Nice big old port scan. Brand new server too. Just a few days old so there is nothing to find. Don’t worry I contacted AWS. Stay safe out there.
You must log in or # to comment.
I think a lot of peope understandably misunderstand this post because it doesn’t really explain the situation. After reading OP’s comments I gather that OP put a new server online (not on AWS) and was immediately port scanned by a host that is on AWS. Since OP did not consent to being port scanned, they filled out an abuse complaint with AWS, the hoster the scan came from, out of principle, knowing that it probably won’t do much. Which is totally fine if that is how you want to spend your time.
I think what most commenters thought is that OP was hosting with AWS and complained to them that someone else scanned their server. This does not seem to be the case.
Trying to learn here, are these SSH login attempts on the root user? If not, is it just the firewall logs?
It wasn’t a script kiddy. It wasn’t even a human. You are going to be a very busy individual if you decide to report every port scan you find.
That’s what automation is for
Or just close off the most common vectors, such as disabling root ssh login, doing key-only SSH auth, and block traffic from regions of the world you don’t need to support.
I got a huge reduction in random login attempts when I changed my ssh port away from the default.
(Of course I also have actual security measures like log in by key only)
Uh sorry dude, but no this isn’t a script kiddy, these are bots that scan every IP address every day for any open ports, it’s a constant thing. If you have a public IP, you have people, govs, nefarious groups scanning it. AWS will tell you the same as if you were hosting it locally, close up the ports, put it on a private network. Use a vpc and WAF in AWS’ case.
I get scanned constantly. Every hour of every day dark forced attempt to penetrate our defences.
Not on AWS and yes I know I can’t stop port scanning and bad traffic is a thing. Doesn’t stop me from filling out the form. I think to piss off you and the other commenters, I’ll write a script to auto fill out AWS abuse forms. Also script kiddy or bot, all the same to me, their hosting provider is getting a message from me
I’ll write a script to auto fill out AWS abuse forms
Sounds like you are the script kiddie here
Port scanning isn’t abuse but automatically filing frivilous abuse reports is.
Good luck with that, I suppose. Botnets can have thousands, if not hundreds of thousands of infected hosts that will endlessly scan everything on the interwebs. Many of those infected hosts are behind NAT’s and your abuse form would be the equivalent of reporting an entire region for a single scan.
But hey! Change the world, amirite?
Meh. I know everyone is giving OP the piss, but I used to fret about this type of stuff long time ago. LOL That became a job. Then I learned a little more and realized I wasn’t being targeted specifically by some hooded specter in a dimly lit basement emphatically announcing ‘I’m in!’, but that these were bots. Sophisticated bots tho, I’ll give them that.
My general attitude is similar to yours. Let OP figure out that the reporting and blocking is basically just creating more noise that has to gets filtered out and bot supply is basically infinite.
“It’s a learning experience.”
Yeah with Amazon’s sheer size this has definitely been done before, curious what limits op is going to hit. My guess is they have a quota for submissions, and they’ll be banned from submitting tickets.
I mean go for it? They literally can’t do anything, you might as well complain that fire is hot though. It’s part of being in the Internet. They provide safety gloves, via VPCs and firewalls, but if you choose not to use them then… yeah I mean youre probably gonna get burned
This is some cartoon-villain type unhinged behavior.
Not on AWS and yes I know I can’t stop port scanning and bad traffic is a thing. Doesn’t stop me from filling out the form.
On occasion, if they end up in recidive, I’ll report them to AbuseIPdb. If I did it for all attempts, I’d be as busy as a squirrel in a nut factory, because the bots are thick out in the ether. Like every minute of the day they’re out there throwing rocks at the castle wall. I had to start logrotating because logs were getting so big it was difficult to review and audit. Every so once in a while, they’ll break out the trebuchet and lob something significant, but I’ve had no breaches to date.
My servers are single user only, so buttoning things down is a little less complicated for me.
You contacted Amazon over a port scan?
Yes. Don’t port scan my shit.
Umm…
You know how that works, right? Like, if you don’t want to expose ports, just… don’t expose them. But you can’t prevent port scanning.
I would love to see the support request from AWS for this.
Edit: also, I think “script kiddy” is a bit of a stretch here.
I don’t have any open ports. I do not care if I did. Port scanning is not authorized traffic.
I would love to see the support request from AWS for this.
Here you go:
Mandiant ASM scanners perform a variety of security-related data-gathering tasks, all intended to positively identify assets and their security posture. The gathered information is analyzed by our research team and proactively published to the owners of this information through our freemium product. No Collection task performed requires authorized access. It is intentionally designed to be light. While your IDS or WAF may have alerted on these scans, these are benign flags and are not indicative of malicious behavior.
If you have further questions, or would like to opt-out, please reply to this message and you will be routed to the appropriate team.
port scanning is not authorized traffic
Hahahahahaha
And?
I think they have a LOT to learn about how the internet ‘works’ as well as how the internet works.
Thing is, for the average consumer of the internet, they have no real concept what’s going on behind the webpage with the fancy graphics they happen to be looking at. When I try to explain to them that bots comprise conservatively 40-50% of all internet traffic which is about ~2 zettabytes per 24 hour period, they still don’t get it. And really, they don’t have to, that’s the job of sysadmin. It’s still pretty mind blowing.
