9 ms·
Portspoof: Emulate a valid service on all 65535 TCP ports
- sedatk 2y agoI had made a similar attempt at stopping email crawler spambots by creating a web page that produces infinite random email addresses. http://web.archive.org/web/20020610054821/http://www.sourtimes.org/fuckemail/ http://web.archive.org/web/20020610054821/http://www.sourtim...
- pdimitar 2y agoAm I missing something or is it truly infinite?
- natmaka 2y agohttps://en.wikipedia.org/wiki/List_poisoning https://en.wikipedia.org/wiki/List_poisoning
- sedatk 2y agoDidn’t know about that term, but it’s funny that an 18 year old Wikipedia article is still four years newer than my web site :)
- westurner 2y agoHow does this compare to a tarpit? Tarpit (networking) https://en.wikipedia.org/wiki/Tarpit_(networking) https://en.wikipedia.org/wiki/Tarpit_(networking) /? inurl:awesome tarpit https://www.google.com/search?q=inurl%3Aawesome+tarpit+site%3Agithub.com https://www.google.com/search?q=inurl%3Aawesome+tarpit+site%... "Does "TARPIT" have any known vulnerabilities or downsides?" https://serverfault.com/questions/611063/does-tarpit-have-any-known-vulnerabilities-or-downsides https://serverfault.com/questions/611063/does-tarpit-have-an... https://gist.github.com/flaviovs/103a0dbf62c67ff371ff75fc62fdded3 https://gist.github.com/flaviovs/103a0dbf62c67ff371ff75fc62f... : > However, if implemented incorrectly, TARPIT can also lead to resource exhaustion in your own server, specifically with the conntrack module. That's because conntrack is used by the kernel to keep track of network connections, and excessive use of conntrack entries can lead to system performance issues, [...] > The script below uses packet marks to flag packets candidate for TARPITing. Together with the NOTRACK chain, this avoids the conntrack issue while keeping the TARPIT mechanism working. The tarpit module used to be in tree. xtables-addons/ xt_TARPIT.c: https://github.com/tinti/xtables-addons/blob/master/extensions/xt_TARPIT.c https://github.com/tinti/xtables-addons/blob/master/extensio...
- lstamour 2y agoHaven't looked into this too deeply but there is a difference between delaying a response (requests get stuck in the tarpit) vs providing a useless but valid response. This approach always provides a response, so it uses more resources than ignoring the request, but less resources than keeping the connection open. Once the response is sent the connection can be closed, which isn't quite how a tarpit behaves. The Linux kernel only needs to track open requests in memory so if connections are closed, they can be removed from the kernel and thus use no more resources than a standard service listening on a port. There is a small risk in that the service replies to requests on the port, though, as replies get more complicated to mimic services, you run the risk of an attacked exploiting the system making the replies. Another way of putting it, this attempts to run a server that responds to incoming requests on every port, in a way that mimics what might run on each port. If so, it technically opens up an attack surface on every port because an attacker can feed it requests but the trade-off is that it runs in user mode and could be granted nil permissions or put on a honeypot machine that is disconnected from anything useful and heavily tripwired for unusual activity. And the approach of hardcoding a response to each port to make it appear open is itself a very simple activity, so the attack surface introduced is minimal while the utility of port scanning is greatly reduced. The more you fake out the scanning by behaving realistically to inputs, the greater the attack surface to exploit, though. And port scanning can trigger false postives in network security scans which can then lead to having to explain why the servers are configured this way and that some ports that should always be closed due to vulnerability are open but not processing requests, so they can be ignored, etc.
- AbraKdabra 2y agoNice, I'm glad the word "honeypot" is never used, once I inherited a "true" honeypot and when I went to check it, it had like 30 ports opened, my reaction was literally "what the fuck is this crap" said out loud.
