5 ms·
Researchers watched 100 hours of hackers hacking honeypot computers
- misiti3780 3y agoActual article: https://www.gosecure.net/blog/2023/08/09/how-unparalleled-rdp-monitoring-reveal-attackers-tradecraft/ https://www.gosecure.net/blog/2023/08/09/how-unparalleled-rd...
- night-rider 3y agoThis is hilarious, and a fun exercise to try out if you want to learn how attacks are pulled off. It's worth having a few 'honey credentials' sitting in plaintext on the honeypot HDD and watch as the threat actors try to use them. Also worth enabling SSH and watch for login attempts like in this: https://brute.fail/ https://brute.fail/
- thefurdrake 3y agoMan, what a way to malign bards. Bard is a great class! ... certainly not the type to sit around and download porn all day, I'm sure...
- michaelteter 3y agoThat was my thought. Bards are underrated! Also, bards are probably the least likely to download it as they are busy making it.
- shove 3y agoWell … played
- 1MachineElf 3y agoThe RDP interception tool used by the researchers: https://github.com/gosecure/pyrdp https://github.com/gosecure/pyrdp I wonder if an "enterprise" version of this might exist so that companies can audit what their administrators do on high-impact systems.
- rhd 3y agoI know CyberArk PAS has this feature, and there are others. https://docs.cyberark.com/PAS/11.6/en/Content/PASIMP/Configuring-Recordings-and-Audits-in-PSM.htm https://docs.cyberark.com/PAS/11.6/en/Content/PASIMP/Configu...
- unethical_ban 3y agoRDP proxy tools certainly exist for gateway access to critical systems.
- seeknotfind 3y agoDoesn't publicizing this reduce its utility?
- progmetaldev 3y agoMost of these attacks are done with completely automated tools. Put in an IP range and off it runs. I doubt most users even realize when they get stuck in the honeypots. Just run the script and go off doing something else.
- HocusLocus 3y agoIn 2016-2017 I opened telnet (23) and a special authless sshd on 22 that both went directly into Crowther & Woods' Adventure "You are standing at the end of a road before a small brick building. Around you is a forest. A small stream..." etc. and logged all keystrokes. To keep everything quaint and throttled I limited simultaneous connections to 1 and paced output to the 30 cps of a Bell 103 modem. After glancing through logs every day and performing a more comprehensive analysis after a year, of ~100k connections NOT ONE HUMAN was spotted playing the game. It's bots and worms all the way down.
- heywoodlh 3y agoHoneypots are fun. I documented how I ran one here: https://the-empire.systems/how-to-run-honeypot https://the-empire.systems/how-to-run-honeypot The TL;DR is that I deployed heralding[0]. If I recall correctly, I think within two days of the server being online, there were over 50,000 attempts to login. [0] https://github.com/johnnykv/Heralding https://github.com/johnnykv/Heralding