3 ms·
Have I missed 99% of the content or is this purely to raise awarness? There is no description of the honeypot. Did the person running it manage to intercept any
by Roark66 3y ago
Have I missed 99% of the content or is this purely to raise awarness? There is no description of the honeypot. Did the person running it manage to intercept any root kits, if yes what were they?
I remember years ago there was this vnc vulnerability that allowed one to login without a password. At the time I was doing "it support" for various small businesses in West Yorkshire, UK. All of my regulars had firewalls with (site to site) vpn for remote access, but often I'd get new clients I never saw before asking to fix something. When that vulnerability came out I was getting calls from such new customers daily about "their system is slow", "our email is not going out" (in these days even small businesses used to run their own email servers). Every single "new customer" I had during next few weeks was "hacked" by the vnc bug. It seems whoever used to do IT for them left vnc accessible from the Internet (not even limiting the source IPs on the firewall). Every single time the root kits I found had outputs in Chinese (it required changing windows cmds settings to even see it). Most were very basic, but they did manage to successfully kill the AV software and they all had their own storage drivers that hid certain folders unless I booted the system in the safe mode(tgese were mostly windows 2000/2003 sbs servers BTW). Frequently I'd find lists of other victims IPs on these systems and their scanning software. What was the goal of this campaign? Sending spam of course. As mentioned most clients only realised they were "hacked" when their system became horribly slow, or their outgoing email was cut off by their ISP blocking outgoing smtp traffic from their IPs following complaints. What was the spam? Viagra of course.... I saw lots of these. Many of these systems had personal data of people, I never noticed attempts to exfiltrate such data. The only time I dealt with proper attempt to steal money from a business account using the IT system was after a disgruntled it admin was fired.
This was almost 20 years ago. I'd love to find out how small network attackers try to "monetize" their victims today. Are they just searching for crypto, attempting "encrypting data" scams, or is there something more interesting? Curious minds want to know?
- fmajid 3y agoThey’re actually set up as cloud providers for hire now, as part of the professionalization of the criminal underworld and its stratification into specialized operators.
- efnx 3y agoAre you serious or was that just a clever joke?
- matheusmoreira 3y agoHe's serious. These people actually sell computing services powered by their network of cracked computers. They'll even manage their fleet by patchinf the vulnerabilities they exploited. Network proxies, redundant distributed storage... Compromised machines could be turned into storage for CSAM, proxies for scrapers or spammers, whatever people want.
- specialist 3y ago> turned into storage for CSAM FFS. I never want to know anything about CSAM and related. But it seems none of us can escape it. I fear that if I ever make one of my hobby projects public, I'll be forced to learn all the security stuff. Alas, I suck at security stuff. I left networking and admin for building CRUD apps, so many years ago, because I have no aptitude or interest. (Whereas I love solving customer use cases.) What are noobs like me supposed to do?
- matheusmoreira 3y agoTo me it seems ISP CGNAT is the only thing keeping people relatively safe on the internet. > What are noobs like me supposed to do? I'm not about to claim I'm some kind of expert on security but... Don't let your computers talk to strangers. Your computers should only be talking or listening to you really and maybe other people who you trust and have authorized. If someone is not in that group, they should not even send back an error page, they should not even answer pings. So set up single packet authorization so that your machines literally drop all network packets unless you send a cryptographically signed packet first. To these bots, it will be like the servers are not even there.
- fmajid 3y ago
- Krasnol 3y agoThanks for being the one who provided some interesting to read on this topic here. I was confused, too. Thought my ublock blocked the rest of the post there...I wonder where the upvotes come from. Do people actually click the link?
- denton-scratch 3y ago> is this purely to raise awarness? It feels to me like someone who has only just noticed that the majority of internet traffic is nowadays malicious. In about 2002 I set up my first domestic mailserver, and was shocked (and frightened) at the proportion of traffic that was malicious. Then I started digging into other system logs. In those days most malicious traffic was from Eastern Europe. I've run honeypots, for entertainment. It was engaging for a while. Eventually I realised that running a home honeypot was a waste of effort, and I just hardened my systems and instituted a bit of monitoring.
- inetknght 3y ago> running a home honeypot was a waste of effort Worse than that: running a home honeypot puts significant risk that malicious activity would be traced to you.
- denton-scratch 3y agoNot to me, actually; the mail honeypot I ran purported to be an open relay, but it didn't actually relay the incoming traffic. It dropped everything, and just wrote a log.
- fullspectrumdev 3y ago> This was almost 20 years ago. I'd love to find out how small network attackers try to "monetize" their victims today Crypto mining, installing software to sell access to the host as a “residential proxy”, good ole theft of data, using the host for DDoS, click fraud, etc