10 ms·
Are tarpits still of use these days? I sort of figured that even modern script mass attackers have gotten professionalized and sophisticated enough that they ca
by xoa 6y ago
Are tarpits still of use these days? I sort of figured that even modern script mass attackers have gotten professionalized and sophisticated enough that they can deal with trivial timeouts and the like. I could see actual honeypots still being of use for researchers or blue teams at organizations that are real targets, and ML might even open up some interesting new ways to make those more engaging for longer. But a tarpit doesn't seem like it'd cause bother for drive-by or APT, the former are all about volume so if something takes more than a few seconds just skip it (and maybe flag it as a tarpit for punishment) and an APT will instantly recognize it too.
For individuals and smaller orgs I've sort of felt like keeping your head down, running a wg/ssh bastion with a non-standard port maybe along with single packet auth or even plain old port knocking to reduce log spam from random drive-by is more effective and attainable for places without any sort of dedicated security or even constant in-house IT staff. Running a tarpit on a VPS seems like it'd fail to bother most these days, and running it on an actual IP seems like at best it'd have no effect and at worst if it ever actually held up a scanner and the operator noticed they might decide to direct some actual attention to that IP, or at least throw a mild ddos at it for a bit. Am I wrong or out of date on that? I'm all for sticking it to bad actors and efforts to reduce the economic incentives, but in 2020 tarpits strike me as kind of obsolete with some risk to boot.
- jdc 6y agoDepends on your threat model and how playful you are.
- belorn 6y agoFor individuals and smaller orgs the easiest and by experience the best practice is to use a certificate (or generated and never to be reused password) for ssh authentication, install server monitoring, and then simply observe if the spam from random drive-by causes enough resource drain that would validate further work. Most likely it won't. Running a tar pit is a bit like installing a trap on a bike in order to teach bike thieves a lesson. It won't really reduce the problem, but for a lot of people the idea of vengeance gives a bit of a warm happy feeling.
- toyg 6y ago> Running a tar pit is a bit like installing a trap on a bike in order to teach bike thieves a lesson. It's more like approaching a thief and persuading him to steal some bike "just around the corner", then guiding him around endlessly. While he's following you, he's also not stealing anything from anyone, his attention (which is naturally finite) gets drained - even just a little bit - to the benefit of the community as a whole. It's not necessarily about vengeance.
- venatiodecorus 6y agowell what they're saying is sure you can do this but this hypothetical bike thief isn't going to follow you very far. ime this would seem to be the case. most ssh spam is very dumb, just looking for low hanging fruit w/ default credentials, and will likely move on very quickly without success.
- ed25519FUUU 6y agoIt sounds like you’re both trapped in this scenario.
- kebman 6y agoTangent story. Two friends of mine went backpacking to Amsterdam, short pants and all. When they got out of the train in the evening, a friendly guy approached them and asked if they were looking for a hotel. They said yes, so he told them to follow him. Delighted to be greeted in this way, they did. First they went down the regular path up Damrak to get to Leidseplein, but slowly and imperceptibly the streets were getting narrower and narrower, until they finally reached a dead end. That's when the guy whirled around, flipped out a small pocket knife and wheezed to them, "Gimme all your cash! NOW!" The guys looked at each other, and then looked at him, and then one of the guys calmly told him, "Look, we're two guys, and you're just one. Even if you get one of us, the other will beat your head in. You can't win this." The mugger looked puzzled for a moment, but then he retorted, "Ok, give me half your money then, and nobody gets hurt!" Not wanting to be the first guy who got stabbed, they agreed that, "Fine, we'll give you half! But only if you promise to not stab us." And so the deal went down, and they had finally arrived in Amsterdam.
- kachnuv_ocasek 6y ago> if something takes more than a few seconds just skip it (and maybe flag it as a tarpit for punishment) Good. Isn't that the point? Also, I like your use of the word punishment as something negative in this context.
- cornstalks 6y ago> I like your use of the word punishment as something negative in this context. Some people decide to launch a DDOS attack or something like that in retaliation. It doesn't always happen, but there have been instances of an attacker being thwarted and then trying to punish the victim (who successfully defended themself) in some other way.
