20 ms·
Spoilerwall: Respond to port scanning requests with movie spoilers
- acchow 9y agoI have tried to parse this sentence 10 times and do not understand. Reading the Github README did not help at all. Can someone explain what is happening?
- deleted 9y ago[deleted]
- indexerror 9y agoLooks like the service returns spoiler for movies when contacted on any port. The attacker would get annoyed if all they see is movie spoilers in the logs.
- roblabla 9y agoI guess it listens on all ports, and sends a random spoiler in plain text when someone connects to said port, before closing the connection. I guess this is supposed to be a joke :)
- saulrh 9y agoThis is a short program that listens on a port and responds to any attempt to connect to that port by sending back movie spoilers. The idea being that anyone that tries to port-scan your machine will be punished by having all the twists in all the best movies revealed.
- banku_brougham 9y agoI like this explanation. But is this good network security?
- deleted 9y ago[deleted]
- laser 9y agoNo, just good humor :)
- sillysaurus3 9y agoIt will make your pentesters sad. We like movies.
- fweespeech 9y agoIt depends if you want to annoy human pentesters to give you the finger. Also, no.
- userbinator 9y agoSomewhat tangentially related: a long time ago, certain scanning tools would crash or otherwise not react well to getting a stream of /dev/urandom. You could consider this the more human version.
- mattstreet 9y agoAnd then someone uses you in an DoS amplification attack instead of going after you directly.
- snorkel 9y agoNope. Good fun but not good security. Better to just refuse the connection.
- ChuckMcM 9y agoI did a killclient which would send back a malformed packet to any ssh handshake and kill the connecting client. This made the pentesters mad. Sending them spoilers will just make the sad, and not so mad.
- pbhjpbhj 9y agoIs that a feature or was that a hack. Did the same packet kill multiple clients? More info?
- ChuckMcM 9y agoIt was a hack, I was getting a nice regular supply of probes from Brazillian addresses, connect to port 22, try 5 different passwords on several different ids ad naseum. So I hacked the openssh server to start mutating the response packets. (very trivial genetic programming where the 'fitness' function value was time to respond between calls, longer = better) That went on for a while until the mutated response was somewhere around 10K bytes and then the call would just stop. A couple of weeks after that I got DDOS'd from a Brazilian botnet. Fail2ban cleaned that up but in practical terms it was easier to just use fail2ban on all of that.
- Crespyl 9y agoThat sounds extremely interesting, do you have a write up or source code somewhere? I'd be interested to hear about more applications of adaptive/genetic code to network security.
- ChuckMcM 9y agoI think it sounds more complicated than it is, think of it as response fuzzing. It is exactly like trying to find vulnerabilities in servers by sending them fuzzed packets except in this case you're trying to find vulnerabilities in clients by returning a fuzzed packet.
- deleted 9y ago[deleted]
- deleted 9y ago[deleted]
- bananabill 9y agoI'll use this along with the metal band logo captcha plugin and be secure as hell.
- krylon 9y ago> metal band logo captcha plugin (Un-)holy captcha, Batman! In retrospect, the idea is so obvious. If I ever get myself a homepage or something, I will put that to good use. =D
- YeGoblynQueenne 9y agoWell, that would get me. Some black and splatter death bands have nigh-on unreadable logos. Or it's just an art I never mastered :(
- tomswartz07 9y agoThe spoiler on Port 5432 is pretty intense. :)
- dom0 9y ago(They're random - different every request)
- btown 9y agoIn all seriousness, if any hacker saw this in their logs, they'd probably say "well played" and redouble their efforts.
- CodeWriter23 9y agoYes we need to fork this into Project Spoilerwall Honeypot.
- tyingq 9y agoA random mix of elevator pitches for various religions might be a better deterrent. Have you heard the good news?
- KekDemaga 9y agoPerhaps questions like "This statement is false", "New Mission: decline this mission", base64 encoded copies of René Magritte's 'this is not a pipe', "God is all powerful, can He make a rock so big that He Himself can't lift it?", "calculate the 2nd prime number", etc to prevent automated AI attacks.
