4 ms·

Nice, I'm glad the word "honeypot" is never used, once I inherited a "true" honeypot and when I went to check it, it had like 30 ports opened, my reaction was l

Nice, I'm glad the word "honeypot" is never used, once I inherited a "true" honeypot and when I went to check it, it had like 30 ports opened, my reaction was literally "what the fuck is this crap" said out loud.

dylan604 2y ago
Isn't that precisely what a honeypot is meant to do though? Having ports open so that script kiddies get excited they get access to something, but the something just isn't anything? Having a honeypot that is locked down doesn't really seem like a honeypot at that point
- londons_explore 2y ago
  The usual trick is to have many pots, each of which is mostly but not entirely locked down.
- AbraKdabra 2y ago
  I do red team, if I see a server with 20+ ports I'll immediately assume it's a honeypot and will stop scanning it. If you are part of a blue team you WANT them to waste time, not instantly know it's a honeypot, that's what I meant for specifically this software.
  - cafeinux 2y ago
    So what you're saying is that I should open 30 ports on my critical servers so that they are ignored as honeypots by the attackers? Noted.
    - AbraKdabra 2y ago
      I mean sure, absolutely go for it, don't forget to tell me the IP so I can add it to my ignore list.
      - dylan604 2y ago
        If you’re a red team member that needs to be told this type of information, you’re not very good at it. You just said this is something you do on your own, so why would you need to be told about it? Either you do it or you don’t.
        AbraKdabra 2y ago
        youdidntgetthejoke.jpg
        deleted 2y ago
        [deleted]
      - cafeinux 2y ago
        Sure, here you are! 127.0.0.1 Thank you for your thoughtfulness.
  - dylan604 2y ago
    I remember the first box I ever built that went online before I had any clue about what I was doing. It had to have looked like a honeypot. Then someone knowledgeable helped me and started shutting things down. They also mentioned Debian being designed as essentially opt-in instead of opt-out to precisely avoid this issue
    - AbraKdabra 2y ago
      Exactly, most people confuse the fact that a server being a honeypot doesn't mean "HEY SCAN ME HEY I'M A HONEYPOT SCAN ME SO I CAN GET FREE INFO", you need a balance between exposing yourself and being authentic so the person on the other side doesn't tap Ctrl-C at the sight of a lot of ports opened. I'm mean sure, you'll get a ton of info from bots, but if you're truly using a honeypot for R&D you want the true hackers to knock on your door.
  - remram 2y ago
    I think what's neat is that this tool can reply to so many protocols/ports, you can enable whichever subset you want. You could also easily tweak it to have the ports spread on a few different IP addresses instead of a single one. That would make them much less obvious.
  - pixl97 2y ago
    Then you're missing out on juicy stuff... I work with a number of overseas clients where getting extra IPv4 is nearly impossible. I'll see them setup a ip forwarding box to tons of different applications. That application may have its own reverse proxy serving even more stuff. The real world has some scary things in it.
treesknees 2y ago
Perhaps one of us misunderstands the term honeypot, it could be me, but IMO this seems perfectly usable to create a honeypot system on your network. A honeypot is used to attract and detect an attacker, usually logging their actions and patterns for analysis or blocking. This tool could use more logging beyond just iptables, and sure it’s not _by itself_ a honeypot, but the idea isn’t that far off. All that aside, the GitHub page suggests this “enhances OS security” which I don’t buy one bit. Sure it provides some obfuscation against automated service scanners, but if you have a MySQL server listening on 3306, and an attacker connects to 3306, they’re still talking to MySQL. Doesn’t matter if all the other 65534 ports are serving garbage responses.
- robertlagrant 2y ago
  But how do you know it's real? You might be running Postgres on 5432 and them connecting to 3306 might respond with a lookalike mysql.
  - jaktet 2y ago
    I would imagine the amount of time someone spends “investigating” a port like 3306 is the amount of time it takes for the existing automated software to run a check to see if the mysql server is vulnerable. So unless the service on 3306 is able to spoof a vulnerable mysql server, they don’t care if it’s real or not. They just care if their tool reports a vulnerable service.
    - robertlagrant 2y ago
      Why would they only care about that if they're trying to hack into a system?
      - jaktet 2y ago
        Unless they are specifically targeting that system my assumption would be that they are just looking for open ports for known services, then if found checking if exploits work or not, and if not move on. I could very well be wrong but from a practical standpoint I can’t imagine this service mattering to someone that is running a program to scan for open ports with vulnerabilities.

