4 ms·
Indeed. After running this for a few weeks, most of the playbacks where a couple of seconds and consisted of a script that, once it obtained access, would just
by mergy 7y ago
Indeed. After running this for a few weeks, most of the playbacks where a couple of seconds and consisted of a script that, once it obtained access, would just try and pull down payload sitting on a vulnerable host (in my case on the OVH Euro ISP) and then try to trigger a cron setup and exec in stealth mode on linux.
Rarely did I ever get an interactive shell show someone trying to move through the process. When I did, it was fun to watch. I would say automated 1-2 sec script attacks outnumbered human logins 1000 to 1.
- segfaultbuserr 7y agoThanks for sharing. On the other hand, I heard that running sandboxes to obtain the latest samples of IoT viruses and tracking their evolution is fun.
- tastroder 7y ago> I would say automated 1-2 sec script attacks outnumbered human logins 1000 to 1. After writing my own honeypot to get up to speed with some SSH details and satisfy curiosity I was kind of disappointed by that fact tbh. Though I expected the level of automation and boring stuff, I let a similar fake environment run for weeks in the hope of some human "coming back" for details but it honestly did not reveal more exciting information than you get from honeypots that make their data public. Nobody else ever got to see the forced little ncurses chat I've built in to talk to the human on the other side, shutting that down was not the happiest of moments. But yeah, fun to watch it was.