An in-depth analysis of SSH attacks on Amazon EC2 – Wise Honeypot Blog
An in-depth analysis of SSH attacks on Amazon EC2
The research explore investigates Secure Shell (SSH) attacks on Amazon EC2 cloud instances across different AWS zones by means of deploying Brainy Honeypot (SH). It provides an in-depth analysis of SSH attacks, SSH intruders profile, and attempts to identify their tactics and purposes.
Key observations for this research experiment are as following:
- Without disclosure of SH’s IP addresses, in less than ten hours, very first brute-force attempt was detected.
- Over 89% of intruders only targeted one SH in one zone;
- Three threat actors (attacker’s profile) were detected – brute-forcer, infector and commander – by which their source IP addresses were entirely different;
- Typically, blacklists are limited to prevent the very first threat actor i.e. brute-forcer and not the other two;
- Top three (Three) origin country of attacks (based on whois information) were China, Russia and Egypt;
- Some password lists used for brute-forcing SSH service were limited to few passwords and targeted toward compromising other malicious groups infected hosts;
- VoIP services, network appliances and development instruments account names were permanently targeted by intruders;
- Upon a successful password guess, a fresh actor (Infector) appeared to upload malicious files to SH and a connection were made to an outward Directive and Control server;
- A number of tactics were used to hide malicious executable, substitute legitimate executable with infected ones and disable audit functionalities of the operating system;
- A third actor (Commander) employed the infected SH to conduct denial-of-service (DoS) attacks;
- On average intruders’ source IP address was observed for a day and there was no further connection to check the status of the infected host or re-deploy the malicious files.
Embark a Cloud example and you will be shocked with the number of ‘malicious’ attempts against your vanilla Cloud server. Well, you may not be even aware of those if you don’ monitor your network traffic, in and out of your server.
Password brute-force attempt is among one of the common security attacks and adversaries are performing Internet-wide scanning, probing and penetrating of feeble credentials on SSH services.
As one of the use-cases for Brainy Honeypot, I did a research experiment on SSH password brute-force attempts in Amazon EC2 environment to profile the adversaries and identify their tactics.
The following list illustrates details of the experiment.
- Number of Brainy Honeypots: three (Trio)
- Period of experiment: fourteen (14) days
- Begin and end dates: seven May two thousand fourteen to twenty one May 2014
- EC2 regions: North California (US), Oregon (US), Singapore (SG)
- Cloud example base-image: Ubuntu 13.04 – EC2 Micro Example
- IP address: Default EC2 Public IP range for each zone
For each SH, I used EC2 Micro Example as a base which has a SSH service exposed by default. From outward perspective, this resemble like a typical EC2 Micro Example.
SH is tooled with its own unique technologies and at it has not borrowed from any known honeypot solution (as argued here ). Additionally, the technologies that are used within SH cannot be publicly disclosed in order to hide its presences from attackers and make it ideal to profile them.
No domain name was mapped to the SH public IP addresses and their addresses were not disclosed or advertised anywhere.
SSH service was modified to accept authentication through username and password (i.e. keyboard based) as well as public-private keys. An extra username (i.e. git) with a feeble password was created on SSH server. The super user (i.e. root) password was also selected from a common password word-lists. Passwords on each SH were selected differently.
Via the experiment, once an account was compromised and intruder was profiled, the password was switched to a different combination.
Outgoing network traffic was actively monitored and filtered. This was a safe-guard not to permit the infrastructure to be (mis)used to target other Internet hosts
On all observations, I assume there is only one actor behind a single IP address.
- It took less than ten (Ten) hours to receive a very first brute-force attempt on the SH.
- Very first successful password guess happened in five days and the subsequent successful attempt happened in less than two days.
- 91 unique successful password guesses happened during the experiment period.
- Three threat actors were identified during the experiment (Figure 1) in which they sourced from a unique IP address.
Figure 1: Three (Trio) threat actors behind all SSH attacks
Brute-force (bot) attempted to brute force the target to find a correct username and password combination. As expected their behaviour was fully automated.
- Some bots attempted guessing a single username and password combination across all SHs and once unsuccessful, they budge to the next password combination. This behavior was noticed since the bot IP address was observed across SHs in a brief span of time (usually a few seconds);
- Some bots attempted to brute-force a set of username and password combination on a single SH and then moved to the next SH..
- Some bots used threading and initiated parallel connections to the SSH service. This behavior was noticeable as password brute-force attempt did not stop instantly after a successful guess.
- The majority of bots only targeted one SH. 12% of bots source IP address were observed on all the SHs while the remaining 88% only targeted one SH.
- The majority of bots were seen over a single day and a few over span of two days. No further activity was observed from the same source of IP address.
