Endlessh: An SSH Tarpit • Hacker News Board

Re: Endlessh: An SSH Tarpit

#41

Post by imglorp » Fri, Mar 22, 2019, 9:16 PM UTC

xoa wrote: post #35

Neat little project to needle some of the botters a bit (though I assume they'll all evolve to recognize this fairly quickly). I'd echo tyingq's comment below though: Any tarpit has the potential to piss someone off. I'd run it on a sacrificial server with no obvious way to tie back to who is running it. Yeah, just speculating but at least from what I've seen in the past if you successfully tarpit some script kiddie…

Good advice, being ready for a revenge DDOS, but I suspect most of these SSH hunters are busy business people who have a quota of zombie hosts to fill for whatever mining or spamming they're up to. DDOSing doesn't pay like those things do.

Re: Endlessh: An SSH Tarpit

#42

Post by LukeShu » Fri, Mar 22, 2019, 9:18 PM UTC

LinuxBender wrote: post #2

I like this! It's tiny, simple, yet effective. 2019-03-22T19:54:06.303Z ACCEPT host=::ffff:196.52.43.xx port=50327 fd=4 n=1/4096 2019-03-22T19:54:38.838Z CLOSE host=::ffff:196.52.43.xx port=50327 fd=4 time=32.535 bytes=199 2019-03-22T19:57:12.008Z ACCEPT host=::ffff:141.98.81.xx port=53646 fd=4 n=1/4096 2019-03-22T19:57:21.118Z CLOSE host=::ffff:141.98.81.xx port=53646 fd=4 time=9.110 bytes=30 The 141 bot never stays…

Thanks for introducing me to `checksec`!

Re: Endlessh: An SSH Tarpit

#43

Post by HashBasher » Fri, Mar 22, 2019, 9:21 PM UTC

I wonder if you could make the attacker crunch out some shah-256 and you can profit by mining Bitcoin.

Re: Endlessh: An SSH Tarpit

#44

Post by LinuxBender » Fri, Mar 22, 2019, 9:22 PM UTC

LukeShu wrote: post #42

LinuxBender wrote: post #2

I like this! It's tiny, simple, yet effective. 2019-03-22T19:54:06.303Z ACCEPT host=::ffff:196.52.43.xx port=50327 fd=4 n=1/4096 2019-03-22T19:54:38.838Z CLOSE host=::ffff:196.52.43.xx port=50327 fd=4 time=32.535 bytes=199 2019-03-22T19:57:12.008Z ACCEPT host=::ffff:141.98.81.xx port=53646 fd=4 n=1/4096 2019-03-22T19:57:21.118Z CLOSE host=::ffff:141.98.81.xx port=53646 fd=4 time=9.110 bytes=30 The 141 bot never stays…

Thanks for introducing me to `checksec`!

My pleasure!

Re: Endlessh: An SSH Tarpit

#45

Post by devy » Fri, Mar 22, 2019, 9:24 PM UTC

On a different note, I love this other tool he wrote: Enchive

https://nullprogram.com/blog/2017/03/12/

Re: Endlessh: An SSH Tarpit

#46

Post by linuxdude314 » Fri, Mar 22, 2019, 9:30 PM UTC

GNOMES wrote: post #14

I must not be understanding something... Does this still allow whitelisted machines to connect, or is this just a troll thing to do?

Yes, it's just a troll thing.

Re: Endlessh: An SSH Tarpit

#47

Post by Jach » Fri, Mar 22, 2019, 9:47 PM UTC

HashBasher wrote: post #43

I wonder if you could make the attacker crunch out some shah-256 and you can profit by mining Bitcoin.

Not bitcoin but forcing a proof-of-work scheme has been proposed as an anti-DoS measure before: http://www.csc.kth.se/utbildning/kth/kurser/DD143X/dkand12/G...

Re: Endlessh: An SSH Tarpit

#48

Post by lucb1e » Fri, Mar 22, 2019, 9:52 PM UTC

penagwin wrote: post #36

lucb1e wrote: post #16

Earlier quoted context omitted.

I love the fake arp responses, that's a brilliant way so you can run this on any machine (doesn't have to be a router) and not worry about managing new hosts (no black/whitelist to manage of which IPs are unused).

I'm definitely not going to try this because it sounds like an easy way to get in trouble, but would this work on a host like DO/linode/vultr, etc? Again, this seems really easy to detect

Oh I was thinking home network or some small business. I'm not yet used to this cloud thing, still hosting my email and website at home. For a network that is not yours, like at a VPS provider, I would totally not try this. They would not be amused.

Re: Endlessh: An SSH Tarpit

#49

Post by spc476 » Fri, Mar 22, 2019, 9:52 PM UTC

tyingq wrote: post #9

ams6110 wrote: post #5

I'm not sure I like this. How secure is it? Anything you put on port 22 is going to be attacked relentlessly. I think I'd rather have OpenSSH handling those attacks than some tarpit program that may or may not have been subjected to the audits and the trial-by-fire that OpenSSH has.

Any tarpit has the potential to piss someone off. I'd run it on a sacrificial server with no obvious way to tie back to who is running it.

You can always tie it to the organization who is running it, by the simple fact of looking at the IP address that is "acting slow".

Years ago when I was playing network admin for a company, I set up a tarpit system which ran for a few years. In that time we never encountered one pissed off person in person (or on the Internet).

Re: Endlessh: An SSH Tarpit

#50

Post by z3t4 » Fri, Mar 22, 2019, 9:53 PM UTC

I can recommend setting up a server and do extensive logging. Then watch hackers as they attempt to break in. I had a server hacked last week and today i read the logs to figure out how they did. From first discovery, trying to figure out what system they're on, to gaining a shell, and figure out how to execute stuff, gaining network access. It was better then watching an actual movie. And a humbling experience. But also entertaining, watching the struggle against my hardening and even stumbled on a bug, feeling his/her frustration. And the wow feeling when they finally got a shell.