Got my first script kiddy
-
Not on AWS and yes I know I can't stop port scanning and bad traffic is a thing. Doesn't stop me from filling out the form. I think to piss off you and the other commenters, I'll write a script to auto fill out AWS abuse forms. Also script kiddy or bot, all the same to me, their hosting provider is getting a message from me
wrote last edited by [email protected]I mean go for it? They literally can't do anything, you might as well complain that fire is hot though. It's part of being in the Internet. They provide safety gloves, via VPCs and firewalls, but if you choose not to use them then.. yeah I mean youre probably gonna get burned
-
I don't have any open ports. I do not care if I did. Port scanning is not authorized traffic.
I would love to see the support request from AWS for this.
Here you go:
Mandiant ASM scanners perform a variety of security-related data-gathering tasks, all intended to positively identify assets and their security posture. The gathered information is analyzed by our research team and proactively published to the owners of this information through our freemium product. No Collection task performed requires authorized access. It is intentionally designed to be light. While your IDS or WAF may have alerted on these scans, these are benign flags and are not indicative of malicious behavior.
If you have further questions, or would like to opt-out, please reply to this message and you will be routed to the appropriate team.
In other words their response was “hey dumbass here’s what happened, now move along”. They didn’t do anything except school you.
-
Not on AWS and yes I know I can't stop port scanning and bad traffic is a thing. Doesn't stop me from filling out the form. I think to piss off you and the other commenters, I'll write a script to auto fill out AWS abuse forms. Also script kiddy or bot, all the same to me, their hosting provider is getting a message from me
Good luck with that, I suppose. Botnets can have thousands, if not hundreds of thousands of infected hosts that will endlessly scan everything on the interwebs. Many of those infected hosts are behind NAT's and your abuse form would be the equivalent of reporting an entire region for a single scan.
But hey! Change the world, amirite?
-
Nice big old port scan. Brand new server too. Just a few days old so there is nothing to find. Don't worry I contacted AWS. Stay safe out there.
If I showed you my WAN-side firewall logs you'd have a panic attack. I have a /29 block and about 10 scans tap one IP or another every second. It's part of being on the internet.
Your domestic home router experiences the exact same thing. Every moment of every day.
Will you report every scan? Every Chinese IP? Every US IP? It's completely common place to have someone 'knock on the door'.
Get off IPv4 anyway and onto IPv6. Good luck to them finding you by chance in there.
-
Good luck with that, I suppose. Botnets can have thousands, if not hundreds of thousands of infected hosts that will endlessly scan everything on the interwebs. Many of those infected hosts are behind NAT's and your abuse form would be the equivalent of reporting an entire region for a single scan.
But hey! Change the world, amirite?
Meh. I know everyone is giving OP the piss, but I used to fret about this type of stuff long time ago. LOL That became a job. Then I learned a little more and realized I wasn't being targeted specifically by some hooded specter in a dimly lit basement emphatically announcing 'I'm in!', but that these were bots. Sophisticated bots tho, I'll give them that.
-
port scanning is not authorized traffic
Hahahahahaha
And?
I think they have a LOT to learn about how the internet 'works' as well as how the internet works.
-
And abuse forms get filled out
wrote last edited by [email protected]Bro. AWS can do jack shit, that's not how it works. You might as well call Toyota next time you see a Camry speeding. All you're going to do is annoy people who in no way can help you with a problem that is your responsibility. I can guarantee they'll tell you you should use private VPCs and entrypoints with security groups, which is what every AWS tutorial starts out by telling you to use.
-
I don't have any open ports. I do not care if I did. Port scanning is not authorized traffic.
I would love to see the support request from AWS for this.
Here you go:
Mandiant ASM scanners perform a variety of security-related data-gathering tasks, all intended to positively identify assets and their security posture. The gathered information is analyzed by our research team and proactively published to the owners of this information through our freemium product. No Collection task performed requires authorized access. It is intentionally designed to be light. While your IDS or WAF may have alerted on these scans, these are benign flags and are not indicative of malicious behavior.
If you have further questions, or would like to opt-out, please reply to this message and you will be routed to the appropriate team.
You have bad takes, so my recommendation is to not block Mandiant ASM so that they are able to find stuff, if you mess up.
-
Meh. I know everyone is giving OP the piss, but I used to fret about this type of stuff long time ago. LOL That became a job. Then I learned a little more and realized I wasn't being targeted specifically by some hooded specter in a dimly lit basement emphatically announcing 'I'm in!', but that these were bots. Sophisticated bots tho, I'll give them that.
My general attitude is similar to yours. Let OP figure out that the reporting and blocking is basically just creating more noise that has to gets filtered out and bot supply is basically infinite.
"It's a learning experience."
-
In other words their response was “hey dumbass here’s what happened, now move along”. They didn’t do anything except school you.
Dude there is a weird disconnect going on in the comments. Yes bots are thing, yes services are abused, yes not everyone plays nice on the Internet, yes you can't control what traffic comes in. I know I'm going to be seeing more this and yes I'm obviously not going to be responding to every one of them.
