Chinese Hackers - Taking up Way to much of my Time

[namestrands]

I spend on average 2 hours each day blocking around 10 /24 Subnets from China, either due to scans bruteforce attacks or exploit testing.

I have been doing this for 3 months now.. how many bloody IP's do they have and why the hell is this allowed to continue.

I am tempted to simply put ALL chinese network on my Router's Block list.

Anyone else seeing this sort of thing?

 

[Gerry]

The US State Department has issued some very strong allegations against Chinese hackers and acting on behalf of the Chinese Government as attacking US interests and agencies.

The US is considering making hacking of US agencies a threat to national security and an Act of War. This is something the State Department is not backing down from despite China's protesting of the accusations and the language.

This is something Richard Clarke warned of in his book Cyber War: The Next Threat to National Security and What to Do About It

 

[namestrands]

Over the past 2 years its been bad but this past 6 months I have never seen anything at this level. its around 1 in every 25 visits to the site is chinese probes, bruteforce, VPN and RDC attempts. I was doing some research and read that trojans where found in computer hardware(PCs, Routers, Network Cards, Webcams) shipped across the US and even destined for Government use. ACT OF WAR indeed, I think its time to stop importing and bring the jobs back to the West. Its some scary stuff to be honest.

 

[Theo]

Use CSF and it'd be done for you automatically. http://www.configserver.com/cp/csf.html

 

[draggar]

The US is considering making hacking of US agencies a threat to national security and an Act of War. This is something the State Department is not backing down from despite China's protesting of the accusations and the language.

This is something Richard Clarke warned of in his book Cyber War: The Next Threat to National Security and What to Do About It

This is the new war - cyber war. I think back in the 1990's Russia stated that if they caught someone hacking and interfering with their network / economy in a serious way it was a nukeable offence.

Luckily I don't think any of my sites are big enough to warrant this but some of my forums are getting massive spam attacks. The sad thing is that they change their IP address more often than they post so you're blocking entire IP ranges.

 

[katherine]

Indeed when you take the time to scrub the logs you'll see plenty of automated (for the most part) attacks. Usually it's script kiddies.
I have devised a solution for that: after N failed attempts to log in to a mailbox, the FTP server or SSH - my server will add your IP address to a deny rule in the firewall and keep you out.
You need to audit the suspicious behavior, it can be automated.

 

[hughesey]

Yeah you need to automate that task. It's only going to get worse too so better to get onto it as soon as possible! Cyber war will be where the new battles are played out!