lol @ the person spamming Never Gonna Give You Up
SSH to funky.nondeterministic.computer
Show HN: Watch bots interact with an SSH honeypot in real time
51–60 of 75 posts
Re: Show HN: Watch bots interact with an SSH honeypot in real time
#52Yeah I have an SSH daemon running on the default port at funky.nondeterministic.computer for people to hit, but it's mostly bots, which is no fun.
Is this the GTA 4 trailer?! /s
It’s too bad that ssh doesn’t carry sound. A MIDI-style rendition of the song would really tie it all together.
Re: Show HN: Watch bots interact with an SSH honeypot in real time
#53Opened the website to be greeted with only spam of huge walls of random text, seems people are abusing the fun out of it! Would love to actually have seen some interesting bot patterns from the authors comments.
Re: Show HN: Watch bots interact with an SSH honeypot in real time
#54Yeah I have an SSH daemon running on the default port at funky.nondeterministic.computer for people to hit, but it's mostly bots, which is no fun.
Do you allow them entry, present a fake prompt, and record what they do?
Some time ago I did a little experiment by running `nc -l -p 23` (telnet) which connects the next incoming telnet connection to your console. Type in a simulated prompt like Password: or # and it'll be buffered until the connection comes in. Then see what the scanner sends.
Re: Show HN: Watch bots interact with an SSH honeypot in real time
#55Opened the website to be greeted with only spam of huge walls of random text, seems people are abusing the fun out of it! Would love to actually have seen some interesting bot patterns from the authors comments.
You're right. HN traffic quickly turned the live feed from bot activity into a wall of human-generated test payloads.
I'm already working on truncating long values and grouping events by source. The next step will probably be rate limiting noisy sources and separating likely human test traffic from recurring automated behavior.
The recurring bot patterns are the part I ultimately want the interface to surface, rather than forcing visitors to inspect every raw event.
Re: Show HN: Watch bots interact with an SSH honeypot in real time
#56Looking at it, all they do is install ssh keys. I honestly expected them to do more like start some kind of service.
Re: Show HN: Watch bots interact with an SSH honeypot in real time
#57Looking at it, all they do is install ssh keys. I honestly expected them to do more like start some kind of service.
That was my first impression too, since the SSH-key installation attempts are much more frequent and tend to dominate the feed.
I did find at least one campaign that went further: it tried to fetch `http://41.216.189.157/run.sh` with wget or curl, execute it, and remove the script afterward. The downloader referenced payloads for aarch64, i386, loongarch64, and m68k, so it appears to be targeting a fairly broad set of Linux systems.
I haven't fully analyzed the artifacts yet, so I can't say exactly what service or payload it ultimately installs. But it was definitely doing more than adding a key.
This also exposed a weakness in the current UI: repetitive persistence attempts are prominent, while rarer download and execution chains are easy to miss.
Re: Show HN: Watch bots interact with an SSH honeypot in real time
#58Cowrie author here! Yes this is the usual background noise on the internet! Cowrie (which I suspect is used here as well as the data generator) recently had a lot of updates, including now easy install from pip (pip install cowrie), and a much improved shell parser that’s much more capable of parsing attacker commands! https://github.com/cowrie/cowrie and get the full raw data in JSON or other formats to add geoip and ASN attribution! And of course malware samples.
Re: Show HN: Watch bots interact with an SSH honeypot in real time
#59Cooll!!!
Re: Show HN: Watch bots interact with an SSH honeypot in real time
#60[flagged]