Live data from Hacker News

Spoilerwall: Respond to port scanning requests with movie spoilers

github.com

101–110 of 112 posts

Re: Spoilerwall: Respond to port scanning requests with movie spoilers

#101

Earlier quoted context omitted.

I like this explanation. But is this good network security?

Somewhat tangentially related: a long time ago, certain scanning tools would crash or otherwise not react well to getting a stream of /dev/urandom. You could consider this the more human version.

And then someone uses you in an DoS amplification attack instead of going after you directly.

Re: Spoilerwall: Respond to port scanning requests with movie spoilers

#102
post #59

Earlier quoted context omitted.

> Quick question I'm always wondering why people prefix a question with the statement "quick question". Now is my chance to ask. Is the question typed quickly? Should I imagine you speaking it in a quick manner? Is it meant as "off topic question"? Do you expect an answer quickly? What does it mean when you prefix your question with the words "quick question"?

It means that the asker believes the question is relatively short and thus won't be too much of a burden on the askee.

I concur - that was the reason at least for me.

Actually I am not a native English speaker, I translated it literally from German where we also say "Kurze Frage [...]".

Re: Spoilerwall: Respond to port scanning requests with movie spoilers

#103
post #100
post #67

Earlier quoted context omitted.

Surely some enterprising hacker can optimize Nyancat so that a normal server can saturate a gigabit connection without killing the CPU.

I can't seem to edit my post anymore, but the machine in question was a tiny little VM used as an SSH jump host. The specs were minimal. It was the only machine that wasn't firewalled to hell and back, which is why I did the Nyancat there. I'm working on deploying an enterprise grade NaaS solution across a large cluster of servers, stay tuned!

>> NaaS

Snrrrrrrk

Re: Spoilerwall: Respond to port scanning requests with movie spoilers

#105
post #97
post #67

Earlier quoted context omitted.

Surely some enterprising hacker can optimize Nyancat so that a normal server can saturate a gigabit connection without killing the CPU.

ncfd = open("/dev/nyancat", O_RDONLY); while (...) { sendfile(sockfd, ncfd, ...); }

No way you can open the nyancat device as read-only. Clearly, it only opens as O_ORLY.

Re: Spoilerwall: Respond to port scanning requests with movie spoilers

#106
post #98

Earlier quoted context omitted.

It was a hack, I was getting a nice regular supply of probes from Brazillian addresses, connect to port 22, try 5 different passwords on several different ids ad naseum. So I hacked the openssh server to start mutating the response packets. (very trivial genetic programming where the 'fitness' function value was time to respond between calls, longer = better) That went on for a while until the mutated response was so…

That sounds extremely interesting, do you have a write up or source code somewhere? I'd be interested to hear about more applications of adaptive/genetic code to network security.

I think it sounds more complicated than it is, think of it as response fuzzing. It is exactly like trying to find vulnerabilities in servers by sending them fuzzed packets except in this case you're trying to find vulnerabilities in clients by returning a fuzzed packet.

Re: Spoilerwall: Respond to port scanning requests with movie spoilers

#107
post #59

Earlier quoted context omitted.

It means that the asker believes the question is relatively short and thus won't be too much of a burden on the askee.

I concur - that was the reason at least for me. Actually I am not a native English speaker, I translated it literally from German where we also say "Kurze Frage [...]".

In German you would use it to get a short answer to a short question, for example a yes/no question or when you ask about the time. In practice the shortest answer possible with the notice that you are just looking for a quick answer without explanations. Normally you use it to let the other know that it will not take long and you don't want to disturb.

Re: Spoilerwall: Respond to port scanning requests with movie spoilers

#108

If you like this, you might like Lenny, the bot designed to waste telemarketers' time. https://toao.net/595-lenny https://www.youtube.com/watch?v=lryrm2CVaVg&list=PLduL71_GKz... https://www.reddit.com/r/itslenny/

Thank you for this!!

This is my new obsession for listening to while working.

Re: Spoilerwall: Respond to port scanning requests with movie spoilers

#110
post #26

Earlier quoted context omitted.

You seem like the sort of person who says, "I always lie."

I like it. Because that's also not a paradox, it's just a lie. It can be deceptively difficult to get the wording correct on a paradox.

In the sense that a paradox is self-contradicting, what I wrote is definitely a paradox. Trust me. I always tell the truth, so to speak.
Post reply on HN