, all my ports are non-default, which are likely to attract
significantly less attention.
I'd try a non-default port first and see how you get on.
Mark.
That?s what I?ve done, obviously.
But would changing the SYSTEM user?s name to something else break a lot of stuff?
Sampsa
5:03 p.m.
New subject: Botnet hits on 23/tcp
On 25 Oct 2016, at 18:01, Mark Wickens <mark at
wickensonline.co.uk> wrote:
I'm afraid I can't do that Dave.
On 10/25/2016 3:59 PM, Sampsa Laine wrote:
Damn it, I was going to rename it to MANNERHEIM.
The Finns on here will get the joke.
Sampsa
On 25 Oct
2016, at 17:53, Mark Wickens <mark at wickensonline.co.uk> wrote:
Hi Sampsa
I need to check this, *but*, all my ports are non-default, which are likely to attract
significantly less attention.
I'd try a non-default port first and see how you get on.
Mark.
That?s what I?ve done, obviously.
But would changing the SYSTEM user?s name to something else break a lot of stuff?
Sampsa
5:50 p.m.
New subject: Botnet hits on 23/tcp
I'd try a non-default port first and see how you
get on.
I'd second that, and I also wouldn't open a TELNET port on the Internet for
anything. Multinet has a perfectly good ssh implementation and I've been running an
open port for that, on a non-standard port number, with no problems at all.
Bob
6:50 p.m.
New subject: Botnet hits on 23/tcp
On 2016-10-25 17:50, Robert Armstrong wrote:
While I certainly think that it does good for your nerves, I really
consider that to just be security through obscurity. Alternate ports is
not really any protection. But it do reduce the noise.
I can understand people who don't like telnet. Cleartext passwords
certainly are not fun.
However, I'm not about to implement ssh for RSX quite yet... So telnet
it is. :-)
Johnny
I'd try a
non-default port first and see how you get on.
I'd second that, and I also wouldn't open a TELNET port on the Internet for
anything. Multinet has a perfectly good ssh implementation and I've been running an
open port for that, on a non-standard port number, with no problems at all. 
6:54 p.m.
New subject: Botnet hits on 23/tcp
On Tue, 25 Oct 2016, Johnny Billquist wrote:
While I certainly think that it does good for your
nerves, I really consider
that to just be security through obscurity. Alternate ports is not really any
protection. But it do reduce the noise.
I can understand people who don't like telnet. Cleartext passwords certainly
are not fun.
However, I'm not about to implement ssh for RSX quite yet... So telnet it is.
:-)
After I noticed quite a few attempts on SYSTEM on MISER:: I now have two
passwords set. The scripts seemed to be confused by the second password
prompt, and intrusion detection gets them long before ... so they don't
even know if they are guessing wrong/right/indifferent.
I am still thinking about turning off telnet though ... I occasionally use
it as a back door in case I lock myself out of my main ssh system. (which
with the protections I have on there I have accidentally done it to myself
once or thrice. :)
Fred
6:56 p.m.
New subject: Botnet hits on 23/tcp
Personally, I also have the system account on my rsx systems setup to not allow logins
over the net. Local users only...
Johnny
Fred <fcoffey at misernet.net> skrev: (25 oktober 2016 18:54:20 CEST)
On Tue, 25 Oct 2016, Johnny Billquist wrote:
--
Sent from my Android device with K-9 Mail. Please excuse my brevity.
While I certainly think that it does good for
your nerves, I really
consider
that to just be security through obscurity.
Alternate ports is not
really any
protection. But it do reduce the noise.
I can understand people who don't like telnet. Cleartext passwords
certainly
are not fun.
However, I'm not about to implement ssh for RSX quite yet... So
telnet it is.
:-)
After I noticed quite a few attempts on SYSTEM on MISER:: I now have
two
passwords set. The scripts seemed to be confused by the second
password
prompt, and intrusion detection gets them long before ... so they don't
even know if they are guessing wrong/right/indifferent.
I am still thinking about turning off telnet though ... I occasionally
use
it as a back door in case I lock myself out of my main ssh system.
(which
with the protections I have on there I have accidentally done it to
myself
once or thrice. :)
Fred
7:19 p.m.
New subject: Botnet hits on 23/tcp
Alternate ports is not really any protection.
