Hacker News Reader

Comment by noir_lord | Hacker News Reader

> However, please consider adding our scanner (71.6.151.167) to your "whitelist". We are well-known cyber-sec researchers, we aren't trying anything nefarious or evil, and we are being as transparent as possible about our scans.

Sure and while we are at it I'll fetch the lube.

I don't complain about port 22 connections because none of my machines run anything on port 22 (I move SSH to a random port mostly to deter whatever is coming out of China this week).

Even if you do find the port you still have to get around the ssh key's (so unless you are the NSA (j/k)), you could try an exploit against ssh but as it doesn't report its version good look with that and do try to avoid triggering fail2ban.

I'm not a systems administrator (I guess I'd be DevOps) but I know enough to know I don't know enough to disregard best practice.

View on HN

What?

They aren't doing anything funny, nor are they asking you for permission to do anything funny.

They scan your ports. To the unobservant, that can look like they are trying to crack your systems. What is wrong with recognizing their IP (adding it to your "whitelist"), and knowing that it probably isn't something worth investigating.

At the very least, you know their IP, so you can search your logs for it to make sure they aren't being evil.

Call me a cynic (I don't mind) but they do the sweep of the whitelisted address and then two weeks later I get an attempted break-in from a completely different address....

I'm not white-listing anyone I don't know.

You won't whitelist someone because they'll try to break in from an IP other than the one you whitelisted? How does that even begin to make sense?

I think you missed that he was responding to this:

> so you can search your logs for it to make sure they aren't being evil.

This argument doesn't apply if the probe and the attack come from different IPs

Who exactly are "they"? Other than someone with a blog post saying whitelist this ip and claiming "no monkey business, promise!" No time/interest to vet them.

Also, did their webpage get hacked and that ip changed?

Will someone with access to their machines network succumb to maliciously using or selling access to this widely whitelisted ip?

Seven years from now will that ip still be theirs?

I'm not saying that these aren't good points, just that gp's comment about lube was out of place. They aren't trying to fuck you.

And we're not talking about a literal software-implemented whitelist, just a "it probably isn't worth investigating or sending complaints" whitelist. That makes the seven-years point less important.

"They" are me.

What's up with this belief that anybody you haven't heard of is a member of some shadowy organization? I'm a well known security researcher, I give several presentations a year at cybersec conferences, and my blog gets regularly link to from news.ycombinator.com.

Also, the post above excludes the first part of that: "We are happy to add your IP addresses to our blacklist so we won't ever scan you again".

Well, as long as you own that IP. So once whitelisted and you switch to a new IP that IP stays whitelisted.

Its safe to assume on the Internet that anybody that comes to you, is a bot or a scam of some kind. Not a surprise to you, a security consultant.

I understand frustration that you can't convince everyone that you are a good guy. All good guys these days have that problem. Even the good folks at the NSA ( you aren't one of them, are you? )

I kind of like running SSH on the default port as it gives me a list of IPs to firewall against on other web facing services across my infrastructure.

If someone is trying to break into my server(s) via SSH, then I sure as hell don't want them to have access to any other services regardless of how secure they might be.

Couldn't you just have your firewall log attempted connections to 22, regardless of whether or not you have SSH running on it?

I've also seen people run a fake SSH server on 22 and log attempts (if you know that you don't use 22 then any connection attempt on 22 is interesting).

"Just"? That requires more work to set up than my method and offers no additional security benefits as you're still running an open SSH port.

You're falling into the common trap of security through obscurity. But in fact it's very easy to find which port SSH listening on even when you're using a non-standard on. However if you harden SSH properly then it doesnt matter what port it's listening on. So your method is more work for zero gain

Reply on news.ycombinator.com