Embed Size (px)
Citation preview
The Naughty StepMarek Isalski — @maznu
Faelix Limited — https://faelix.net/
ssh
SMTP IMAP POP
VOIP
Drupal
WordPress
That is one big pile of shit!
The Naughty Step
The Shit Pit The Naughty Step
PushDovirus cover traffic sending 2kbytes with POST / HTTP/1.0
and opening connection to TCP port 25
omg wtf loadavg
– every infosec professional ever
“Security is hard.”
WWW
Cat GIF Blog
make DJT root again!
WWW
Cat GIF Blog
make DJT root again!
apachelogs
fail2ban
Edge Router
WWW
Cat GIF Blog
make DJT root again!
apachelogs
fail2ban
slurry
AMQP
Edge Router
WWW
Cat GIF Blog
make DJT root again!
apachelogs
fail2ban
slurry
spreader
AMQP
Edge Router
WWW
Cat GIF Blog
apachelogs
fail2ban
slurry
spreader
AMQP
passwords are hard
Edge Router
WWW
Cat GIF Blog
apachelogs
fail2ban
slurry
spreader
AMQP
passwords are hard
WWW
Cat GIF Blog
apachelogs
fail2ban
slurry
spreader
AMQP
passwords are hard
Edge Router
Edge Router
fail2ban
slurry
spreader
AMQP
passwords are hard
Edge Router
WWW
Cat GIF Blog
fail2ban
slurry
spreader
AMQP
passwords are hard
Edge Router
fail2ban
slurry
spreader
AMQP
make DJT root again!
Edge Router
fail2ban
slurry
spreader
AMQP
make DJT root again!
DNS RBL
badips.comVIPs
Edge Router
fail2ban
slurry
spreader
AMQP
make DJT root again!
DNS RBL
badips.com
fastnetmon
VIPs
fastnetmon? NetMcr #2!
Edge Router
fail2ban
slurry
spreader
AMQP
make DJT root again!
DNS RBL
badips.com
fastnetmon
VIPs
snort? NetMcr #???
snort
Edge Router
fail2ban
slurry
spreader
AMQP
make DJT root again!
DNS RBL
badips.comVIPs
IPv6
fastnetmon
snort
bots = smartTypical day of traffic in the shitpit:
spike of traffic, bot realises, moves on.
bots = dumbLast 90 days, showing some ongoing, persistent attackers.
Show me the code!
Show me the code!
:-(
Show me the code!
:-)
soon?
Check these out!• fail2ban = tail log files, filter them, perform actions
• fastnetmon = am I being DDoSed? uses NetFlow/etc
• portsentry = am I being portscanned?
• mod_security + OWASP = Web Application Firewall
• snort = intrusion detection system
Check these out!• fail2ban = tail log files, filter them, perform actions
• fastnetmon = am I being DDoSed? uses NetFlow/etc
• portsentry = am I being portscanned?
• mod_security + OWASP = Web Application Firewall
• snort = intrusion detection system
• MikroTik MUM London 2016-11-14 (Monday!)
![Zabezpečení nejen SSH na serveru pomocí Fail2Ban a jednoduchého honeypotu. / JAN LIPOVSKÝ [CYAN RESEARCH & DEVELOPMENT S.R.O.]](https://img.pdfslide.net/doc/110x75/58ec146d1a28ab17408b45c1/zabezpeceni-nejen-ssh-na-serveru-pomoci-fail2ban-a-jednoducheho-honeypotu.jpg)
![FastNetMonを試してみた...“An opensource recipe for detecting DDoS and automate mitigation techniques” [Vicente De Luca, Zendesk] FastNetMonとは 主な機能 パフォーマンス](https://img.pdfslide.net/doc/110x75/5ec6c91cb74ffa63fa51db66/fastnetmone-aoean-opensource-recipe-for-detecting-ddos-and.jpg)
![Como Fazer para Bloquear o UltraSurf, Solução Definitiva [iptables + fail2ban] _ DotSharp](https://img.pdfslide.net/doc/110x75/55cf9b6c550346d033a600d1/como-fazer-para-bloquear-o-ultrasurf-solucao-definitiva-iptables-fail2ban.jpg)