I'm not sure I agree. 99.97% (an arbitrarily made up but probably not too far off
number :-) of the stuff you see on the Internet is bots and scripts, and these don't
adapt to non-standard ports. Breaking in would require a human to sit down and some time
figuring out what I've done. Admittedly it's not that hard, but the odds of a
real person wanting to spend his time doing that is pretty small.
Having said that, I also don't enable keyboard authentication on my ssh servers -
it's public key/private key only.
Bob
7:22 p.m.
New subject: Botnet hits on 23/tcp
Nmap can figure it out for you. No need for humans.
Johnny
Robert Armstrong <bob at jfcl.com> skrev: (25 oktober 2016 19:19:20 CEST)
--
Sent from my Android device with K-9 Mail. Please excuse my brevity.
Alternate
ports is not really any protection.
I'm not sure I agree. 99.97% (an arbitrarily made up but probably not
too far off number :-) of the stuff you see on the Internet is bots and
scripts, and these don't adapt to non-standard ports. Breaking in
would require a human to sit down and some time figuring out what I've
done. Admittedly it's not that hard, but the odds of a real person
wanting to spend his time doing that is pretty small.
Having said that, I also don't enable keyboard authentication on my ssh
servers - it's public key/private key only.
Bob
9:20 p.m.
New subject: Botnet hits on 23/tcp
On 2016-10-25 19:51, Robert Armstrong wrote:
nmap will also try and figure out what service is listening on the port.
So, running your ssh server on a non-standard port don't really increase
security. It can still easily be found, even without human intervention.
At which point we're back to the same situation as ssh running on the
standard port. Ie. running on a non-standard port is just security
through obscurity. The actual ssh is just as secure (or not) independent
of the port. And finding it, even on a non-standard port, is not hard,
if someone really wants to. And it can all be automated.
For the actual cracking, nmap isn't the tool. It just provides
information. But for the actual cracking, the same tool works equally
well on standard ports as non-standard ports.
But I do agree that it definitely reduce the noise, so I'm not saying
people shouldn't. I'm just saying that you should not think that it
makes it any safer. :-)
Johnny
Nmap can figure
it out for you. No need for humans.
nmap only tells you what ports are open, and there will be a bunch.
It?s a long way from there to breaking in ? a human is still required.
6:46 p.m.
New subject: Botnet hits on 23/tcp
On 2016-10-25 16:48, Sampsa Laine wrote:
Guys,
I basically had HILANT:: totally lose the plot because of these telnet botnets that are
hitting port 23/tcp all over the place.
Have any of you guys been affected? I have a feeling as I?ve got a Finnish IP address I
might be one of the Lucky Winners of Putin?s latest ragefest.
Affected in the sense that I see lots and lots of connections on MIM and
Magica, yes.
Since my TCP/IP for RSX have detection for this kind of stuff, and
automatically filters traffic out for a while from abusive sites, I
can't say that I've been affected much in any negative way.
FYI, these scripts are smarter than the usual
root/Administrator scripts - I logged in and there had been over 49,000 attempts to log in
to the SYSTEM account?
Yeah, that's the next thing. These scripts get very confused by RSX, as
RSX actually allows you to issue commands without being logged in, so it
does not start by prompting for a username. Scripts usually stalls right
there and then. :-)
Anyway, I?ve changed the NAT forwarding to another
port (if you happen to use HILANT:: via Telnet it?s now at
telnet://hilant.sampsa.com:2389.
Also, is renaming the SYSTEM account likely to break stuff? They seem to be targeting
that specific username so I figured I?d change it to STALIN or something?
I suspect there might be some things that get broken if you rename it,
but I don't know for sure.
But it's hilarious to watch from RSX, how the script-kiddies try and try...
Johnny
9:28 p.m.
New subject: Botnet hits on 23/tcp
On 2016-10-25 12:46, Johnny Billquist wrote:
But it's hilarious to watch from RSX, how the
script-kiddies try and
try...
For a while I had a patched up sshd running. I have the ssh
config/patches
still documented at http://www.eunet.it/tac8.html but never got around
to
writing up the rest. tldr; a root logon with any password seamlessly
drop you
into a 4.3BSD root shell. I thought hilarity would ensue.
A few observations.
Back then it was mostly China.
Some of the more clever botnets would start their brute force password
attempts with a long random password, probably to detect exactly what
I was doing, running a honeypot.
A large number of attempts to wget/curl a rootkit once in. Probably
scripted or copy/paste, but the lack of any follow up commands was
telling.
I had it up for about a year and nobody ever ruined the box. Actually,
only 2 people ever interactively explored the system.
