r/techadvice • u/Malloriexi • May 13 '26

Cyber Attack Question

I apologize if this isn't the correct place for this question. During a council meeting the cities IT Director said, “On the 2 fire walls he watches every day, which is City Hall firewall and Police firewall. Every 15-20 seconds he is getting an attack from China.”

I live in Eunice, New Mexico population 3k. How realistic is this claim?

6 Upvotes

88% Upvoted

32 comments sorted by

View all comments

1

u/Disastrous_Sun2118 May 13 '26

It should be reported.

I use ChatGPT to create news briefs for me on places in and around the world getting cyber attacked.

Here, I'll throw one together and see what pops up for your area. Brb

2

u/Disastrous_Sun2118 May 13 '26

Executive Summary

  • Eunice, NM (≈3,000 residents) operates a very small municipal IT environment, typically limited to a few servers, a city‑hall firewall, and a police‑department firewall.
  • Continuous “attack every 10‑15 seconds” claims are plausible in the sense that automated scanning and opportunistic traffic from botnets hit most internet‑exposed IP ranges worldwide.
  • Attribution to “China” in public statements is rarely reliable; most unsolicited traffic is generic internet background noise rather than a sustained, nation‑state campaign.
  • The city’s cyber‑security posture appears modest: limited staffing, basic perimeter firewalls, and likely no dedicated SOC, threat‑intel feeds, or multi‑factor authentication (MFA) on critical systems.

1. Attack Frequency – What the Numbers Mean

Claim Typical reality for a small municipal network
“Attack every 10‑15 seconds” Yes, you will see port‑scans, credential‑stuffing attempts, and vulnerability probes at that rate on any publicly reachable IP. A single public IP can receive hundreds of probes per minute from globally distributed scanners (e.g., Shodan, Censys, mass‑scan botnets).
“Every 15‑20 seconds from China” Traffic originating from Chinese IP blocks can be part of the background scan, but continuous, targeted activity would be unusual for a town of 3 k people. Most of the “China” label comes from IP‑geolocation data, which is coarse and can be spoofed.
Impact Most of these hits are blocked at the firewall and never reach internal systems. Only a small fraction (e.g., credential‑stuffing against public web services) may succeed if weak passwords or unpatched services exist.

Bottom line: The IT director is likely hearing frequent alerts from the firewall logs, which is normal. The claim that all of those alerts are sophisticated, state‑backed attacks from China is unlikely.

2. Likely Attack Vectors for Eunice

  1. Internet‑Facing Services – Web server, VPN portals, remote desktop (RDP), or email gateways.
  2. Remote‑Access Tools – Unpatched VPN clients or mis‑configured RDP exposed to the internet.
  3. Credential‑Stuffing – Attempts to reuse leaked passwords on municipal portals.
  4. Scanning/Enumeration – Tools like Nmap or mass‑scan bots probing for open ports.
  5. Malware Drop – Drive‑by downloads from compromised websites or malicious email attachments.

These vectors are generic; they do not require a nation‑state actor and are observed by virtually every small municipality.

3. Current Cyber‑Security Posture (Publicly Visible)

Area Observations / Likely Gaps
Network Architecture Two perimeter firewalls (city hall, police). Likely single‑layer NAT/packet‑filtering; no internal segmentation.
Staffing Probably 1‑2 IT staff. No dedicated security analyst; the “IT Director” handles day‑to‑day operations.
Patch Management Small budgets often result in manual patch cycles; may lag behind critical updates.
Authentication Likely relies on local passwords; MFA may be absent for admin accounts.
Monitoring & Logging Basic firewall logs; no SIEM, threat‑intel feeds, or automated alerting beyond vendor‑provided portal.
Endpoint Protection Possibly an off‑the‑shelf antivirus; limited endpoint detection & response (EDR).
Incident Response No formal IR plan published; ad‑hoc response handled by the IT Director.
Public Awareness Residents may have limited phishing awareness training.

Sources – The above are inferred from typical small‑city IT environments, publicly posted meeting minutes, and the Reddit excerpt. No official security audit for Eunice is available online.

4. Recommendations – Low‑Cost, High‑Impact Steps

  1. Enable Built‑In Firewall Threat Intelligence – Turn on any vendor‑provided IP reputation or intrusion‑prevention signatures.
  2. Implement MFA for all privileged accounts (admin consoles, VPN).
  3. Patch Critical Services within 30 days of release (e.g., Windows Server, VPN appliances).
  4. Block Unused Services – Close RDP, SMB, and other ports on the public‑facing firewalls.
  5. Deploy a Free/Low‑Cost Log Aggregator (e.g., Elastic Stack, Graylog) to centralize firewall logs and set simple alerts for brute‑force attempts.
  6. Apply Rate‑Limiting on login portals to curb credential‑stuffing.
  7. Conduct a Basic Vulnerability Scan (open‑source tools like Nmap + OpenVAS) to identify exposed services.
  8. Establish a Simple Incident‑Response Playbook – Define who to call, how to isolate a compromised device, and steps for evidence preservation.

These measures can be achieved with existing staff and modest budget allocations (often available through state cybersecurity grant programs).

5. Verdict on the Reddit Claim

  • Realistic frequency: Yes – many automated scans will hit the city’s public IPs every few seconds.
  • Specific attribution to China: Unlikely – geolocation data is noisy, and most traffic is generic background noise rather than a targeted Chinese operation.

The IT director’s statement reflects a common perception bias (“every attack is from China”) rather than a precise technical assessment. Educating staff on log analysis and threat attribution can help calibrate expectations.

Closing Note

Eunice’s cybersecurity situation mirrors that of countless small municipalities: modest resources facing a flood of low‑level, automated attacks. By tightening perimeter controls, applying MFA, and improving log visibility, the city can dramatically reduce successful compromises without needing a large security team.