Massive Attack from Brazil

[estradis]

Since a few days we observe an increase of unsuccessful login attempts to certain user mailboxes as well as DDOS attacks and increased flooding with spam. So far, all connections have originated in Brazil. Meanwhile the rate is about 20 logon attempts and about 300 spam delivery attempts per minute.

Since we block every external IP address after the first unsuccessful login, this rate of increase must be assumed to be a targeted attack.

The good news is that our security concept works and HMS has so far withstood all attacks. We are still relatively relaxed about the incident.

For the forensic analysis, however, I'm interested in whether anyone else is affected besides us.

[mattg]

Not affecting me (yet)

Is this only port 25, or are they trying other ports too?

[estradis]

We are still analyzing the ongoing attack. As soon as we have valueable results, I'll let you know. At the moment it looks like only port 25 is affected.

[palinka]

Any of those IPs on this list?

http://hmsfirewallbandemo.ddns.net/sear ... rch=Brazil

Buh-bye spammers...

[estradis]

From midnight until now there have been almost 700 incidents for certain users and they don't only affect port 25. We now classify this as a "real" attack on our users.

We have enough data collected and are ending this by banning all addresses from Brazil until further notice.

Any of those IPs on this list?

http://hmsfirewallbandemo.ddns.net/sear ... rch=Brazil

Buh-bye spammers...

Don't know, might be.

And by the way, I'm not talking about spammers!

[palinka]

And by the way, I'm not talking about spammers!

When the gate is closed it's closed. Chickens on one side, foxes on the other.

[palinka]

We have enough data collected and are ending this by banning all addresses from Brazil until further notice.

By the way, out of curiosity, by what method do you block addresses by country?

[estradis]

We have enough data collected and are ending this by banning all addresses from Brazil until further notice.

By the way, out of curiosity, by what method do you block addresses by country?

GeoIP, directly on the firewall cluster. (It's a payed service.)

[palinka]

Ok thanks.

[estradis]

After a more detailed examination of all our log files, we discoverd that there was a secondary attack on our company that occurred within the network address 185.222.211.0/24, which also is located in Brazil. The secondary attack was not limited to hms. All protocols (smtp, imap, https) were tested as well as exploits, but fortunatly they don't broke through. (Our security concept rocks! )

For legal reasons, we cannot publicly recommend banning the 185.222.211.0/24 network, but I guess each postmaster or admin should be able to make their own decision.

[mattg]

This website says that that set of IP addresses is from the Seychelles, not from Brazil
https://gwhois.org/185.222.211.0+dns

A long, long way from Brazil
(Seychelles is a island group in the Indian Ocean, closest continent is Africa)

[palinka]

This website says that that set of IP addresses is from the Seychelles, not from Brazil
https://gwhois.org/185.222.211.0+dns

A long, long way from Brazil
(Seychelles is a island group in the Indian Ocean, closest continent is Africa)

I've noticed that different geoip services use different datasets, and when there is a discrepancy they all have one of 2 different results. This suggests there are 2 main databases they all draw from.

I just looked at results from ip-api.com which also said Seychelles, and ipapi.com which said England however the geo coordinates matched for both results. Are the Seychelles a British territory still? Neither said Brazil.

[SorenR]

This website says that that set of IP addresses is from the Seychelles, not from Brazil
https://gwhois.org/185.222.211.0+dns

A long, long way from Brazil
(Seychelles is a island group in the Indian Ocean, closest continent is Africa)

I've noticed that different geoip services use different datasets, and when there is a discrepancy they all have one of 2 different results. This suggests there are 2 main databases they all draw from.

I just looked at results from ip-api.com which also said Seychelles, and ipapi.com which said England however the geo coordinates matched for both results. Are the Seychelles a British territory still? Neither said Brazil.

I noticed that I sometimes get two results when querying zz.countries.nerd.dk. I presume it's to do with physical datacenter and owner company being in two different countries.

[palinka]

This website says that that set of IP addresses is from the Seychelles, not from Brazil
https://gwhois.org/185.222.211.0+dns

A long, long way from Brazil
(Seychelles is a island group in the Indian Ocean, closest continent is Africa)

I've noticed that different geoip services use different datasets, and when there is a discrepancy they all have one of 2 different results. This suggests there are 2 main databases they all draw from.

I just looked at results from ip-api.com which also said Seychelles, and ipapi.com which said England however the geo coordinates matched for both results. Are the Seychelles a British territory still? Neither said Brazil.

I noticed that I sometimes get two results when querying zz.countries.nerd.dk. I presume it's to do with physical datacenter and owner company being in two different countries.

If I'm correct about there being 2 "master" databases, maybe zz.countries.nerd.dk uses both and just ignores conflicts?

[mattg]

Are the Seychelles a British territory still? Neither said Brazil.

Yes

[jimimaseye]

Are the Seychelles a British territory still? Neither said Brazil.

Yes

No. We have been giving places up left right and centre.