7:51 p.m.
On Tue, 25 Oct 2016 17:48:45 +0300, Sampsa Laine wrote:
Also, is renaming the SYSTEM account likely to break
stuff? They seem to be
targeting that specific username so I figured I?d change it to STALIN or
something?
Instead of renaming it, you may want to disable interactive logins for the
SYSTEM account altogether, or you may want to investigate about tightening
timeouts for the intrusion detection function (see SHOW INTRU command), so
that VMS will not allow logins from accounts for which a certain threshold
has been reached, even if the attacker guesses the password. :)
HTH,
G.
9:23 p.m.
New subject: Botnet hits on 23/tcp
On 2016-10-25 19:51, G. wrote:
On Tue, 25 Oct 2016 17:48:45 +0300, Sampsa Laine
wrote:
Totally agree on disabling interactive logins. But I would perhaps limit
that to just network logins. (I believe VMS can also make that distinction.)
However, if the intrusion system disables the account, it becomes a
rather ugly DOS vector. Not sure how they were thinking there...
Johnny
Also, is renaming the SYSTEM account likely to
break stuff? They seem to be
targeting that specific username so I figured I?d change it to STALIN or
something?
Instead of renaming it, you may want to disable interactive logins for the
SYSTEM account altogether, or you may want to investigate about tightening
timeouts for the intrusion detection function (see SHOW INTRU command), so
that VMS will not allow logins from accounts for which a certain threshold
has been reached, even if the attacker guesses the password. :)
9:44 p.m.
New subject: Botnet hits on 23/tcp
On Tue, 25 Oct 2016 21:23:17 +0200, Johnny Billquist wrote:
Totally agree on disabling interactive logins. But I
would perhaps limit
that to just network logins. (I believe VMS can also make that distinction.)
Yes, I forgot that. At the moment I do not even remember if that does work
with all the available TCP/IP implementations (Digital, Process Software,
etc.). I seem to remember that there was some difference among them in the
way they honoured that flag in the user authorization file...
However, if the intrusion system disables the account,
it becomes a
rather ugly DOS vector. Not sure how they were thinking there...
Actually it does not completely disable the profile: it just sets some
timers which control for how much time an account could not login, even with
the good password. As soon as someone tries a bad password the account gets
flagged as suspect and a timer is started; if the bad password is tried a
certain number of times before the timer expires, the account is flagged as
intruder, a new timer is set and logins for that account are disabled. If
I'm not wrong, this second timer is reset every Nth attempt at login, So the
more you try the more you wait. It's a DOS, but at least auto-restoring.
IIRC, there are hooks in LOGINOUT.EXE that allow for an external program to
be called upon certain events, so that its behaviour can be customised in
some way, but I've never really studied it, so I cannot say for sure. :)
G.
10:04 p.m.
New subject: Botnet hits on 23/tcp
On Tue, 25 Oct 2016, Johnny Billquist wrote:
However, if the intrusion system disables the account,
it becomes a rather
ugly DOS vector. Not sure how they were thinking there...
I've had that happen. Couldn't telnet in, even _locally_ to MISER. Found
out that intrusion detection was throwing out ALL telnet attempts. So, I
used a different VMS host to "set host" instead. :)
20(or some arbitrary number I don't remember) minutes later the intrusion
record was gone.
Fred
26 Oct
26 Oct
2:01 a.m.
New subject: Botnet hits on 23/tcp
On 25 Oct 2016, at 22:23, Johnny Billquist <bqt at
softjar.se> wrote:
On 2016-10-25 19:51, G. wrote:
Here?s the weird thing about VMS (well I guess it?s the TCP/IP Layered Product generating
the events so maybe the weird thing about both MULTINET and HP?s TCP/IP LP):
- DECNET logins are shown as REMOTE/NETWORK
- TCP/IP logins are shown as _LOCAL_.
I always wondered where the logic behind that was.
Is there any way to limit logins to say JUST NETWORK because that would effectively
disable TCP/IP logins, no?
Sampsa
On Tue, 25 Oct 2016 17:48:45 +0300, Sampsa Laine
wrote:
Totally agree on disabling interactive logins. But I would perhaps limit that to just
network logins. (I believe VMS can also make that distinction.)
However, if the intrusion system disables the account, it becomes a rather ugly DOS
vector. Not sure how they were thinking there?
Also, is renaming the SYSTEM account likely to
break stuff? They seem to be
targeting that specific username so I figured I?d change it to STALIN or
something?