- dylan604 2y agoIsn't that precisely what a honeypot is meant to do though? Having ports open so that script kiddies get excited they get access to something, but the something just isn't anything? Having a honeypot that is locked down doesn't really seem like a honeypot at that point
- londons_explore 2y agoThe usual trick is to have many pots, each of which is mostly but not entirely locked down.
- AbraKdabra 2y agoI do red team, if I see a server with 20+ ports I'll immediately assume it's a honeypot and will stop scanning it. If you are part of a blue team you WANT them to waste time, not instantly know it's a honeypot, that's what I meant for specifically this software.
- cafeinux 2y agoSo what you're saying is that I should open 30 ports on my critical servers so that they are ignored as honeypots by the attackers? Noted.
- AbraKdabra 2y agoI mean sure, absolutely go for it, don't forget to tell me the IP so I can add it to my ignore list.
- dylan604 2y ago
- PeterWhittaker 2y agoInteresting concept, am curious how this withstands community review and analysis. Bit puzzled though, by the statement made immediately after stating that it is GPL2: For commercial, legitimate applications, please contact the author for the appropriate licensing arrangements. Since the GPL2 doesn't permit restricting what others do with GPLd software, I don't think this statement is doing what the author hopes; they might want to consult a lawyer. (IANAL, etc., but there is nothing in there to prevent me, e.g., from building a business out of this, charging gazillions, and keeping it all for myself, provided I make the source available to my customers.)
- pc486 2y agoI believe the author is saying they're willing to relicense the software for commercial integrations.
- PeterWhittaker 2y agoI believe you're right, that was my conclusion as well. I'm not sure that that will accomplish what they hoped. To continue my original example, I could, in theory, take this code, ensure that it works with arbitrary independent pseudo-services, create my own such services, under a proprietary licence, and distribute the whole as an aggregate, which is permitted by the GPL. The author likely seeks to provide commercial licensing for those interested in integrating their pseudo-services as libraries, which would require either that they be GPLd or that the original code be licensed in some other way. I hope the author achieves the success they hope for without the licensing and legal hell they may have set themselves up for. It can be a great disappointment to have one's work turned into someone else's success by a someone or someones with more legal and licence cunning than one's self. (Note: that ain't me, I've just seen that exact scenario playout more than a fair few times....)
- tptacek 2y agoYes, people can do that. It's inconvenient and risky, so serious customer prospects will pay to avoid it. This is one of the more common open source commercialization strategies; one of the earlier examples is Sleepycat.
- veeter 2y agoWouldn't that inevitably end up with your server being more closely inspected (or at least more heavily trafficked) by hackers/bots? I doubt that most script kiddies are filtering out potential honeypots/things like this from their tools.
- NBJack 2y agoNot a network security expert, but the level of traffic necessary to figure out whats real would probably trip other detection mechanisms in the process.
- ssklash 2y agoI agree, returning legit banners on common ports is likely to get you looked at more rather than less, since most tools are not accounting for situations where every single port is open, indicating false positives. This is a common scenario on penetration tests, and while it does end up wasting time, I'd rather not give attackers any more reason to be looking at my infra. I would prefer port knocking, which is kinda of the polar opposite approach to this.
- tugu77 2y agoCombine the two. By default, return nonsense on all ports. But once a certain access sequence has been detected from a source IP, redirect traffic to a specific port from just that IP to your real service.
- billyhoffman 2y agoSo port knocking, but with also returning junk during the knocking process?
- dietr1ch 2y agoI guess it'll be obvious that a server is running portspoof after you find that 3 random services that nobody uses anymore seem to be running, but now that you know the host is up, which ports do you tinker with? If you assume that scanning/attacking each port on each server takes about the same effort, you are better off finding a machine where the scan/attack has a higher chance of being successful, even if you can tell which ports are spoofed and not worth attacking. Maybe you can run portspoof locally on 127.0.0.35 and compare which responses seem different (data, timings) from what you get back, but the space is suddenly 5000x bigger than the handful of ports that normally seem to be open and ports on other servers may seem more likely to yield success.