[johang]

I've noticed that different geoip services use different datasets, and when there is a discrepancy they all have one of 2 different results. This suggests there are 2 main databases they all draw from.

I just looked at results from ip-api.com which also said Seychelles, and ipapi.com which said England however the geo coordinates matched for both results. Are the Seychelles a British territory still? Neither said Brazil.

I noticed that I sometimes get two results when querying zz.countries.nerd.dk. I presume it's to do with physical datacenter and owner company being in two different countries.

If I'm correct about there being 2 "master" databases, maybe zz.countries.nerd.dk uses both and just ignores conflicts?

there is no master for geolocation data; "everyone" ( commercial or non-commercial geolocation provider ) makes their own database..

data might(usually) come from the IP/inetnum allocations done by the RIRs.. that is RIPE; ARIN; APNIC; lacnic; AFRINIC; the "geoloc" attribute is however not mandatory in their databases, and if you are a geoloc-provider you build your database upon the RIRS provided data and propabally add possibility for people or organisations to report "errors" ( according to their knowledge or belief ) of where the IPs actually reside, ( many of these geoloc-providers say they have agreeements with ISPs so they get right information ), so depending on who updated what and when .. you get different results

and then on top of that you have "people" try getting a set of the geoloc-providers ( typically: MaxMind, GooGle, IP2 Location, IPligence, db-ip, eurekapi, ipinfodb, and others ) and match them against each other to get a more "true" database

and of course you have the interesting possibility of a geoloc provider to "answer" you with different answers when you query.. ( could be their internal data structure not being in sync or their "upstream" provider not having their data in sync )

but.. now with this answer we are WAY off from original posters question
but if i was interested i would check out; geoipify.whoisxmlapi.com geo.ipify.org IPInfo.io DB-IP.com IP2Location.com IPData.co IPGeolocation.io Ipapi.com IPStack.com ClearIP.io IPWhois.io ; some of them provide web-api some of them .. an api ..

[palinka]

Thanks for the explanation. Very informative.

[SorenR]

geoipify.whoisxmlapi.com - 1.000 requests monthly free.
geo.ipify.org -1.000 requests monthly free.
IPInfo.io - Free plan for 1,000 requests a day to our API and it's for non-commercial use.
DB-IP.com - No free plan.
IP2Location.com - No free plan.
IPData.co - 1.500 requests daily free.
IPGeolocation.io - Developer plan. 1K Requests Per Day Free.
Ipapi.com - Free 10.000 Lookups per Month.
IPStack.com - Free 10.000 Lookups per Month.
ClearIP.io - *Free account provides up to 50k lookups per month.
IPWhois.io - Our API is free for up to 10,000 requests per month (IP and REFERER identification).

[palinka]

ip-api.com - unlimited lookups free but rate limited to 150/ minute. Bonus: no account / api key necessary.

I hit the rate limit once from a single ip. Since then, I:
1) disconnect with RvdH's disconnect.exe
2) autoban for 1 hour

I think that will prevent rate limiting under the same circumstances (single ip connecting again and again within a single minute). Bonus #2: it prevents redundant ip entries in my firewall ban database and therefore also prevents redundant ips in the firewall rules.

[SorenR]

ip-api.com - unlimited lookups free but rate limited to 150/ minute. Bonus: no account / api key necessary.

I hit the rate limit once from a single ip. Since then, I:
1) disconnect with RvdH's disconnect.exe
2) autoban for 1 hour

I think that will prevent rate limiting under the same circumstances (single ip connecting again and again within a single minute). Bonus #2: it prevents redundant ip entries in my firewall ban database and therefore also prevents redundant ips in the firewall rules.

I believe api.clearip.io focus on a different audience

ip-api.com:

Code: Select all

{
	"as":"AS63949 Linode, LLC",
	"city":"London",
	"country":"United Kingdom",
	"countryCode":"GB",
	"isp":"Linode, LLC",
	"lat":51.5074,
	"lon":-0.127758,
	"org":"Linode, LLC",
	"query":"109.74.192.170",
	"region":"ENG",
	"regionName":"England",
	"status":"success",
	"timezone":"Europe/London",
	"zip":"W1B"
}

api.clearip.io:

Code: Select all

{
	"ip_address":"109.74.192.170",
	"country":"United Kingdom",
	"continent":"Europe",
	"country_flag":"????", <== It's really an icon
	"CountryCode":"GB",
	"City":"St Andrews",
	"Region":"Scotland",
	"lat":56.33871,
	"lng":-2.79902,
	"tz":"",
	"isp":"Linode, LLC",
	"is_anonymous_proxy":false,
	"is_satellite_provider":false,
	"currency":["GBP"],
	"country_details":{
		"name":{
			"common":"United Kingdom",
			"official":"United Kingdom of Great Britain and Northern Ireland",
			"Native":{
				"eng":{
					"common":"United Kingdom",
					"official":"United Kingdom of Great Britain and Northern Ireland"
				}
			}
		},
		"EuMember":true,
		"LandLocked":false,
		"Nationality":"",
		"tld":[".uk"],
		"Languages":{
			"eng":"English"
		},
		"Translations":{
			"FRA":{
				"common":"Royaume-Uni",
				"official":"Royaume-Uni de Grande-Bretagne et d'Irlande du Nord"
			},
			"HRV":{
				"common":"Ujedinjeno Kraljevstvo",
				"official":"Ujedinjeno Kraljevstvo Velike Britanije i Sjeverne Irske"
			},
			"ITA":{
				"common":"Regno Unito",
				"official":"Regno Unito di Gran Bretagna e Irlanda del Nord"
			},
			"NLD":{
				"common":"Verenigd Koninkrijk",
				"official":"Verenigd Koninkrijk van Groot-Brittannië en Noord-Ierland"
			},
			"POR":{
				"common":"Reino Unido",
				"official":"Reino Unido da Grã-Bretanha e Irlanda do Norte"
			},
			"RUS":{
				"common":"??????????????",
				"official":"??????????? ??????????? ?????????????? ? ???????? ????????"
			},
			"SPA":{
				"common":"Reino Unido",
				"official":"Reino Unido de Gran Bretaña e Irlanda del Norte"
			}
		},
		"currency":["GBP"],
		"Borders":["IRL"],
		"cca2":"GB",
		"cca3":"GBR",
		"CIOC":"GBR",
		"CCN3":"826",
		"callingCode":["44"],
		"InternationalPrefix":"00",
		"region":"Europe",
		"subregion":"Northern Europe",
		"Continent":"Europe",
		"capital":"London",
		"Area":242900,
		"longitude":"2 00 W",
		"latitude":"54 00 N",
		"MinLongitude":-13.65,
		"MinLatitude":49.86667,
		"MaxLongitude":2.866667,
		"MaxLatitude":61.5,
		"Latitude":54.560886,
		"Longitude":-2.2125118
	}
}

[palinka]

1) disconnect with RvdH's disconnect.exe
2) autoban for 1 hour

I think that will prevent rate limiting under the same circumstances (single ip connecting again and again within a single minute).

This is not perfect. Since putting it place i went several days without a single duplicate hit. Then today i had two IPs make duplicate hits. In both cases the duplicate connections arrived at the same time down to the same millisecond according to hmailserver log. One of those simultaneous connections got killed immediately and the other died several seconds later. However, all subsequent connections from those IPs were blocked by autoban so at least the damage was limited.

Die, spammer, die!

[SorenR]

1) disconnect with RvdH's disconnect.exe
2) autoban for 1 hour

I think that will prevent rate limiting under the same circumstances (single ip connecting again and again within a single minute).

This is not perfect. Since putting it place i went several days without a single duplicate hit. Then today i had two IPs make duplicate hits. In both cases the duplicate connections arrived at the same time down to the same millisecond according to hmailserver log. One of those simultaneous connections got killed immediately and the other died several seconds later. However, all subsequent connections from those IPs were blocked by autoban so at least the damage was limited.

Die, spammer, die!

That's why I build session locking into AutoBan to avoid errors and stuff.

==> With LockFile(TEMPDIR & "\autoban.lck") <==

Well, that's not the whole truth - LockFile was conceived when I made my custom logger to prevent one session merging log lines with another session.

Code: Select all

Function AutoBan(sIPAddress, sReason, iDuration, sType) : AutoBan = False
   '
   '   sType can be one of the following;
   '   "yyyy" Year, "m" Month, "d" Day, "h" Hour, "n" Minute, "s" Second
   '
   Dim oApp : Set oApp = CreateObject("hMailServer.Application")
   Call oApp.Authenticate(ADMIN, PASSWORD)
   With LockFile(TEMPDIR & "\autoban.lck")
      On Error Resume Next
      Dim oSecurityRange : Set oSecurityRange = oApp.Settings.SecurityRanges.ItemByName("(" & sReason & ") " & sIPAddress)
      If Err.Number = 9 Then
         With oApp.Settings.SecurityRanges.Add
            .Name = "(" & sReason & ") " & sIPAddress
            .LowerIP = sIPAddress
            .UpperIP = sIPAddress
            .Priority = 20
            .Expires = True
            .ExpiresTime = DateAdd(sType, iDuration, Now())
            .Save
         End With
         AutoBan = True
      End If
      On Error Goto 0
      .Close
   End With
   Set oApp = Nothing
End Function

[palinka]

I use it.

[estradis]

This website says that that set of IP addresses is from the Seychelles, not from Brazil
https://gwhois.org/185.222.211.0+dns

A long, long way from Brazil
(Seychelles is a island group in the Indian Ocean, closest continent is Africa)

You' re damn right. Probably I had another IP address open and just read "Brazil" and then mistook it. Ironically, the attacks stopped when I blocked Brazil via GeoIP. That's why I didn't notice the mistake.

At the moment there is silence. But when it starts again, I have absolutely no problem blocking the Seychelles as well ...