101–110 of 118 posts
I can recommend setting up a server and do extensive logging. Then watch hackers as they attempt to break in. I had a server hacked last week and today i read the logs to figure out how they did. From first discovery, trying to figure out what system they're on, to gaining a shell, and figure out how to execute stuff, gaining network access. It was better then watching an actual movie. And a humbling experience. But…
Earlier quoted context omitted.
What are you trying to achieve?
He's trying to crash a script-kiddy's box with fuzzing. It's a fun thought, though I'm not sure it's practical as you'd only get a few tries. Fuzzing is typically an approach of throwing it the wall and seeing what sticks; if your deep learning found something that crashed most ssh clients that would just be a zero-day.
I like this! It's tiny, simple, yet effective. 2019-03-22T19:54:06.303Z ACCEPT host=::ffff:196.52.43.xx port=50327 fd=4 n=1/4096 2019-03-22T19:54:38.838Z CLOSE host=::ffff:196.52.43.xx port=50327 fd=4 time=32.535 bytes=199 2019-03-22T19:57:12.008Z ACCEPT host=::ffff:141.98.81.xx port=53646 fd=4 n=1/4096 2019-03-22T19:57:21.118Z CLOSE host=::ffff:141.98.81.xx port=53646 fd=4 time=9.110 bytes=30 The 141 bot never stays…
I like this! It's tiny, simple, yet effective. 2019-03-22T19:54:06.303Z ACCEPT host=::ffff:196.52.43.xx port=50327 fd=4 n=1/4096 2019-03-22T19:54:38.838Z CLOSE host=::ffff:196.52.43.xx port=50327 fd=4 time=32.535 bytes=199 2019-03-22T19:57:12.008Z ACCEPT host=::ffff:141.98.81.xx port=53646 fd=4 n=1/4096 2019-03-22T19:57:21.118Z CLOSE host=::ffff:141.98.81.xx port=53646 fd=4 time=9.110 bytes=30 The 141 bot never stays…
Do you realize that the thing does not process any attacker controlled input and thus all the hardening is completely pointless exercise?
Earlier quoted context omitted.
What are you trying to achieve?
He's trying to crash a script-kiddy's box with fuzzing. It's a fun thought, though I'm not sure it's practical as you'd only get a few tries. Fuzzing is typically an approach of throwing it the wall and seeing what sticks; if your deep learning found something that crashed most ssh clients that would just be a zero-day.
Earlier quoted context omitted.
Do you realize that the thing does not process any attacker controlled input and thus all the hardening is completely pointless exercise?
The number of times in my life that I have seen "this should never happen" scroll by on STDOUT suggests that it's time well spent.
https://www.cloudshark.org/captures/b64150b66908
IP addresses have been change to protect the innocent. This is from macOS but definitely seeing some different behavior from other clients.
Earlier quoted context omitted.
Whether you own them or not is subject to a lot of debate and not clear cut. If you owned them, why would you need to fool ARIN into believing they are being utilised? The agreement you make to get an allocation requires a certain level of utilization depending on the size of the block to prevent squatting and exhaustion of resources. This is a good thing, and if it was actually respected we wouldn't be in a mad rush…
"Mad rush" - heh. I'd hate to see how long something rolled out at a leisurely pace would take!
it only took 20 years to standardize after all. we're seriously rushing here!
Earlier quoted context omitted.
Even sophisticated/organized hackers have free time, and if someone "messed with them" and caused them to need to push a hotfix at 6pm on a Friday because their cluster got stuck on your tarpit, you can bet they'll give the tarpit operator some of their attention. Woe to you if they happen to find something that's not patched.
Turn it around. How would hackers adapt if nearly every host responded on ssh the same way? Maybe it’d be behavior worthy of being in openssh or elsewhere. Don’t make it cheap to cheat. This might not be the holy grail, but it’s a good avenue.