- yonatan8070 2y ago> it binds to just ONE tcp port per a running instance ! How does that work? Do you need to run 65535 instances to cover all ports?
- Chilinot 2y agoYea, that statement confused me as well.
- geraldhh 2y agonat-redirection
- remram 2y agoiptables rule redirects all closed ports on the machine to the one portspoof listens to: https://github.com/drk1wi/portspoof/blob/c3f3c34531c59df229eafdaf69a818cc7a847ff3/system_files/iptables-config#L10 https://github.com/drk1wi/portspoof/blob/c3f3c34531c59df229e... Then it calls getsockopt to find out what the original port was: https://github.com/drk1wi/portspoof/blob/c3f3c34531c59df229eafdaf69a818cc7a847ff3/src/connection.cpp#L153 https://github.com/drk1wi/portspoof/blob/c3f3c34531c59df229e...
- Izmaki 2y agoThat's actually pretty darn neat. Thanks for the references, too.
- alanfranz 2y agowhy? A single process can bind to multiple ports. I don't know what's the hard limit actually, or how much memory it would use. Probably a port redirect would just be simpler.
- jagged-chisel 2y agoBut this thing says it binds to ONE port. iptables is doing the port redirect for unbound ports.
- throwaway984393 2y ago[dead]
- PaulAJ 2y agoWould this also be potentially a DoS amplifier? If you sent it the right spoof packets, would it return a lot of packets to the apparent origin?
- throwaway984393 2y ago[dead]
- ryan-c 2y agoFor TCP services, it won't send a large packet until the "client" provides a correct ACK packet to complete the three way handshake. This would indeed be pants-on-head for UDP.
- cryptonector 2y agoAmplification attacks are mainly a concern with UDP because UDP does not have a return routability check, while TCP does.
- pogue 2y agoThis sent me down a rabbit hole remembering the DDoS attacks the skids were coming up with in the 90s. The famous Pepsi & Smurf attacks that would spoof a connection from one server running CHARGEN [1] and send it to another running ECHO [2] and it would just send an endless flood of characters to the victim. It might have been one of, if not, the first distributed denial of service attacks. It's wild to think people would leave all the ports open on their servers that would just spew endless characters and etc. Those were the days when everyone was so open and trusting of other users on the internet. CORRECTION: This was actually name "Fraggle". [3] Smurf involved ICMP flooding. I remember seeing these on EFnet IRC in the 90s. Since the code is so ancient, I thought I'd share it. I'm sure these would be useless in modern times, but they're an interesting bit of internet history. It also hilarious to look at the comments and see old IRC handles you recognize. Who remembers napster before he developed the p2p software that made him famous? Pepsi.c https://cdn.preterhuman.net/texts/underground/hacking/exploits/pepsi.c https://cdn.preterhuman.net/texts/underground/hacking/exploi... This site has loads of old historic exploits preserved one folder up. Smurf.c https://gist.github.com/JasonPellerin/2eecbf1f7e49750d2249 https://gist.github.com/JasonPellerin/2eecbf1f7e49750d2249 [1] https://en.wikipedia.org/wiki/Character_Generator_Protocol?wprov=sfla1 https://en.wikipedia.org/wiki/Character_Generator_Protocol?w... [2] https://en.wikipedia.org/wiki/Echo_Protocol?wprov=sfla1 https://en.wikipedia.org/wiki/Echo_Protocol?wprov=sfla1 [3] https://en.wikipedia.org/wiki/Smurf_attack?wprov=sfla1 https://en.wikipedia.org/wiki/Smurf_attack?wprov=sfla1
- locusofself 2y agoCould this not trivially be accomplished with a service listening on one port and 'iptables' rules?
