Pattern of network vulnerability scanning coming from all over the world

[Curt_Wilson]

In the last month or so we have seen lots of network vulnerability scanning for the following 3 Threat IDs coming from all over the world.

- MVPower DVR TV Shell Unauthenticated Command Execution Vulnerability(30426)
- WebUI mainfile.php Arbitrary Command Injection Vulnerability(38836)
- Wireless IP Camera Pre-Auth Info Leak Vulnerability(33556)

We don't have products that would be vulnerable to these threats. A single scanning interval seems to always look for only these 3 threats all within a few seconds, coming from the same source IP, and attacking the same destination IP. Then several hours later plus or minus a few hours (seems random), another scan interval occurs, but with a different source IP (and likely different region), and attacking a different destination IP from the last time it occurred. Then it repeats.

Our action for these attacks is "reset-both". Should we be doing some thing different?

We find it strange that this is coming from several regions around the world. Are they all part of the same hacking group?

Has anyone else also seen this same pattern?

[BPry · Accepted solution]

@Curt_Wilson,

Important to remember that unless it's just someone running scripts, most people would run activity through a botnet. This would explain your wide range of IPs coming from different regions.

An additional step to take would be to block the IP for a set period of time. 

[OtakarKlier]

Hello,

I agree with @BPry, definitly set the policy to block-ip. The max time is 3600 seconds (1 hour) so at least they would only be able to try once an hour. If they are comming from the smae source IP you could always just put in a rule to block those IP's. 

Just a thought.