frequently attacked from same address

[randomName]

In AiProtection I keep getting an attack from the same address. I just got off the phone with my ISP and they can't do anything about it except off me a $10a month security sweet package to my service. Reminds me of an old joke "Bricks thrown through windows? Call such-n-such" lol but anyways so I'm here wondering what I can do. Is there anything I can do?

TIA

 

[KevTech]

If it is being blocked by the router then why worry about it?

If you turned AiProtection off you would still have all these scans and they would still be blocked by the firewall.

Only difference is nothing logged to make you go oh my god I am being attacked.

 

[RMerlin]

Story-time: back in the early days, I knew this guy who ran an IRC server at the ISP where he worked. There was some kid who kept trying to flood him with ping requests (that used to be an effective attack when most people were on a 28.8K connection, and the attacker would be at a university location).

That administrator dove into his IRC client's source code (he was using ircII), and modified the PING response code to return a 64 KB packet instead of a 64 bytes one).

That poor kid quickly went offline after he sent those couple of ping requests at him, and got flooded with 64 KB replies, being sent through that ISP's backbone... That took care of the problem


Back to OP issue: if the "attack" is always the same (a simple connection attempt to a specific port), then just ignore it. The firewall will stop him there. If however he's attempting multiple attack vector on a regular basis, I guess you could block him either through a manual iptables entry in the INPUT chain, or by using the router's Network Service Filtering.

 

[randomName]

Story-time: back in the early days, I knew this guy who ran an IRC server at the ISP where he worked. There was some kid who kept trying to flood him with ping requests (that used to be an effective attack when most people were on a 28.8K connection, and the attacker would be at a university location).

That administrator dove into his IRC client's source code (he was using ircII), and modified the PING response code to return a 64 KB packet instead of a 64 bytes one).

That poor kid quickly went offline after he sent those couple of ping requests at him, and got flooded with 64 KB replies, being sent through that ISP's backbone... That took care of the problem


Back to OP issue: if the "attack" is always the same (a simple connection attempt to a specific port), then just ignore it. The firewall will stop him there. If however he's attempting multiple attack vector on a regular basis, I guess you could block him either through a manual iptables entry in the INPUT chain, or by using the router's Network Service Filtering.

It's no specific port, just an attack on my router address trying to access the back door, and 'remote command exe.' Would networking services help?

 

[RMerlin]

It's no specific port, just an attack on my router address trying to access the back door, and 'remote command exe.' Would networking services help?

Personally I would simply ignore them. If they come up on the IPS log, then the connection attempts are already blocked anyway.

 

[AndreiV]

It's no specific port, just an attack on my router address trying to access the back door, and 'remote command exe.' Would networking services help?

You are not being "attacked" , what you are seeing is background scatter and bots trying to find unpatched systems. It is happening to everyone , the only change is that AiProtection now shows you what it has blocked. Ai has been blocking these things since day one and previously didn't tell you.

I have 60+ events a week and have seen one IP address 7 times.

If you looked at you router log you would not find the "attacking "IP that was listed by AiProtection, it hasn't even reached your router, you are safe and have nothing to worry about. In many ways it would have been a lot better for Trend Micro to never start this new GUI.

Also , note the type of "attack" , 99% of the ones I see listed are old exploits , some as much as 8 years old, your router is patched against those already.

This is the exploit you are seeing :

EXPLOIT ASUSWRT 3.0.0.4.3 76_1071 LAN Backdoor Comm and Execution (CVE-2014-958 3 )

LOOK at the date , 2014 , patched 4 years ago and no threat to you anyway.

Information on AiProtection :


https://www.asus.com/support/faq/1012070/
https://www.asus.com/AiProtection/


Internet >> AiProtection inspects all data before allowing anything through >> your router firewall . If AiProtection lists something as BLOCKED it has seen something it didn't like and STOPPED it from ever reaching your router .

Let AiProtection do its job, have a coffee and enjoy the weekend.

 

[randomName]

Ok, cool. I just get a little anxiety seeing the same address trying to use a back door exploit, or execute some remote command thing. I'm not use to it. I traded my old RT N66U for the 86U so this is all new to me.

Thanks all!!

 

[randomName]

And next time I have a security question I'll post under General Network Security, thanks

 

[Rolo]

It's like learning biology and then becoming a hypochondriac!