https://us-cert.cisa.gov/ncas/alerts/aa20-304a
https://www.ic3.gov/Media/News/2020/201030.pdf
library(Rwhois)
https://bcable.net/x/Rproj/shared
source("shared/load_recurse.R")
source("shared/load_varlog.R")
source("shared/parse_rawsplit.R")
source("shared/cleanup_logs.R")
#!/bin/bash
DIR="appel.2020"
IPS="$(cat ips.txt | tr "\n" "|" | sed -r "s/.$//g")"
mkdir tmplogs
ls -1 "$DIR"/messages-* | while read line; do
filename="$(basename "$line")"
grep -E "$IPS" "$line" > tmplogs/"$filename"
done
# delete empty line files
wc -l tmplogs/* | \
grep " 0 tmplogs/messages-" | sed -r "s/.* 0 tmplogs/tmplogs/g" | \
xargs -I{} rm {}
messages_records <- load_varlog("tmplogs", "messages")
messages_records <- raw_populate(messages_records)
messages_records <- cleanup_syslog(messages_records)
ipt_data <- cleanup_iptables(messages_records)
messages_records$Raw.Split <- NA
ipt_data$Raw.Split <- NA
whois_data <- Rwhois::whois_query(ipt_data$IP.Source)
ipt_data$Country.Code <- sapply(whois_data,
function(x){ head(x[x$key == "country", "val"], n=1) }
)
print_ipt <- ipt_data[,c(
"Date", "IP.Source", "Protocol",
"Source.Port", "Destination.Port",
"Country.Code"
)]
names(print_ipt) <- c("Date", "IP.Source", "Proto", "SPT", "DPT", "Country")
print_ipt
## Date IP.Source Proto SPT DPT Country
## 1 2019-11-18 08:47:11 185.191.207.149 TCP 46645 3392 IL
## 2 2019-11-18 08:47:44 185.191.207.149 TCP 46645 3393 IL
## 3 2019-11-18 08:48:26 185.191.207.149 TCP 46645 3396 IL
## 4 2019-11-18 08:48:55 185.191.207.149 TCP 46645 3383 IL
## 5 2019-11-18 08:49:18 185.191.207.149 TCP 46645 3385 IL
## 6 2019-11-18 08:49:19 185.191.207.149 TCP 46645 5000 IL
## 7 2019-11-18 08:49:32 185.191.207.149 TCP 46645 3380 IL
## 8 2019-11-18 08:49:33 185.191.207.149 TCP 46645 4000 IL
## 9 2019-11-18 08:49:41 185.191.207.149 TCP 46645 7770 IL
## 10 2019-11-18 08:50:06 185.191.207.149 TCP 46645 3300 IL
## 11 2019-11-18 08:50:08 185.191.207.149 TCP 46645 9999 IL
## 12 2019-11-18 08:50:10 185.191.207.149 TCP 46645 3386 IL
## 13 2019-11-18 08:50:18 185.191.207.149 TCP 46645 6000 IL
## 14 2019-11-18 08:50:23 185.191.207.149 TCP 46645 3388 IL
## 15 2019-11-18 08:50:43 185.191.207.149 TCP 46645 3395 IL
## 16 2019-11-18 08:50:49 185.191.207.149 TCP 46645 12345 IL
## 17 2019-11-18 08:50:51 185.191.207.149 TCP 46645 3400 IL
## 18 2019-11-18 08:51:07 185.191.207.149 TCP 46645 3391 IL
## 19 2019-11-18 08:51:11 185.191.207.149 TCP 46645 3382 IL
## 20 2019-11-18 08:51:12 185.191.207.149 TCP 46645 3389 IL
## 21 2019-11-18 08:51:19 185.191.207.149 TCP 46645 33908 IL
## 22 2019-11-18 08:51:33 185.191.207.149 TCP 46645 13597 IL
## 23 2019-11-18 08:51:39 185.191.207.149 TCP 46645 3397 IL
## 24 2019-11-18 08:51:45 185.191.207.149 TCP 46645 3398 IL
## 25 2019-11-18 08:52:03 185.191.207.149 TCP 46645 3390 IL
## 26 2019-11-18 08:52:23 185.191.207.149 TCP 46645 3381 IL
## 27 2019-11-18 08:53:37 185.191.207.149 TCP 46645 43389 IL
## 28 2019-11-18 08:54:17 185.191.207.149 TCP 46645 3387 IL
## 29 2019-11-18 08:54:25 185.191.207.149 TCP 46645 3384 IL
## 30 2019-11-18 08:54:43 185.191.207.149 TCP 46645 4001 IL
## 31 2019-11-18 08:54:49 185.191.207.149 TCP 46645 3394 IL
## 32 2019-11-18 08:54:55 185.191.207.149 TCP 46645 3355 IL
## 33 2019-11-18 08:55:07 185.191.207.149 TCP 46645 6666 IL
## 34 2020-04-10 10:10:48 103.205.140.80 TCP 62804 1433 IN
## 35 2020-05-02 07:57:05 103.205.140.70 TCP 64550 1433 IN
## 36 2020-05-09 06:52:42 103.205.140.77 TCP 64433 1433 IN
## 37 2020-05-09 06:52:45 103.205.140.77 TCP 64433 1433 IN
## 38 2020-05-20 18:15:07 103.205.140.70 TCP 55882 1433 IN
## 39 2020-06-15 06:09:19 103.205.140.72 TCP 62890 445 IN
## 40 2020-06-15 06:09:22 103.205.140.72 TCP 62890 445 IN
## 41 2020-08-17 03:25:50 185.191.207.189 UDP 5072 5060 IL
## 42 2020-10-03 16:58:00 92.223.89.167 TCP 80 41375 LU
Dates included are not entirely within the ranges given. The ranges given may have been the exact dates that the Iranians had control of those IP addresses within whatever rented datacenters they were using, or it could be static IP addresses leased to an organization over a long period of time. Even so, the dates given were very short most of the time, and could have been just when the logs they had of attacks were given rather than the known usage from the “other side”.
Quoting the PDF:
Which is in line with what I was saying, however also to note:
It's interesting to note some of this traffic is attacking MS-SQL ports (1433), and SQLmap would in fact attempt to attack those ports. This could mean that it was an actual attempt, or it could also just be them or someone else randomly scanning things. It could also be them scanning anything and everything, try to flag an FBI report, and then scare the crap out of sysadmins through a very advanced propaganda technique.
Regardless there is no SQL server on that host, so they aren't going to get into anything. I serve almost exclusively static content, and nothing special is on this server that isn't directly delivered to you by browsing these pages. This is by design.
I'm a bit confused by the consistent source port of 46645 from the Israeli IP. Clearly scanning for RDP vulnerabilities, so I'm not sure what that's about. Screams poorly written custom scanner or something.
Also, I quite like the attempt on port 12345. Classy.
I C U BRUV