- pavel_lishin 9y ago> "calculate the 2nd prime number" I don't recognize this reference.
- Dylan16807 9y ago> "New Mission: decline this mission" Is that a paradox? If you accept it or have it forced on you then depending on how you interpret the rules you either succeed or fail straightforwardly. If you don't accept it or have it forced on you then nothing happens. There's no loop of logic.
- IncRnd 9y agoYou seem like the sort of person who says, "I always lie."
- aquasarus 9y agoIn an effort to explain what this does, I'd just like to point out how the grammar of the title is meant to be interpreted: [Avoid being scanned] [by spoiling movies] [on all your ports].
- Animats 9y agoThis is like yelling at recorded telemarketing pitches.
- Brian_K_White 9y agoPlot hole. A human responding to a machine would indeed be silly. But this is a machine responding to a machine.
- YeGoblynQueenne 9y agoI sometimes explain my bugs to recorded telemarketing pitches. They can be very helpful that way.
- satsuma 9y agoI'd put it more on the level of setting up a chat bot to talk to another chatbot.
- haberman 9y agoIf you like this, you might like Lenny, the bot designed to waste telemarketers' time. https://toao.net/595-lenny https://toao.net/595-lenny https://www.youtube.com/watch?v=lryrm2CVaVg&list=PLduL71_GKzHHk4hLga0nOGWrXlhl-i_3g https://www.youtube.com/watch?v=lryrm2CVaVg&list=PLduL71_GKz... https://www.reddit.com/r/itslenny/ https://www.reddit.com/r/itslenny/
- deleted 9y ago[deleted]
- coin 9y agoAlso Jolly Roger Telephone Company https://www.youtube.com/channel/UC3OxCWLEmoIhNMm-hnvBm9Q/videos https://www.youtube.com/channel/UC3OxCWLEmoIhNMm-hnvBm9Q/vid...
- a_c 9y agoHow does this work? There is definitely huge demand based in other languages!
- EGreg 9y agoIt's just a recording.
- Sophira 9y agoIt's a little more than that; it also incorporates silence detection so that it waits for the caller to finish talking before 'Lenny' plays its next line. But otherwise, yeah, it's just recordings.
- a_c 9y agoIt does seem natural that it is a recording with silence detection. What about the process of choosing these specific set of dialogue? It is definitely not chosen arbitrarily as lenny's response blend pretty well with marketer's question. I was imagining some analysis on marketer's most used conversation were done.
- Pinkpanthers 9y agoHello there, tired of throwing away money to fake hackers?Worry no more as we can help you with that.We are part of a team consisting of highly efficient developers and hackers.We carry out services like,upgrade school grades, Get passwords for all social networks like Facebook,Instagram,Twitter,Whats app,Line,Skype Hack, We also delete unwanted online pictures and videos on any website,clear criminal records,hack bank accounts for transfers and credit card top ups,application hacking.We do custom software and web development in php, java, asp.net etc.We have 100% records from our client as well as highest repeat hire rate,and a refund policy we work with,our work speak for ourselves, we provide a perfect software solution to all clients.We believe in mutual growing with client and hence we work as a technology partner and consultant for our clients. Contact us .............pinkpantherhackers@gmail.com text +13238351741 ICQ ..........711574456 Thanks as we anticipate working with you now and in the future to come
- droithomme 9y agoIf anyone is planning to use this they might want to review and clean up the dataset. It contains many fake spoilers, as well as non-sequitor obscenities and racist epithets.
- BelleMe 9y agohttps://pitbullandgoldfishes.wordpress.com https://pitbullandgoldfishes.wordpress.com
- pje 9y ago> Fucked up people killing cats after a tornado Gummo is so much more than this though
- zeptomu 9y agoQuick question: Why does 35: chosen = random.choice(movies) at https://github.com/infobyte/spoilerwall/blob/master/server-spoiler.py#L35 https://github.com/infobyte/spoilerwall/blob/master/server-s... have a reference to 'movies'. I thought one had to explicitly pass it to the MyTCPHandler class using the server object? Or is this a special case because of __main__?