- xoa 6y agoYeah, this is what I had in mind. Right now the economics there seem in favor of attackers since botnet resources for low level DDOS are plentiful. While major players have plenty of measures for mitigation, for a residential/SOHO/SMB/smaller NPO even a very cheap DDOS or actual more focused (but still automated) hunt for vulnerabilities and unpatched targets might cause real trouble. Economics works both ways unfortunately, efforts like tarpits in principle aim to make mass scans more expensive and troublesome reducing the incentives. But attackers in turn can work to make it more expensive and troublesome to run tarpits or the like, and certainly have incentive to see them not spread. So who has the best multipliers and resources? If "we" (both the overall world community and subsections) were able significantly reduce the resources available to attackers for DDOS making vengeance/example setting more expensive that'd help. But it seems like it's going the other way if anything :(
- pnutjam 6y agoDon't forget fail2ban or something similar. 2 hour lockout after 4 bad tries does wonders to discourage bots.
- protomyth 6y agoWell, if you use certificates, you can immediately ban anyone trying to do password authentication.
- dawnerd 6y agoJust an obvious protip to test that your cert works before banning password auths. I uh, found out the hard way.
- protomyth 6y agoYeah, cannot say I've never done that. Test then Ban.
- efreak 6y agoI never had an issue with authentication. My issue was a typo in sudoers (I allowed a user to view syslog, iirc, and had a semicolon instead of a colon) that prevented me from using sudo, as only my primary user was allowed to log in via ssh. Fortunately cloud vps still has vnc login, and I actually had a root password. Now I use a root shell to edit sudoers, so I can test it before dropping root.
- LinuxBender 6y agoYes, well, mostly just for entertainment. My sftp server acts in a weird way like a tarpit. Instead of tarpitting or blocking the bots, I create accounts for them with null passwords. I was hoping they might upload something interesting, but no... they just try to get a shell or try to forward ports to other sites, which I do not allow. Some of them have been connecting several times an hour for the past several years.
- narrator 6y agoWhen I used to run my own MX on a home server, I would have bots connect and try to send mail to <random whatever>@mydomain. They never used the same email or IP and they did it for several years straight. I tried IP blocking, but the IPChains list got so long it started slowing down my server.
- jchook 6y agoThis is why folks use techniques like greylisting and why you should almost never use a catch-all mailbox. Spamhaus usually stops a big chunk of them too.
- toxik 6y agoHard disagree on catch all. A catch all allows you to trace who gave your address to spammers, and then to bin all email to that address.
- FullyFunctional 6y agoYep, I've been doing this for nearly a decade. This in combination with Gmail's spam filter works just fine. I have caught quite a few emails to my parents from people who can't spell their (simple) email address.
- bbarnett 6y agoYou don't need a catch all for that, just give unique email addresses to each, and edit /etc/aliases. NOTE: a few bits of info here, although someone mentioning ipchains means their comment is from an older time of course: - use ipset for large sets of blocked IP addresses. That's what it's for, and it works well without slowdown, even on massive sets - http://www.ipdeny.com/ipblocks/data/aggregated http://www.ipdeny.com/ipblocks/data/aggregated This is a nice list of IP addresses broken down by region. Handy do download weekly, or monthly, and then dump into ipset. - firehol is also a nice list to use, eg: https://raw.githubusercontent.com/ktsaou/blocklist-ipsets/master https://raw.githubusercontent.com/ktsaou/blocklist-ipsets/ma...
- chromaton 6y agoI've successfully used an HTTP tarpit to cut down on registration spam. The attacks were being launched from only a handful of (presumably compromised) hosts. If I blocked them, they'd switch to a different attacking host. But I discovered if I tarpitted them, they'd be slowed down to the point where they weren't a problem any more.
- spc476 6y agoAbout 15 years ago, I ran a tarpit at my then current job (small ISP for commercial clients and web hosting) that tarpitted all TCP traffic on unused IP blocks. It did slow down network scans and had I gotten around to it, I could have probably set up some way of automatically blocking the IP addresses hitting the tarpit (as no legitimate traffic should hit it).
- pbhjpbhj 6y agofail2ban would be the go to solution for blocking IP address used in failed port access attempts.