Ask him to email you the upgrade file.
The above are all measures mentioned in the pdf file i shared on other thread.
-
Amazon Deals - ToS - Like us?
Botnet Attack on BSNL Broadband network
- Thread starter Sushubh
- Start date
- Replies 121
- Views 12,265
The above are all measures mentioned in the pdf file i shared on other thread.
A firewall adds next to no latency. A firewall merely blocks traffic on certain ports. IDS/IPS however takes a significant processing power but if the CPU is decent it'll run fine without adding anything to latency.
NAT usually protects the users who have public IPv4 because the incoming ports have to be forwarded on the router even with firewall turned off.
Attackers are looking for easy jobs, they just do a simple dictionary attack of router logins and very rarely use exploits. I often see random Indian and Chinese IP addresses attempting to bruteforce my router SSH by trying simple logins like 'root'. I have since changed my router SSH port to a very high number because attackers usually go after ports <2000 as port scanning takes time.
Last week on my Europe server I had accidentally left the password on minecraft user as 1234 and I forgot that it's SSH was available to WAN, within 2 days someone managed to get in and run a crypto miner that pegged the CPU at 100, luckily the user wasn't sudo and I was able to just delete the user and get rid of it.
NAT usually protects the users who have public IPv4 because the incoming ports have to be forwarded on the router even with firewall turned off.
Attackers are looking for easy jobs, they just do a simple dictionary attack of router logins and very rarely use exploits. I often see random Indian and Chinese IP addresses attempting to bruteforce my router SSH by trying simple logins like 'root'. I have since changed my router SSH port to a very high number because attackers usually go after ports <2000 as port scanning takes time.
Last week on my Europe server I had accidentally left the password on minecraft user as 1234 and I forgot that it's SSH was available to WAN, within 2 days someone managed to get in and run a crypto miner that pegged the CPU at 100, luckily the user wasn't sudo and I was able to just delete the user and get rid of it.
vishalrao
The Global Village Idiot
- Messages
- 6,588
- Location
- Pune
- ISP
- Tata Play 1 gbps, Microscan 500 mbps, Jio AirFiber 100 mbps. Prior PDPL 300 mbps and BSNL 300 mbps.
I noticed a slight improvement in the network although it's not fully restored.
No more packet losses (connection flapping) but download speed is reduced (60-70 mbps) and latency is a bit high (25 ms) to speedtest servers. Upload speed is still very low (under 10 mbps).
edit: there is still some packet loss but very rare now.
No more packet losses (connection flapping) but download speed is reduced (60-70 mbps) and latency is a bit high (25 ms) to speedtest servers. Upload speed is still very low (under 10 mbps).
edit: there is still some packet loss but very rare now.
vishalrao
The Global Village Idiot
- Messages
- 6,588
- Location
- Pune
- ISP
- Tata Play 1 gbps, Microscan 500 mbps, Jio AirFiber 100 mbps. Prior PDPL 300 mbps and BSNL 300 mbps.
Yeah, the steps my LCO told me are pretty much the same as what you shared. I could not re-locate your post or the other thread though so didn't link it.
varkey
I got banned!
Similar thing happened on my VM on Hetzner cloud as well. There was a non-privileged user account which had some basic password that I had created for some troubleshooting and later forgot.
Then few days back got an abuse report from Hetzner saying my VM was taking part in some sort of brute-force attack on SSH/FTP with relevant logs. Investigation pointed to this account and someone had managed to SSH in with the basic password. The attacker installed a cron job which tried to check and re-install the brute force script if it was killed. Anyway, I quickly disabled password based logins and removed the scripts and crons. Will be re-creating that VM later just to be sure.
So if you are using ONU in bridge mode, you should be safe. Because a ONU in bridge mode does not have access to internet. I am using Gennex ONU on MTNL FTTH and my Asus RT-AX88U is dialing the PPPOe connection. I have enabled SSH on LAN side only. Asus routers force you to change default login password at the very beginning of setup wizard so hopefully fingers crossed.
For the last time, NAT is not a security tool.
But yes, most attackers are not smart enough to spend time on exploits. Brute force gets you nowhere if your password is randomly generated 30 characters string.
I completely agree that NAT isn't meant to be a security tool it works as such as many home routers don't have firewalls that block incoming ports by default. So, the only thing that's preventing some ports that are exposed by devices behind a NAT is the NAT itself. It's not the intended function of NAT but it often ends up being one due to negligence of router softwares.
@JB700 But to keep marketing NAT as the saviour of cyber-threats in 2020 simply ends up making normal users feel secure when they really aren't.
Ultimately, in most cases, attackers get access via the OS through executables, phishing etc. Rarely will you come across exploited routers excluding those with default logins.
Ultimately, in most cases, attackers get access via the OS through executables, phishing etc. Rarely will you come across exploited routers excluding those with default logins.
Similar threads
