3 ms·
I would be wary of adding ghost hosts as that might attract more scans and potential hacks. This is the equivalent of adding 1000 fake locks to your door, all
by djaouen 2y ago
I would be wary of adding ghost hosts as that might attract more scans and potential hacks. This is the equivalent of adding 1000 fake locks to your door, all of which appear open, in the hopes that an intruder guesses that you are actually using one of the fake locks.
- BLKNSLVR 2y agoBy the sounds of it, it's a single additional service that just looks like 1,000 locks. Additionally, this is to slow down an intruder that's already in the local network, so "might attract more scans and potential hacks" is somewhat moot - it doesn't announce to the Internet that port 22 is open, for example. Although, if the intruder works out they're ghost hosts, then they might assume that there must be gold in them thar hills given the additional levels of protections / obscurity, and thus redouble their efforts in mapping the network and discovering real hosts. The point appears to be to slow down an already-intruder, to give more time to lock down the real hosts and remove said intruder. In which case it seems to act as a detection mechanism to notify that there is an intruder attempting to map the network - which could possibly be the most value it brings.
- daghamm 2y agoYeah, I have experienced this myself. Many years ago we worked on a project that deployed fake vulnerable services (SMTP, SSH and so on) to a /16 network. At some point so many people were trying to exploit these that the admins asked us disable it. I guess we got on some kind of list...