Nice big old port scan. Brand new server too. Just a few days old so there is nothing to find. Don’t worry I contacted AWS. Stay safe out there.
It wasn’t a script kiddy. It wasn’t even a human. You are going to be a very busy individual if you decide to report every port scan you find.
Uh sorry dude, but no this isn’t a script kiddy, these are bots that scan every IP address every day for any open ports, it’s a constant thing. If you have a public IP, you have people, govs, nefarious groups scanning it. AWS will tell you the same as if you were hosting it locally, close up the ports, put it on a private network. Use a vpc and WAF in AWS’ case.
I get scanned constantly. Every hour of every day dark forced attempt to penetrate our defences.
Not on AWS and yes I know I can’t stop port scanning and bad traffic is a thing. Doesn’t stop me from filling out the form. I think to piss off you and the other commenters, I’ll write a script to auto fill out AWS abuse forms. Also script kiddy or bot, all the same to me, their hosting provider is getting a message from me
Port scanning isn’t abuse but automatically filing frivilous abuse reports is.
Good luck with that, I suppose. Botnets can have thousands, if not hundreds of thousands of infected hosts that will endlessly scan everything on the interwebs. Many of those infected hosts are behind NAT’s and your abuse form would be the equivalent of reporting an entire region for a single scan.
But hey! Change the world, amirite?
You contacted Amazon over a port scan?
Yes. Don’t port scan my shit.
Umm…
You know how that works, right? Like, if you don’t want to expose ports, just… don’t expose them. But you can’t prevent port scanning.
I would love to see the support request from AWS for this.
Edit: also, I think “script kiddy” is a bit of a stretch here.
I don’t have any open ports. I do not care if I did. Port scanning is not authorized traffic.
I would love to see the support request from AWS for this.
Here you go:
Mandiant ASM scanners perform a variety of security-related data-gathering tasks, all intended to positively identify assets and their security posture. The gathered information is analyzed by our research team and proactively published to the owners of this information through our freemium product. No Collection task performed requires authorized access. It is intentionally designed to be light. While your IDS or WAF may have alerted on these scans, these are benign flags and are not indicative of malicious behavior.
If you have further questions, or would like to opt-out, please reply to this message and you will be routed to the appropriate team.
port scanning is not authorized traffic
Hahahahahaha
And?
I think they have a LOT to learn about how the internet ‘works’ as well as how the internet works.
Thing is, for the average consumer of the internet, they have no real concept what’s going on behind the webpage with the fancy graphics they happen to be looking at. When I try to explain to them that bots comprise conservatively 40-50% of all internet traffic which is about ~2 zettabytes per 24 hour period, they still don’t get it. And really, they don’t have to, that’s the job of sysadmin. It’s still pretty mind blowing.
And abuse forms get filled out
Bro. AWS can do jack shit, that’s not how it works. You might as well call Toyota next time you see a Camry speeding. All you’re going to do is annoy people who in no way can help you with a problem that is your responsibility. I can guarantee they’ll tell you you should use private VPCs and entrypoints with security groups, which is what every AWS tutorial starts out by telling you to use.
In other words their response was “hey dumbass here’s what happened, now move along”. They didn’t do anything except school you.
Port scanning is not authorized traffic.
Lol what
I think you should read the terms of your AWS contract. How do you think aws moves instances if not for agents gathering metrics?
And this case is Mandiant, so you’re fine.
Are you sure you’re ready for AWS?
Not on AWS