Instead of renaming it, you may want to disable interactive logins for the
SYSTEM account altogether, or you may want to investigate about tightening
timeouts for the intrusion detection function (see SHOW INTRU command), so
that VMS will not allow logins from accounts for which a certain threshold
has been reached, even if the attacker guesses the password. :) 
6:24 a.m.
New subject: Botnet hits on 23/tcp
You can limit different types of logins in different ways.
E.g. by defining when you can login in the UAF.
Anyhow, I wouldn't be too concerned about those scripties. The DECUS
server in Finland has been online since early 90's and noone has ever
succeeded to break in.
Telnet was enabled until about a year ago and the SYSTEM account has
been enabled normally.
Two settings are recommended to make the life bitter for the scripties.
First extend the breakin system parameters to make the waiting time
really long and second limit the maximum sessions of telnet or ssh. Then
the scripties will try for a while, but soon they'll be bored and find
an easier target. And your system will not be much affected.
Kari
On 26.10.2016 3:01, Sampsa Laine wrote:
On 25 Oct
2016, at 22:23, Johnny Billquist <bqt at softjar.se> wrote:
On 2016-10-25 19:51, G. wrote:
Here?s the weird thing about VMS (well I guess it?s the TCP/IP Layered Product
generating the events so maybe the weird thing about both MULTINET and HP?s TCP/IP LP):
- DECNET logins are shown as REMOTE/NETWORK
- TCP/IP logins are shown as _LOCAL_.
I always wondered where the logic behind that was.
Is there any way to limit logins to say JUST NETWORK because that would effectively
disable TCP/IP logins, no?
Sampsa
On Tue, 25 Oct 2016 17:48:45 +0300, Sampsa Laine
wrote:
Totally agree on
disabling interactive logins. But I would perhaps limit that to just network logins. (I
believe VMS can also make that distinction.)
However, if the intrusion system disables the account, it becomes a rather ugly DOS
vector. Not sure how they were thinking there?
Also, is renaming the SYSTEM account likely to
break stuff? They seem to be
targeting that specific username so I figured I?d change it to STALIN or
something?
Instead of renaming it, you may want to disable interactive logins for
the
SYSTEM account altogether, or you may want to investigate about tightening
timeouts for the intrusion detection function (see SHOW INTRU command), so
that VMS will not allow logins from accounts for which a certain threshold
has been reached, even if the attacker guesses the password. :) 
31 Oct
31 Oct
1:49 a.m.
New subject: Botnet hits on 23/tcp
And there is a genius from Trinidad trying very hard to get into my
system with username "SHSTEM" all the time :)
On 10/26/2016 12:24 AM, Kari Uusim?ki wrote:
You can limit different types of logins in different ways.
E.g. by defining when you can login in the UAF.
Anyhow, I wouldn't be too concerned about those scripties. The DECUS
server in Finland has been online since early 90's and noone has ever
succeeded to break in.
Telnet was enabled until about a year ago and the SYSTEM account has
been enabled normally.
Two settings are recommended to make the life bitter for the
scripties. First extend the breakin system parameters to make the
waiting time really long and second limit the maximum sessions of
telnet or ssh. Then the scripties will try for a while, but soon
they'll be bored and find an easier target. And your system will not
be much affected.
Kari
On 26.10.2016 3:01, Sampsa Laine wrote:
--
Supratim Sanyal
/*Named must your fear be before banish it you can. - Yoda*/
39.19151 N, 77.23432 W | Ph: +1 469 SANYALS (+1 469 726 9257) |
www.sanyal.org <http://www.sanyal.org/>
Sent via FossaMail <http://www.fossamail.org> on Windows 10 Professional
64-bit / Intel Mobile Core 2 Duo P8700 @ 2533 MHz
<https://www.facebook.com/supratim.sanyal>
On 25 Oct
2016, at 22:23, Johnny Billquist <bqt at softjar.se> wrote:
On 2016-10-25 19:51, G. wrote:
Here?s the weird thing about VMS (well I guess it?s the TCP/IP
Layered Product generating the events so maybe the weird thing about
both MULTINET and HP?s TCP/IP LP):
- DECNET logins are shown as REMOTE/NETWORK
- TCP/IP logins are shown as _LOCAL_.
I always wondered where the logic behind that was.
Is there any way to limit logins to say JUST NETWORK because that
would effectively disable TCP/IP logins, no?
