Hacker News new | ask | show | jobs
by fapjacks 2873 days ago
A word of caution: Many (most) IRC spambot detectors check if your connecting IP is also running a Dropbear SSHd service. This can cause you to be k-lined in some instances, and it's not immediately obvious to basically everyone why the anti-spambot bots are flagging your connection. Of course, this isn't Dropbear SSHd's fault. Just something you might want to keep in mind if you use both of these things.
2 comments

It is because dropbear is very common in embedded systems. They are commonly riddled with vulnerabilities, so they are getting hacked almost as soon as they are publicly reachable. This is not because of dropbear, but because they are typically configured with weak credentials that are newer changed. I guess IRC servers see a lot of spam from such devices, so they just drop all systems which has dropbear.
It's probably also because of dropbear since embedded devices often run old versions and dropbear seemed to be vulnerable to severe vulnerabilities in the past:

https://www.cvedetails.com/vulnerability-list/vendor_id-1580...

Huh, what kind of dodgy IRC servers have you been on ;) ? I've never encountered that in years of IRCing from hosts running Dropbear, though I could see it happening.
Heh I should be more precise. During the summer storm season (for example the attacks last week across most of the popular networks), most networks deploy spambot countermeasures that they don't typically run on a normal day. But when they flip the switch, it tests new connections only. So for example I use ZNC and essentially never disconnect. But I disconnected to renew my LetsEncrypt certs during this time and then was k-lined on reconnection on a couple of networks.