- y7 9y agoIf the file gets executed as a script, then __name__ == "__main__", hence L43:53 get executed in the top-level scope, which is also available in the lower levels. This isn't very good writing, since this code will throw exceptions when __name__ != "__main__" (i.e. when import-ing the file as a module), which misleadingly defeats the purpose of having that conditional there.
- zeptomu 9y agoOk, thanks, that makes sense. I knew that top-level variables are global, but didn't know that variables in __main__ share this property (which is e.g. different in the C language).
- AlecSchueler 9y agoif __name__ == __main__ is just a conditional on the top level scope.
- apenwarr 9y agoUsually people write an actual function called main(), and call it from the global level conditional, to avoid this oddness. The actual function called main() has no special meaning in python.
- janwillemb 9y ago> Quick question I'm always wondering why people prefix a question with the statement "quick question". Now is my chance to ask. Is the question typed quickly? Should I imagine you speaking it in a quick manner? Is it meant as "off topic question"? Do you expect an answer quickly? What does it mean when you prefix your question with the words "quick question"?
- dsl 9y agoYou have to be very careful when running this on the telnet port. I had a server set to spew a full color ANSI Nyancat at you when you telneted in. When the Mirai botnet was in full swing, I was pushing 5+ Mbps of Nyancat down to peoples infected webcams and killing my servers CPU.
- Overtonwindow 9y agoI'm sorry, that's terrible, but this sounds hilarious
- batrat 9y agoI laughed so hard. Sorry...
- ChuckMcM 9y agook, I've stopped laughing now and and cleaned up the spilled drink. This is brilliant. You need to team up with a CDN and get them supply cats from the nearest available node. "Unleash the Nyancat!" as they say...
- adrianN 9y agoSurely some enterprising hacker can optimize Nyancat so that a normal server can saturate a gigabit connection without killing the CPU.
- swiley 9y ago"Line Rate Nyan via Direct Networking"
- jwilk 9y agoncfd = open("/dev/nyancat", O_RDONLY); while (...) { sendfile(sockfd, ncfd, ...); }
- nobodyorother 9y agoNo way you can open the nyancat device as read-only. Clearly, it only opens as O_ORLY.
- Satchelmouth 9y agoPort 22, best spoiler.
- Ankaios 9y agoHow about also responding with censored Russian and Chinese news stories, history, and the like? Seems like a decent way to respond to Kremlin astroturfers and friends, too.
- willvarfar 9y agoSo Russia and China put your servers on their blacklists and you get magical protection from hackers whose last hop comes from those countries? Excellent mitigation :)
- jerianasmith 9y agoYou will make your pen testers sad. Others like movies.
- bryanrasmussen 9y agoOne word: AdvertWall
- TimMurnaghan 9y agoDamn it - now I can't go to see the postgres movie as I know how it ends. PostgreSQL received invalid response to SSL negotiation: B
- xz0r 9y agoWhat if someone discovers an RCE in SocketServer?
- krylon 9y ago> Alien vs. Predator: At the end the last guy in the cinema pissed on the screen before leaving. I have never seen a movie summed up in a single sentence so well.
- raverbashing 9y agoIs there one that causes SSH clients trying to brute-force passwords to crash?
- apocalyptic0n3 9y agoNot that I am aware of, but fail2ban is always an option to help with that.
- xfer 9y agoI have moved from port 22 long time ago.
- murcs 9y agoWhy not just tarpit them? Isn't time an issue like in mail spam? If it takes forever to scan you ... https://sysadminblog.net/2013/08/debian-iptables-tarpit/ https://sysadminblog.net/2013/08/debian-iptables-tarpit/
- thomasdd 9y agoNow NMAP has to be rewriten to detect this crazy honey-potting style, by utilising "spoilers.json" file :) I love Python, I just implemented this in my HoneyPot added some connections-counters, statistic and alterting... Anyone want to have as free open-source on github? Let me know.
- jwilk 9y agoIn a remotely similar vein, I sometimes run an open proxy that always responds with a cow: https://github.com/jwilk/cowproxy https://github.com/jwilk/cowproxy