Is there one that causes SSH clients trying to brute-force passwords to crash?
I have moved from port 22 long time ago.
Spoilerwall: Respond to port scanning requests with movie spoilers
91–100 of 112 posts
Re: Spoilerwall: Respond to port scanning requests with movie spoilers
#92Earlier quoted context omitted.
I did a killclient which would send back a malformed packet to any ssh handshake and kill the connecting client. This made the pentesters mad. Sending them spoilers will just make the sad, and not so mad.
Is that a feature or was that a hack. Did the same packet kill multiple clients? More info?
It was a hack, I was getting a nice regular supply of probes from Brazillian addresses, connect to port 22, try 5 different passwords on several different ids ad naseum. So I hacked the openssh server to start mutating the response packets. (very trivial genetic programming where the 'fitness' function value was time to respond between calls, longer = better) That went on for a while until the mutated response was somewhere around 10K bytes and then the call would just stop. A couple of weeks after that I got DDOS'd from a Brazilian botnet. Fail2ban cleaned that up but in practical terms it was easier to just use fail2ban on all of that.
Re: Spoilerwall: Respond to port scanning requests with movie spoilers
#93This is like yelling at recorded telemarketing pitches.
I'd put it more on the level of setting up a chat bot to talk to another chatbot.
Re: Spoilerwall: Respond to port scanning requests with movie spoilers
#94You have to be very careful when running this on the telnet port. I had a server set to spew a full color ANSI Nyancat at you when you telneted in. When the Mirai botnet was in full swing, I was pushing 5+ Mbps of Nyancat down to peoples infected webcams and killing my servers CPU.
Basically don't offer hackers any data amplification attacks, never respond with more data than it took for the attack to make the request.
Re: Spoilerwall: Respond to port scanning requests with movie spoilers
#95Now NMAP has to be rewriten to detect this crazy honey-potting style, by utilising "spoilers.json" file :) I love Python, I just implemented this in my HoneyPot added some connections-counters, statistic and alterting... Anyone want to have as free open-source on github? Let me know.
Re: Spoilerwall: Respond to port scanning requests with movie spoilers
#96Earlier quoted context omitted.
It's just a recording.
It's a little more than that; it also incorporates silence detection so that it waits for the caller to finish talking before 'Lenny' plays its next line. But otherwise, yeah, it's just recordings.
It does seem natural that it is a recording with silence detection. What about the process of choosing these specific set of dialogue? It is definitely not chosen arbitrarily as lenny's response blend pretty well with marketer's question. I was imagining some analysis on marketer's most used conversation were done.
Re: Spoilerwall: Respond to port scanning requests with movie spoilers
#97You have to be very careful when running this on the telnet port. I had a server set to spew a full color ANSI Nyancat at you when you telneted in. When the Mirai botnet was in full swing, I was pushing 5+ Mbps of Nyancat down to peoples infected webcams and killing my servers CPU.
Surely some enterprising hacker can optimize Nyancat so that a normal server can saturate a gigabit connection without killing the CPU.
ncfd = open("/dev/nyancat", O_RDONLY);
while (...) {
sendfile(sockfd, ncfd, ...);
}Re: Spoilerwall: Respond to port scanning requests with movie spoilers
#98Earlier quoted context omitted.
Is that a feature or was that a hack. Did the same packet kill multiple clients? More info?
It was a hack, I was getting a nice regular supply of probes from Brazillian addresses, connect to port 22, try 5 different passwords on several different ids ad naseum. So I hacked the openssh server to start mutating the response packets. (very trivial genetic programming where the 'fitness' function value was time to respond between calls, longer = better) That went on for a while until the mutated response was so…
That sounds extremely interesting, do you have a write up or source code somewhere?
I'd be interested to hear about more applications of adaptive/genetic code to network security.
Re: Spoilerwall: Respond to port scanning requests with movie spoilers
#99You have to be very careful when running this on the telnet port. I had a server set to spew a full color ANSI Nyancat at you when you telneted in. When the Mirai botnet was in full swing, I was pushing 5+ Mbps of Nyancat down to peoples infected webcams and killing my servers CPU.
Basically don't offer hackers any data amplification attacks, never respond with more data than it took for the attack to make the request.
What? For data amplification attacks to work you need to spoof IP addresses, which is almost impossible with TCP (telnet uses it), GP was a victim of a plain old DDoS.
Re: Spoilerwall: Respond to port scanning requests with movie spoilers
#100You have to be very careful when running this on the telnet port. I had a server set to spew a full color ANSI Nyancat at you when you telneted in. When the Mirai botnet was in full swing, I was pushing 5+ Mbps of Nyancat down to peoples infected webcams and killing my servers CPU.
Surely some enterprising hacker can optimize Nyancat so that a normal server can saturate a gigabit connection without killing the CPU.
I can't seem to edit my post anymore, but the machine in question was a tiny little VM used as an SSH jump host. The specs were minimal. It was the only machine that wasn't firewalled to hell and back, which is why I did the Nyancat there.
I'm working on deploying an enterprise grade NaaS solution across a large cluster of servers, stay tuned!