- tredre3 2y agoPer the README it binds to just ONE tcp port per a running instance ! Configure your firewall rules: iptables -t nat -A PREROUTING -i eth0 -p tcp -m tcp --dport 1:65535 -j REDIRECT --to-ports 4444
- phoronixrly 2y ago> By using those two techniques together: > your attackers will have a tough time while trying to identify your real services. So... Security through obscurity? > the only way to determine if a service is emulated is through a protocol probe (imagine probing protocols for 65k open ports!). So... Security through obscurity? > it takes more than 8hours and 200MB of sent data in order to properly go through the reconessaince phase for your system ( nmap -sV -p - equivalent). So... Security through obscurity? Idk... Maybe I am not versed enough in infosec but this also begs the question are you not attracting more interest if your system lights up green for an exposed Redis instance for an adversary to notice you and take a closer look for anything else vulnerable.
- ryan-c 2y agoThe objective here is to give script kiddies and other spray-and-pray attackers the finger.
- phoronixrly 2y agoHow does it do that though? You light up in a skid's Internet-wide scan for let's say Redis. They try and fail to dump anything from it so they proceed and run a vulnerability scanner on your host (skids gonna skid)... It proceeds to discover IDK... a trivial SQLi you coded like a dumbass...
- rvba 2y agoThey try to run some other attack on you. For something you dont have. If more servers use the tool, they waste attacker's time. A bit like herd immunity
- anyfoo 2y agoIt’s literally an arms race. You make it more expensive for attackers to progress. Yes, security through obscurity is bad on its own, but it’s not necessarily useless as an additional measure. For a similar concept, look at the delay you get after entering a password wrong to a login prompt: That technically does not add any barrier whatsoever, but it does make it much harder for an attacker to brute force the password.
- snvzz 2y agoCute as this is, most attackers aren't obsessed with you, but are looking at just one port, the one they have an exploit for. And if you have that port open with a vulnerable service, they'll find and exploit it, irrespective of whether this tool is running.
- TacticalCoder 2y agoIf it was the case that the way all attackers worked was to have one ready exploit and only scan the port on which that exploit could work, then why are there good guys even seeing port scanning at all?
- kibwen 2y agoIt feels inevitable that computer security will continue evolving towards "active defense" typified by approaches like the above. Look at how complex and many-layered your immune system is, and consider that eventually your computer and/or network will resemble that as well.
- gerdesj 2y agoIT is growing up gradually. It's only had a few decades to worry about security and I've seen most of them. One day, IT will become time served but not today.
- Laforet 2y agoIMO this is still a passive type of security through obfuscation. Active defence would be more like returning zip bombs to known intruders in order to crash the process.
- timschmidt 2y agoOr a tar pit: https://github.com/skeeto/endlessh https://github.com/skeeto/endlessh
- fastily 2y agoEndlessh seems to be abandonware. linuxserver.io used to maintain a docker image but deprecated it (https://github.com/linuxserver/docker-endlessh/pull/16 https://github.com/linuxserver/docker-endlessh/pull/16) after endlessh didn’t get any new updates in over 3 years. I’ve started using endlessh-go instead https://github.com/shizunge/endlessh-go https://github.com/shizunge/endlessh-go
- deleted 2y ago[deleted]
- orev 2y agoIt appears it can be configured to actively return attacks: > Portspoof can be used as an 'Exploitation Framework Frontend', that turns your system into responsive and aggressive machine. In practice this usually means exploiting your attackers' tools and exploits
- wslh 2y agoIn the mid-90s, there was a honeypot product called CyberCop Sting[1], which predated Secure Networks' Ballista[2]. CyberCop Sting could simulate TCP and UDP services across various implementations. If I recall correctly, it also allowed the configuration of TCP/IP stacks to mimic the behavior of different operating systems. These features were particularly innovative almost 30 years ago. [1] https://theswissbay.ch/pdf/Gentoomen%20Library/Security/0321108957.Addison-Wesley%20Professional.Honeypots-%20Tracking%20Hackers.pdf https://theswissbay.ch/pdf/Gentoomen%20Library/Security/0321... [2] https://news.ycombinator.com/item?id=26440139 https://news.ycombinator.com/item?id=26440139
- noufalibrahim 2y agoFascinating. I was going to ask if there were similar projects. It seems like an obvious thing to do and I was mildly surprised that it never occurred to me and majorly surprised that this was the first time I'm hearing about the idea.