It was my brand new server's first and I felt like celebrating the event by filling out the AWS abuse form. It was literally copy and paste.
Also, I'm not fussed about what ever services they are running. I didn't ask for it or want it. I told them as much and I going to leave it at that.
No one got schooled. There is nothing wrong with telling someone who shows up at your business to please don't come back. Y'all need to chill.
Well this whole thing was fun but I'm going to get on with my day
-
Not on AWS and yes I know I can't stop port scanning and bad traffic is a thing. Doesn't stop me from filling out the form. I think to piss off you and the other commenters, I'll write a script to auto fill out AWS abuse forms. Also script kiddy or bot, all the same to me, their hosting provider is getting a message from me
This is some cartoon-villain type unhinged behavior.
-
Dude there is a weird disconnect going on in the comments. Yes bots are thing, yes services are abused, yes not everyone plays nice on the Internet, yes you can't control what traffic comes in. I know I'm going to be seeing more this and yes I'm obviously not going to be responding to every one of them.
It was my brand new server's first and I felt like celebrating the event by filling out the AWS abuse form. It was literally copy and paste.
Also, I'm not fussed about what ever services they are running. I didn't ask for it or want it. I told them as much and I going to leave it at that.
No one got schooled. There is nothing wrong with telling someone who shows up at your business to please don't come back. Y'all need to chill.
Well this whole thing was fun but I'm going to get on with my day
I don't think anyone here disagrees that port scanning is bad, nor that you even filed an aws ticket. And congrats on your live service.
But your answers to comments are weird, like this is not only your first server or vps experience with a public interface, but your first time exposing anything to the public web. And even if that's true, there's a first time for everyone.
But man, doubling down and insisting that "port scanning is unauthorized traffic" betrays a certain naivete about how tcpip works.
What you are seeing is not only normal, but AWS can't do anything about it because that's how IP source and destination sockets work.
-
Yes. Don't port scan my shit.
"Good luck with that."
I realize you're inexperienced and excited, but this is truly no big deal. Port scans are quite common and aren't even always malicious. You can use nmap to scan systems yourself - just to see what's out there or to test if your firewalls are woking, etc.
-
My general attitude is similar to yours. Let OP figure out that the reporting and blocking is basically just creating more noise that has to gets filtered out and bot supply is basically infinite.
"It's a learning experience."
Yeah with Amazon's sheer size this has definitely been done before, curious what limits op is going to hit. My guess is they have a quota for submissions, and they'll be banned from submitting tickets.
-
I think they have a LOT to learn about how the internet 'works' as well as how the internet works.
wrote last edited by [email protected]Thing is, for the average consumer of the internet, they have no real concept what's going on behind the webpage with the fancy graphics they happen to be looking at. When I try to explain to them that bots comprise conservatively 40-50% of all internet traffic which is about ~2 zettabytes per 24 hour period, they still don't get it. And really, they don't have to, that's the job of sysadmin. It's still pretty mind blowing.
-
Not on AWS and yes I know I can't stop port scanning and bad traffic is a thing. Doesn't stop me from filling out the form. I think to piss off you and the other commenters, I'll write a script to auto fill out AWS abuse forms. Also script kiddy or bot, all the same to me, their hosting provider is getting a message from me
Port scanning isn't abuse but automatically filing frivilous abuse reports is.
-
Nice big old port scan. Brand new server too. Just a few days old so there is nothing to find. Don't worry I contacted AWS. Stay safe out there.
Switch to IPv6 only and the port scans will go away. The address space is so big that port scanning is difficult, so the usual bots don't bother.
-
"Good luck with that."
I realize you're inexperienced and excited, but this is truly no big deal. Port scans are quite common and aren't even always malicious. You can use nmap to scan systems yourself - just to see what's out there or to test if your firewalls are woking, etc.
And the first time I used nmap on my college network, a professor called up the help desk to report that he had been port scanned.
Then my freind at the help desk told me not to run nmap again and to wait until after dark to pull all the reel to reel tapes out of the dumpster….
-
Switch to IPv6 only and the port scans will go away. The address space is so big that port scanning is difficult, so the usual bots don't bother.
Sure but there are just some things you can’t run over ipv6
-
If I showed you my WAN-side firewall logs you'd have a panic attack. I have a /29 block and about 10 scans tap one IP or another every second. It's part of being on the internet.
Your domestic home router experiences the exact same thing. Every moment of every day.
Will you report every scan? Every Chinese IP? Every US IP? It's completely common place to have someone 'knock on the door'.
Get off IPv4 anyway and onto IPv6. Good luck to them finding you by chance in there.
I ran a Tor relay on one of my spare servers for a while, and my god did that thing get port scanned. Even two years after I stopped hosting the relay, it was still getting pinged every 5-10 seconds (while my other servers tend to get pinged "only" once ever 20-30 seconds).
