One of the many sets of data I collect with mcflow<\/tt> on my gateway is traffic counters for TCP SYN packets I receive but do not SYN ACK. I keep the source IP address, the destination port, and of course timestamps and counters. This type of data generally represents one of three things: probing for vulnerable services which I don’t run, probing for services I do run but block from offenders, or probing for botnet-controlled devices.<\/p>\n
The table below shows the top 10 ports for the current week. In the case of ssh and http, I do run those services but mcblockd<\/tt> automatically blocks those who violate my configured policies. I do not run a telnet server anywhere (my IoT devices are of my own design and use ECDH, 2048-bit RSA keys and AES128). I also do not run MS SQL Server or rdp (Remote Desktop). I have no Windows hosts, and if I did, I certainly wouldn’t expose MS SQL Server or Remote Desktop.<\/p>\n
Ports 7547 and 5358 are known to be used by Mirai and its descendants. Port 7547 is also a common port used by broadband ISPs for TR-064 services (specifically, TR-069) to manage home routers.<\/p>\n
| Port<\/th>\n | Packets<\/th>\n | Bytes<\/th>\n<\/tr>\n | |||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 22 (ssh)<\/td>\n | 22116<\/td>\n | 1168688<\/td>\n<\/tr>\n | |||||||||||||||||||||||||||||||||
| 23 (telnet)<\/td>\n | 3740<\/td>\n | 152784<\/td>\n<\/tr>\n | |||||||||||||||||||||||||||||||||
| 80 (http)<\/td>\n | 1601<\/td>\n | 99216<\/td>\n<\/tr>\n | |||||||||||||||||||||||||||||||||
| 1433 (ms-sql-s)<\/td>\n | 1279<\/td>\n | 52288<\/td>\n<\/tr>\n | |||||||||||||||||||||||||||||||||
| 81<\/td>\n | 917<\/td>\n | 38016<\/td>\n<\/tr>\n | |||||||||||||||||||||||||||||||||
| 7547<\/td>\n | 515<\/td>\n | 20620<\/td>\n<\/tr>\n | |||||||||||||||||||||||||||||||||
| 3389 (rdp)<\/td>\n | 199<\/td>\n | 8792<\/td>\n<\/tr>\n | |||||||||||||||||||||||||||||||||
| 5358<\/td>\n | 195<\/td>\n | 8148<\/td>\n<\/tr>\n | |||||||||||||||||||||||||||||||||
| 2323<\/td>\n | 181<\/td>\n | 7384<\/td>\n<\/tr>\n | |||||||||||||||||||||||||||||||||
| 8080<\/td>\n | 154<\/td>\n | 6700<\/td>\n<\/tr>\n<\/table>\n Below is a table showing the SYNs I didn’t SYN ACK by country. This is just the top 10. Note that the top two have large swaths of their IP address space automatically blocked by mcblockd<\/tt> for violating my configured policies. They’re also known state sponsors of cyberattacks, and the evidence is pretty clear here. Much (but not all) of the US stuff is research scanning.<\/p>\n What is perhaps interesting about this data: the lines drawn during WWII and the Cold War don’t appear to have changed. I find this very sad. I’m just a tiny single user running a very modest home network, yet I’m a target of Russia and China. And my network is likely much more secure than the average home network. I assume this means that all of us are being probed all of the time, and some of us are probably regularly compromised. I think we (meaning the entire industry) need to consider completely banning telnet and doing something real about securing IoT devices.<\/p>\n","protected":false},"excerpt":{"rendered":" One of the many sets of data I collect with mcflow on my gateway is traffic counters for TCP SYN packets I receive but do not SYN ACK. I keep the source IP address, the destination port, and of course timestamps and counters. This type of data generally represents one of three things: probing for … <\/p>\n |