Beautiful!
Endlessh: An SSH Tarpit
31–40 of 118 posts
Re: Endlessh: An SSH Tarpit
#32Earlier quoted context omitted.
Any tarpit has the potential to piss someone off. I'd run it on a sacrificial server with no obvious way to tie back to who is running it.
Why worry about pissing off the kind of person who scans for open SSH ports for no apparent legitimate reason? Are you concerned that the Chinese are going to try even harder to hack your machine, like they're not already doing everything they can to break in?
The vast majority are going for the low hanging fruit. I don't have to outrun the bear. I just have to outrun you.
Re: Endlessh: An SSH Tarpit
#33Assuming you run a legit SSH server on port A and an SSH tarpit on port B. What hinders an attacker to connect to port A an B at the same time? What is the advantage having an attacker connected for weeks on port B?
nothing, except the attacker doesn't know what A is. 22 is the default for ssh.
Re: Endlessh: An SSH Tarpit
#34Earlier quoted context omitted.
Presumably legitimate access would be on port 22, whereas only bots would hit 2222.
almost, but backwards. The bots all know port 22. Only you know which random other port is the real ssh port.
And the second guess would be port 2222, so don't use it for a real ssh server!
Re: Endlessh: An SSH Tarpit
#35Neat little project to needle some of the botters a bit (though I assume they'll all evolve to recognize this fairly quickly). I'd echo tyingq's comment below though:
Any tarpit has the potential to piss someone off. I'd run it on a sacrificial server with no obvious way to tie back to who is running it.
Yeah, just speculating but at least from what I've seen in the past if you successfully tarpit some script kiddie and they notice the IP their scan got stuck on there is some potential to move from "one of a billion random lowest common denominator bulk scan targets" to "paid attention to specifically some minimal amount", which is a genuinely different scenario. Even if all that amounts to is a relatively low volume revenge DDOS pointed at you for a bit it's still more of a disruption then if the auto scan had just moved on without seeing anything of note in the first place. This looks like fun on some systems, but on anything real I'm inclined to just stick to cutting down on log spam via single packet auth or a port knocker or the like. The old outrun-the-hiker-not-the-bear aphorism fits a lot of cases, just something to keep in mind before implementing something like this if you aren't directly experimenting with more active reactions.
Conversely as a research project I'm now actually curious what sort of extra attention even something like this could attract. Maybe these days everyone would just adapt and move on instead and the above is all obsolete?
Re: Endlessh: An SSH Tarpit
#36I haven't used it in years, but Tom Liston's "Labrea" tarpit is an interesting take on this concept: https://github.com/Hirato/LaBrea It listens in your unused IP space and both tar-pits scanners and creates actionable intelligence about scans against your hosts.
I love the fake arp responses, that's a brilliant way so you can run this on any machine (doesn't have to be a router) and not worry about managing new hosts (no black/whitelist to manage of which IPs are unused).
I'm definitely not going to try this because it sounds like an easy way to get in trouble, but would this work on a host like DO/linode/vultr, etc? Again, this seems really easy to detect
Re: Endlessh: An SSH Tarpit
#37Massively async ssh scanners won't care. They'll time out and move on without being held up at all.
Re: Endlessh: An SSH Tarpit
#38I like this! It's tiny, simple, yet effective. 2019-03-22T19:54:06.303Z ACCEPT host=::ffff:196.52.43.xx port=50327 fd=4 n=1/4096 2019-03-22T19:54:38.838Z CLOSE host=::ffff:196.52.43.xx port=50327 fd=4 time=32.535 bytes=199 2019-03-22T19:57:12.008Z ACCEPT host=::ffff:141.98.81.xx port=53646 fd=4 n=1/4096 2019-03-22T19:57:21.118Z CLOSE host=::ffff:141.98.81.xx port=53646 fd=4 time=9.110 bytes=30 The 141 bot never stays…
You should submit a pull request!
The thought crossed my mind, but I am lazy and the proper change would be to write a configure script that checks for the availability of the various hardening options.
There are decent examples in the Tor source code.
Re: Endlessh: An SSH Tarpit
#39Earlier quoted context omitted.
I love the fake arp responses, that's a brilliant way so you can run this on any machine (doesn't have to be a router) and not worry about managing new hosts (no black/whitelist to manage of which IPs are unused).
I'm definitely not going to try this because it sounds like an easy way to get in trouble, but would this work on a host like DO/linode/vultr, etc? Again, this seems really easy to detect
Yes be super careful with Labrea on VPS providers and dedicated server providers. They tend to get upset if you are trying to pick up IP's. In most cases it won't even work on KVM hosts.
I've used Labrea on unused address space to make ARIN/RIPE happy back in the day and that was harmless, as entire /16's and /17's were unused. They used to nag about nothing in the /16's being pingable, so Labrea made it all 100% pingable
Re: Endlessh: An SSH Tarpit
#40Earlier quoted context omitted.
Any tarpit has the potential to piss someone off. I'd run it on a sacrificial server with no obvious way to tie back to who is running it.
Why worry about pissing off the kind of person who scans for open SSH ports for no apparent legitimate reason? Are you concerned that the Chinese are going to try even harder to hack your machine, like they're not already doing everything they can to break in?
They may be the same type of person that would launch a ddos, for example.