- stormbeard 2y agoHow is this better than configuring an iptables redirection?
- zamadatix 2y agoiptables only provides one of the two approaches detailed, namely the "ack" portion. For the "fake a random real service on each port" portion you'd need something additional like this.
- amyfp214 2y agothe natural evolution of such an approach is to also seemingly advertise a variety of security holes.. and maintain a blacklist silently that feeds actual production systems as a firewall, should said hacker reach that point
- rockskon 2y ago*65536 ports Port 0 is a port some operating systems can and do host services on accessible over the Internet. Also - if there's any MariaDB devs reading this - your default setting making the database listen on port 0 to disable Internet access does not, in fact, disable Internet access of the DB for quite a few thousand systems.
- Avamander 2y agoYou can even use it under Linux if you wish btw, you just can't bind to it, but you can have your firewall redirect port 0 to something else.
- rockskon 2y agoYou can bind to it on some versions of Linux. I've scanned a bunch of Linux systems that host stuff on port 0.
- BitPirate 2y agoYour observation doesn't contradict the use of firewall rules to accomplish this.
- rockskon 2y agoIt's not some ufw rule that normally prevents hosting a service on port 0.
- arghwhat 2y agoThat's not what was said. They said that a firewall rule can redirect traffic coming in on port 0 to a running service even when a service cannot bind directly to port 0. Binding with port 0 as argument for AF_INET binds a random available port, not port 0. This is documented behavior of Linux and likely every other OS implementing a BSD-style socket interface. Also note that ufw is just a tiny, non-standard wrapper for the much more powerful nftables/iptables interfaces
- ENOTTY 2y agoTo speed up a comprehensive port probe with service discovery, one could use a few different systems on different IPs and divide the work.
- varun_ch 2y agoI do something similar on my website: https://bini.wales https://bini.wales returns 200 for all endpoints and logs all attempts, so it makes for a decent have a honeypot against automated attacks (mostly it just catches people mass scanning for vulnerable WordPress plugins or leftover backdoors). Similarly, https://varun.ch/login https://varun.ch/login emulates a WordPress site (with a twist)
- arghwhat 2y agoYou will get the WordPress scans regardless of what you return.
- justmarc 2y agoBringing back fond memories of the happy 90s
- pmarreck 2y agoWell, that is certainly one way to attack the problem!
- TZubiri 2y agoOr just don't
- halayli 2y agoor not respond at all. On linux you can disable the rst behavior using sysctl -w net.ipv4.tcp_reset_reject=0
- jfuu 2y agoDo I need a specific kernel module loaded for this? I just get: sysctl: cannot stat /proc/sys/net/ipv4/tcp_reset_reject: No such file or directory This also gives nothing: sysctl -a | grep tcp_reset_reject
- ajsnigrutin 2y ago> it takes more than 8hours and 200MB of sent data in order to properly go through the reconessaince phase for your system ( nmap -sV -p - equivalent). So, every automated portscan from a hacked machne will waste 200MB of my bandwidth?
- sigio 2y agoYes, but it will also waste 200MB of the attacker's bandwidth, which is a more limited resource.
- aidenn0 2y agoBe aware that if you run something like this, you will get dozens of bug bounty requests by people who scanned your machine and found "known vulnerable version of X" running.
- debarshri 2y agoWhat would be great is if there is a network call detected on port where there is no actual service listen, if the tool could create alerts and send it to SIEM it will create lot of value.
- 0xedd 2y ago[dead]