And abuse forms get filled out
Bro. AWS can do jack shit, that’s not how it works. You might as well call Toyota next time you see a Camry speeding. All you’re going to do is annoy people who in no way can help you with a problem that is your responsibility. I can guarantee they’ll tell you you should use private VPCs and entrypoints with security groups, which is what every AWS tutorial starts out by telling you to use.
In other words their response was “hey dumbass here’s what happened, now move along”. They didn’t do anything except school you.
Dude there is a weird disconnect going on in the comments. Yes bots are thing, yes services are abused, yes not everyone plays nice on the Internet, yes you can’t control what traffic comes in. I know I’m going to be seeing more this and yes I’m obviously not going to be responding to every one of them.
It was my brand new server’s first and I felt like celebrating the event by filling out the AWS abuse form. It was literally copy and paste.
Also, I’m not fussed about what ever services they are running. I didn’t ask for it or want it. I told them as much and I going to leave it at that.
No one got schooled. There is nothing wrong with telling someone who shows up at your business to please don’t come back. Y’all need to chill.
Well this whole thing was fun but I’m going to get on with my day
I don’t think anyone here disagrees that port scanning is bad, nor that you even filed an aws ticket. And congrats on your live service.
But your answers to comments are weird, like this is not only your first server or vps experience with a public interface, but your first time exposing anything to the public web. And even if that’s true, there’s a first time for everyone.
But man, doubling down and insisting that “port scanning is unauthorized traffic” betrays a certain naivete about how tcpip works.
What you are seeing is not only normal, but AWS can’t do anything about it because that’s how IP source and destination sockets work.
Port scanning is not authorized traffic.
Lol what
I think you should read the terms of your AWS contract. How do you think aws moves instances if not for agents gathering metrics?
And this case is Mandiant, so you’re fine.
Are you sure you’re ready for AWS?
Not on AWS
You have bad takes, so my recommendation is to not block Mandiant ASM so that they are able to find stuff, if you mess up.
“Good luck with that.”
I realize you’re inexperienced and excited, but this is truly no big deal. Port scans are quite common and aren’t even always malicious. You can use nmap to scan systems yourself - just to see what’s out there or to test if your firewalls are woking, etc.
And the first time I used nmap on my college network, a professor called up the help desk to report that he had been port scanned.
Then my freind at the help desk told me not to run nmap again and to wait until after dark to pull all the reel to reel tapes out of the dumpster….
Switch to IPv6 only and the port scans will go away. The address space is so big that port scanning is difficult, so the usual bots don’t bother.
Sure but there are just some things you can’t run over ipv6
Such as?
Some game servers, some ISPs don’t provide IPv6 for (some of) their customers.
Ah game servers yes that’s fair. I found that with Astroneer. If the ISP doesn’t provide V6 though it’s time to switch ISPs.
Majority of traffic to Google is now V6 in most countries. Globally it’s still just under 50%. https://www.google.com/intl/en/ipv6/statistics.html
If the ISP doesn’t provide V6 though it’s time to switch ISPs.
cries in USA
You could always get a tunneled V6 line but it’s a lot of hassle for something you should have by default.
Us europoors may not have golden toilet seats and medical insurance, or V8 Chevvies, or American Size Mayonnaise, but we have our 2a02:7892:1234:::/64!!!
Monopolistic control of buildings by one ISP is illegal in most Euro countries :D
Yup, we don’t have IPv6, so we’d need a VPN or something to do that.
I have 750 bots stuck in HTTP tarpits right now, and another 13 stuck in an SSH tarpit.
You can fight back! If we all fight back just a little bit, then mass-scanning and scraping becomes too expensive to do.
Amen
If I showed you my WAN-side firewall logs you’d have a panic attack. I have a /29 block and about 10 scans tap one IP or another every second. It’s part of being on the internet.
Your domestic home router experiences the exact same thing. Every moment of every day.
Will you report every scan? Every Chinese IP? Every US IP? It’s completely common place to have someone ‘knock on the door’.
Get off IPv4 anyway and onto IPv6. Good luck to them finding you by chance in there.
I ran a Tor relay on one of my spare servers for a while, and my god did that thing get port scanned. Even two years after I stopped hosting the relay, it was still getting pinged every 5-10 seconds (while my other servers tend to get pinged “only” once ever 20-30 seconds).
Haha, I get one of those every other day.
The sad reality of the Internet. Being the first for this new server feels like a “Welcome to the Internet, glad you are here” kind of message
Remember to also report ssh login attempts and unauthorized wordpress access (even if wordpress isn’t installed).
Also, all spam messages.
For SSH it will have to be attempted connections. Ain’t no way I’m putting a forward facing SSH. I’ll deal with any downtime that comes from not being able to access my server remotely
I am reminded of a Richard Pryor skit in which he tells about a football player he knew who bit the fingers off of an opponent who was trying to gouge his eyes through his helmet. When Pryor asked him why he bit the guy’s fingers off he said ‘Everything outside the mask is his. Everything inside the mask is mine.’
