3 ms·
Actually this already is the SOTA of cracking. My honeypot can see several different IP is brute forcing concurrently, and they seems irrelevant. But once you l
by catkitcourt 2y ago
Actually this already is the SOTA of cracking. My honeypot can see several different IP is brute forcing concurrently, and they seems irrelevant. But once you let one of them login, it will quit immediately and all those IPs will quiet after ~15sec. Then one of those IPs will login again to deploy miner.
- superjan 2y agoNext level: let them login and forward the ssh connection to the digital equivalent of a room full of mirrors.
- spogbiper 2y agoreminds me of using the old MIRROR target in iptables back in the day. before it was removed because its ridiculous. we used to watch script kiddies trying to brute force their own hosts but even then we knew it was ripe for abuse. https://www.linuxtopia.org/Linux_Firewall_iptables/x4448.html https://www.linuxtopia.org/Linux_Firewall_iptables/x4448.htm...
- snvzz 2y agoIt was beautiful to see people nuke themselves in winnuke era.
- Terr_ 2y agoProbably for the best, since it sounds like that could be used for DDoS amplification and/or reflection. For example, if an attack could spoof traffic to get two different reflectors hall-of-mirror-ing each other, or using a botnet that spoofs traffic to get one collection of dupes to slam a single victim in response, etc.