6 ms·

What is the origin of passwords submitted to honeypots?

52 points by metaphor 3y ago

metaphor 3y ago
Originally submitted this[1], but refreshing replaces with this[2]. [1] https://isc.sans.edu/diary/Potential+Weaponizing+of+Honeypot+Logs+Guest+Diary/30178/ https://isc.sans.edu/diary/Potential+Weaponizing+of+Honeypot... [2] https://isc.sans.edu/diary/0 https://isc.sans.edu/diary/0
- dang 3y ago
  Our software swapped [1] for [2] because [2] is listed as the canonical URL in [1]. Which article is better? They both seem pretty good and I'm unclear on the difference.
  - metaphor 3y ago
    Contents of the canonical URL appears to change over time by showing the latest blog post, which is currently this[1] that was just published today, not what was originally submitted. [1] https://isc.sans.edu/diary/What+is+the+origin+of+passwords+submitted+to+honeypots/30182 https://isc.sans.edu/diary/What+is+the+origin+of+passwords+s...
    - dang 3y ago
      Ah thanks - let's change to that above instead of https://isc.sans.edu/diary/0 https://isc.sans.edu/diary/0.
franga2000 3y ago
TL;DR: `cat` was a mistake, never pipe files to your terminal, use a text editor or viewer instead.
avidiax 3y ago
It's an interesting optimization problem for the attacker. The most common passwords are problematic. They will frequently work, but they will work for the other guy, too. So then the question is "how do you pull up the ladder?" Changing the password is simple, but likely to get the machine reimaged. Looking at the login history would give an allowlist of subnets, which can be used to deny other attackers access, but hopefully without inconveniencing the owner into reimaging.
- dtgriscom 3y ago
  > So then the question is "how do you pull up the ladder?" I've never heard that metaphor before, but it's a good one. Thanks.
  - Caligatio 3y ago
    I've never seen it used in this context; it usually is used in reference to a social program (i.e. you benefitted from something and then advocate for it to be abolished).
vinay_ys 3y ago
Passwords should be dead soon and this article should be irrelevant soon after. PSA: For most basic and routine websites/apps of low-value, please, please use the FaceID/TouchID protected platform authenticators for passwordless authentication. And for those archaic sites that still insist on passwords (why? tell them about passwordless by writing feedback/app reviews), use the platform built-in password managers. Don't do passwords by memory. For higher value things like banks, please use a different user-id/e-mail-id and passwords stored in password-manager (or write down the password in a book kept safely at your home – this is so much safer than weak passwords you try to scheme up and remember). And, always use 2FA – preferably a hardware FIDO key that you can enroll at least 2 of them and keep them safe. In India, regulator insists banks use mobile SMS OTP. In such case, keeping your phone secure from SMS sniffing malicious apps is critical. If you are really paranoid, get the simplest modern feature phone with a phone number dedicated for receiving such critical SMS! The day when all financial institutions use passwordless auth with FIDO2 MFA cannot come soon enough!
- MattPalmer1086 3y ago
  Define soon. Passwords, for all their annoyances, will probably be around for a long time. While they are not brilliant at anything, they are good enough on many dimensions. Some disadvantages of the things you mention are: * They don't require specialised hardware * They don't require complicated recovery mechanisms if that hardware is lost, stolen or broken. * Arguably, biometrics should not be used for authentication. Once a biometric system is compromised, you have no way to recover. You can't change your biometrics.
  - NikkiA 3y ago
    My bank dropped using passwords back in july. Now all that protects my account is a 5 digit PIN and SMS, and you can reset the pin via SMS. I'm glad financial companies hire security minded folks.
    - MattPalmer1086 3y ago
      Well, technically a PIN is a kind of low security password...
beefnugs 3y ago
I would assume the harder looking passwords actually came from a "known backdoor" incident. Like where a manufacturer of IOT or router puts in backdoors for development then forgets to remove before production
LucyAltaha17 3y ago
[dead]