dylan604 2y ago

Isn't that precisely what a honeypot is meant to do though? Having ports open so that script kiddies get excited they get access to something, but the something just isn't anything? Having a honeypot that is locked down doesn't really seem like a honeypot at that point

londons_explore 2y ago
The usual trick is to have many pots, each of which is mostly but not entirely locked down.
AbraKdabra 2y ago
I do red team, if I see a server with 20+ ports I'll immediately assume it's a honeypot and will stop scanning it. If you are part of a blue team you WANT them to waste time, not instantly know it's a honeypot, that's what I meant for specifically this software.
- cafeinux 2y ago
  So what you're saying is that I should open 30 ports on my critical servers so that they are ignored as honeypots by the attackers? Noted.
  - AbraKdabra 2y ago
    I mean sure, absolutely go for it, don't forget to tell me the IP so I can add it to my ignore list.
    - dylan604 2y ago
      If you’re a red team member that needs to be told this type of information, you’re not very good at it. You just said this is something you do on your own, so why would you need to be told about it? Either you do it or you don’t.
      - AbraKdabra 2y ago
        youdidntgetthejoke.jpg
      - deleted 2y ago
        [deleted]
    - cafeinux 2y ago
      Sure, here you are! 127.0.0.1 Thank you for your thoughtfulness.
- dylan604 2y ago
  I remember the first box I ever built that went online before I had any clue about what I was doing. It had to have looked like a honeypot. Then someone knowledgeable helped me and started shutting things down. They also mentioned Debian being designed as essentially opt-in instead of opt-out to precisely avoid this issue
  - AbraKdabra 2y ago
    Exactly, most people confuse the fact that a server being a honeypot doesn't mean "HEY SCAN ME HEY I'M A HONEYPOT SCAN ME SO I CAN GET FREE INFO", you need a balance between exposing yourself and being authentic so the person on the other side doesn't tap Ctrl-C at the sight of a lot of ports opened. I'm mean sure, you'll get a ton of info from bots, but if you're truly using a honeypot for R&D you want the true hackers to knock on your door.
- remram 2y ago
  I think what's neat is that this tool can reply to so many protocols/ports, you can enable whichever subset you want. You could also easily tweak it to have the ports spread on a few different IP addresses instead of a single one. That would make them much less obvious.
- pixl97 2y ago
  Then you're missing out on juicy stuff... I work with a number of overseas clients where getting extra IPv4 is nearly impossible. I'll see them setup a ip forwarding box to tons of different applications. That application may have its own reverse proxy serving even more stuff. The real world has some scary things in it.

treesknees 2y ago

Perhaps one of us misunderstands the term honeypot, it could be me, but IMO this seems perfectly usable to create a honeypot system on your network. A honeypot is used to attract and detect an attacker, usually logging their actions and patterns for analysis or blocking. This tool could use more logging beyond just iptables, and sure it’s not _by itself_ a honeypot, but the idea isn’t that far off. All that aside, the GitHub page suggests this “enhances OS security” which I don’t buy one bit. Sure it provides some obfuscation against automated service scanners, but if you have a MySQL server listening on 3306, and an attacker connects to 3306, they’re still talking to MySQL. Doesn’t matter if all the other 65534 ports are serving garbage responses.

robertlagrant 2y ago
But how do you know it's real? You might be running Postgres on 5432 and them connecting to 3306 might respond with a lookalike mysql.
- jaktet 2y ago
  I would imagine the amount of time someone spends “investigating” a port like 3306 is the amount of time it takes for the existing automated software to run a check to see if the mysql server is vulnerable. So unless the service on 3306 is able to spoof a vulnerable mysql server, they don’t care if it’s real or not. They just care if their tool reports a vulnerable service.
  - robertlagrant 2y ago
    Why would they only care about that if they're trying to hack into a system?
    - jaktet 2y ago
      Unless they are specifically targeting that system my assumption would be that they are just looking for open ports for known services, then if found checking if exploits work or not, and if not move on. I could very well be wrong but from a practical standpoint I can’t imagine this service mattering to someone that is running a program to scan for open ports with vulnerabilities.