Figure Two: Percentage of intruders that target all Wise Honeypots v.s. one Clever Honeypot
Some bots attempted a limited set of passwords, normally less than five items. The password combination was not something common and it seems like they target particular servers or attempt to penetrate to other malicious groups compromised servers:
Among password there were instances such as “shangaidc” and “lanzhon” (Chinese terms) that was primarily collected on Singapore-based SH however, later on, the passwords were observed on the other zones.
The majority of bots used publicly available password lists such as RockYou or five hundred worst passwords lists (see https://wiki.skullsecurity.org/Passwords).
Targeted user accounts
The majority of attempts were targeted on super accounts such as “root” or “admin”. The other group of very targeted usernames were network appliances, development implements, and VoIP services::
- teamspeak (a VoIP software, popular among movie game players))
- git, svn (code repositories for software development)
- nagios, vyatta (network appliances)
Note: The reader should be reminded that the information were collected only by looking at the registration information (i.e. whois) of the intruder IP address and it should not perceived as the intrusions are orchestrated by a particular nation. A computer savvy person is aware of the fact that source IP addresses can be lightly spoofed.
The following picture demonstrate the origin country of the bot based on the IP whois information.
Figure Three: SSH attacks’ origin countries (top left Singapore and right top and bottom US SHs)
The majority of the attempts were sourced from China. Following by Russia targeting Singapore-based SH and Egypt for US-based SHs. There was no intrusion observed from Russia on US-based SH and from Egypt on Singapore-based SHs across the experiment.
Upon a successful brute-force attempt, bot stopped communicating with SH (only in one example the bot continued brute-forcing however targeting a different user account) and it was interesting to observe there was no further connection from the bot’s source IP address, instead a fresh IP address with the correct username and password was observed to authenticate to the SSH.
The fresh intruder, which I called it Infector, attempted to infect SH by using malicious scripts or binary files.
The majority of the infectors used Secure Copy (scp) to transfer files to SH while there were instances where ‘wget’ was used to download malicious files from an outward server.
Upon successful file upload, infector executed a number of instructions prior and after execution of malicious files. In the example below, infector checks for the available memory on the host, checks for last logged users, switches the permission settings on the malicious script (i.e. httpd.pl) and executes it. Ultimately she clears the history of her guidelines.
In another example (below), infector very first checks whether the system is 64bit or 32bit, then after relieving the malicious binary permissions, it executes the binary and puts it in the background to make sure the process is running even after logging out.
The above two examples were found to be scripted or automated, however, there were few instances that the interaction seems to be manual. Infector was found to key-in the directions, frequently use ‘backspace’ key to correct the typos (see below).
After deployment of the malicious files, no further interactions observed from infectors. In some instances, I even killed the malicious process, in order to see if the infector attempts to reconnect and re-deploy the malicious file.
Infector used a number of technologies to hide the existence of malicious files or substitute legitimate binaries with malicious equivalents. Additionally, the infector attempted to clean her tracks by resetting the audit log file or disabling it. The following is the series of guidelines that infector executed on the SH where she substituted the legitimate binaries with malicious ones and attempted to fountain and execute a malicious kernel module.
The following examples shows the audit logs were disabled (i.e. piped to null).
The following is the output of nestat during the infection.
And the following example shows list of files uploaded and extracted on the SH.
Upon successful deployment of malicious files, in all cases, an outbound connection was initiated from the SH to a C&C server.
Commander, the third actor, is a malicious entity who controls the C&C server and remotely sends directive to infected hosts.
Figure four shows the IRC welcome message from one of the C&C servers.
Figure Four: an example of IRC welcome message on a C&C server hosted on Five.254.116.134 (provider: Voxility)
In most cases, C&C server was IRC based and infected host joined an IRC channel and got assigned a nickname for communication with the Commander.
Via the experiment, the infected SHs were employed to initiate DoS attacks against two outward servers:
And below is the response from the infected host once task is finished
The attack was targeted on port fifty three (DNS) for the duration of sixty seconds and one hundred twenty seconds. Please note that all outbound connections from SH were monitored and filtered in order to prevent any possible harm to outward servers.
That’s all for now. There are still other interesting points that I am investigating and will cover them in the future posts.
How to protect yourself against SSH attacks
Three (Trio) tips that can strongly improve the security stance of your SSH service (there are lots other things your can do but these three will help the most):
- Be cautious of running blacklisting software such as Fail2ban. You may crash your own server (more details https://wiki.archlinux.org/index.php/fail2ban). Instead whitelist the access to the SSH service, if not possible, use an outer blacklist feed to block intruders. Recall, if you use a generic blacklist feed, on average, it blocks 12% of your actual intruders;
- Disable username and password (keyboard-based) authentication on the SSH service. If not possible setup a Two-Factor authentication (more here); and
- Run the SSH service on a non-default port (security by obscurity!).
Malicious scripts and binary files, password lists etc. are available for download to the research community. Get in touch if you interested to a receive a copy.
How much do you know about attackers, targeting your systems? Is your defence strategy and security controls sturdy enough? For thirty days let us display you who targets your systems and what their purposes are.