3 ms·
Even sophisticated/organized hackers have free time, and if someone "messed with them" and caused them to need to push a hotfix at 6pm on a Friday because their
by btown 8y ago
Even sophisticated/organized hackers have free time, and if someone "messed with them" and caused them to need to push a hotfix at 6pm on a Friday because their cluster got stuck on your tarpit, you can bet they'll give the tarpit operator some of their attention. Woe to you if they happen to find something that's not patched.
- ianai 8y agoTurn it around. How would hackers adapt if nearly every host responded on ssh the same way? Maybe it’d be behavior worthy of being in openssh or elsewhere. Don’t make it cheap to cheat. This might not be the holy grail, but it’s a good avenue.
- gh02t 8y agoSeems to me like they'd just implement a timeout on waiting for the identification string. I don't know the SSH protocol that well, but from the article it sounds like it's easy to bypass this tarpit if you don't strictly follow the SSH standard. I doubt a timeout would have much impact when connecting to legitimate hosts since they probably respond quickly with their identification, so the fix is easy.