Sampsa
On Tue, 25 Oct 2016 17:48:45 +0300, Sampsa Laine
wrote:
> Also, is renaming the SYSTEM account likely to break stuff? They
> seem to be
> targeting that specific username so I figured I?d change it to
> STALIN or
> something?
Instead of renaming it, you may want to disable interactive logins
for the
SYSTEM account altogether, or you may want to investigate about
tightening
timeouts for the intrusion detection function (see SHOW INTRU
command), so
that VMS will not allow logins from accounts for which a certain
threshold
has been reached, even if the attacker guesses the password. :)
Totally agree on
disabling interactive logins. But I would perhaps
limit that to just network logins. (I believe VMS can also make that
distinction.)
However, if the intrusion system disables the account, it becomes a
rather ugly DOS vector. Not sure how they were thinking there?
16 Nov
16 Nov
7:11 p.m.
New subject: Botnet hits on 23/tcp
I'm a bit late on this thread, but it was, more-than-likely the Mirai bot
(which was subsequently responsible for the internet-wide DDOS a few weeks
ago).. at least that was what kept hitting my VAX several times a second,
until I limited my tcp connection rate to 23/tcp.
Reading the code when it was released, it was pure happenstance that it
tried the "system" account (the code for Mirai made it out a day or so
after the attack....).
Apologies if this was already a part of this thread (I don't see the
entirety of the thread on this device..).
\fwiw
joe
On Tue, Oct 25, 2016 at 10:48 AM, Sampsa Laine <sampsa at mac.com> wrote:
Guys,
I basically had HILANT:: totally lose the plot because of these telnet
botnets that are hitting port 23/tcp all over the place.
Have any of you guys been affected? I have a feeling as I?ve got a Finnish
IP address I might be one of the Lucky Winners of Putin?s latest ragefest.
FYI, these scripts are smarter than the usual root/Administrator scripts -
I logged in and there had been over 49,000 attempts to log in to the SYSTEM
account?
Anyway, I?ve changed the NAT forwarding to another port (if you happen to
use HILANT:: via Telnet it?s now at telnet://hilant.sampsa.com:2389.
Also, is renaming the SYSTEM account likely to break stuff? They seem to
be targeting that specific username so I figured I?d change it to STALIN or
something?
Sampsa
8:40 p.m.
New subject: Botnet hits on 23/tcp
Still going on - interesting how they came up with SHSTEM, SHSTEMT etc weird accounts to
try
http://sanyalnet-openvms-vax.freeddns.org:82/falserver/intrusions.txt
On Nov 16, 2016, at 1:11 PM, Joe Ferraro <jferraro
at gmail.com> wrote:
I'm a bit late on this thread, but it was, more-than-likely the Mirai bot (which was
subsequently responsible for the internet-wide DDOS a few weeks ago).. at least that was
what kept hitting my VAX several times a second, until I limited my tcp connection rate to
23/tcp.
Reading the code when it was released, it was pure happenstance that it tried the
"system" account (the code for Mirai made it out a day or so after the
attack....).
Apologies if this was already a part of this thread (I don't see the entirety of the
thread on this device..).
\fwiw
joe
On Tue, Oct 25, 2016 at 10:48 AM, Sampsa Laine
<sampsa at mac.com> wrote:
Guys,
I basically had HILANT:: totally lose the plot because of these telnet botnets that are
hitting port 23/tcp all over the place.
Have any of you guys been affected? I have a feeling as I?ve got a Finnish IP address I
might be one of the Lucky Winners of Putin?s latest ragefest.
FYI, these scripts are smarter than the usual root/Administrator scripts - I logged in
and there had been over 49,000 attempts to log in to the SYSTEM account?
Anyway, I?ve changed the NAT forwarding to another port (if you happen to use HILANT::
via Telnet it?s now at telnet://hilant.sampsa.com:2389.
Also, is renaming the SYSTEM account likely to break stuff? They seem to be targeting
that specific username so I figured I?d change it to STALIN or something?
Sampsa
2958
days inactive
2980
days old
23 comments
10 participants
participants (10)
-
bob＠jfcl.com -
bqt＠softjar.se -
dugo＠xs4all.nl -
fcoffey＠misernet.net -
gerry77＠mail.com -
jferraro＠gmail.com -
mark＠wickensonline.co.uk -
sampsa＠mac.com -
supratim＠riseup.net -
uusimaki＠exdecfinland.org