52 points by metaphor 3y ago

Originally submitted this[1], but refreshing replaces with this[2]. [1] https://isc.sans.edu/diary/Potential+Weaponizing+of+Honeypot+Logs+Guest+Diary/30178/ https://isc.sans.edu/diary/Potential+Weaponizing+of+Honeypot... [2] https://isc.sans.edu/diary/0 https://isc.sans.edu/diary/0

dang 3y ago
Our software swapped [1] for [2] because [2] is listed as the canonical URL in [1]. Which article is better? They both seem pretty good and I'm unclear on the difference.
- metaphor 3y ago
  Contents of the canonical URL appears to change over time by showing the latest blog post, which is currently this[1] that was just published today, not what was originally submitted. [1] https://isc.sans.edu/diary/What+is+the+origin+of+passwords+submitted+to+honeypots/30182 https://isc.sans.edu/diary/What+is+the+origin+of+passwords+s...
  - dang 3y ago
    Ah thanks - let's change to that above instead of https://isc.sans.edu/diary/0 https://isc.sans.edu/diary/0.

franga2000 3y ago

TL;DR: `cat` was a mistake, never pipe files to your terminal, use a text editor or viewer instead.

avidiax 3y ago

It's an interesting optimization problem for the attacker. The most common passwords are problematic. They will frequently work, but they will work for the other guy, too. So then the question is "how do you pull up the ladder?" Changing the password is simple, but likely to get the machine reimaged. Looking at the login history would give an allowlist of subnets, which can be used to deny other attackers access, but hopefully without inconveniencing the owner into reimaging.

dtgriscom 3y ago
> So then the question is "how do you pull up the ladder?" I've never heard that metaphor before, but it's a good one. Thanks.
- Caligatio 3y ago
  I've never seen it used in this context; it usually is used in reference to a social program (i.e. you benefitted from something and then advocate for it to be abolished).

vinay_ys 3y ago

Passwords should be dead soon and this article should be irrelevant soon after. PSA: For most basic and routine websites/apps of low-value, please, please use the FaceID/TouchID protected platform authenticators for passwordless authentication. And for those archaic sites that still insist on passwords (why? tell them about passwordless by writing feedback/app reviews), use the platform built-in password managers. Don't do passwords by memory. For higher value things like banks, please use a different user-id/e-mail-id and passwords stored in password-manager (or write down the password in a book kept safely at your home – this is so much safer than weak passwords you try to scheme up and remember). And, always use 2FA – preferably a hardware FIDO key that you can enroll at least 2 of them and keep them safe. In India, regulator insists banks use mobile SMS OTP. In such case, keeping your phone secure from SMS sniffing malicious apps is critical. If you are really paranoid, get the simplest modern feature phone with a phone number dedicated for receiving such critical SMS! The day when all financial institutions use passwordless auth with FIDO2 MFA cannot come soon enough!

MattPalmer1086 3y ago
Define soon. Passwords, for all their annoyances, will probably be around for a long time. While they are not brilliant at anything, they are good enough on many dimensions. Some disadvantages of the things you mention are: * They don't require specialised hardware * They don't require complicated recovery mechanisms if that hardware is lost, stolen or broken. * Arguably, biometrics should not be used for authentication. Once a biometric system is compromised, you have no way to recover. You can't change your biometrics.
- NikkiA 3y ago
  My bank dropped using passwords back in july. Now all that protects my account is a 5 digit PIN and SMS, and you can reset the pin via SMS. I'm glad financial companies hire security minded folks.
  - MattPalmer1086 3y ago
    Well, technically a PIN is a kind of low security password...

beefnugs 3y ago

I would assume the harder looking passwords actually came from a "known backdoor" incident. Like where a manufacturer of IOT or router puts in backdoors for development then forgets to remove before production

LucyAltaha17 3y ago

[dead]