Endlessh: An SSH Tarpit • Hacker News Board

Re: Endlessh: An SSH Tarpit

#11

Post by codeulike » Wed, Sep 16, 2020, 12:28 PM UTC

klodolph wrote: post #7

nickcw wrote: post #2

Great idea! I'm not sure we should be writing new network connected daemons in C though.

> I'm not sure we should be writing new network connected daemons in C though. In general, yes. However, in this case--no, that's not helpful advice--because this program doesn't actually receive input from clients! Kind of hard to trigger exploitable behavior on a program that only sends output.

Kind of hard to trigger exploitable behavior on a program that only sends output.

It wouldn't suprise me to find there were still possible exploits

Re: Endlessh: An SSH Tarpit

#12

Post by jk563 » Wed, Sep 16, 2020, 12:39 PM UTC

DarkWiiPlayer wrote: post #9

Reminds me of the dungeon I built for web crawlers to have fun collecting email addresses at https://darkwiiplayer.com/bot-dungeon xD

Does it only go to level 100?

Re: Endlessh: An SSH Tarpit

#13

Post by gerdesj » Wed, Sep 16, 2020, 12:44 PM UTC

DarkWiiPlayer wrote: post #9

Reminds me of the dungeon I built for web crawlers to have fun collecting email addresses at https://darkwiiplayer.com/bot-dungeon xD

Typo: "yow far will YOU get?"

(sorry)

Re: Endlessh: An SSH Tarpit

#14

Post by fb03 » Wed, Sep 16, 2020, 12:45 PM UTC

codeulike wrote: post #11

klodolph wrote: post #7

Earlier quoted context omitted.

> I'm not sure we should be writing new network connected daemons in C though. In general, yes. However, in this case--no, that's not helpful advice--because this program doesn't actually receive input from clients! Kind of hard to trigger exploitable behavior on a program that only sends output.

Kind of hard to trigger exploitable behavior on a program that only sends output. It wouldn't suprise me to find there were still possible exploits

Explaining, since you were downvoted without a proper reason:

While everything is possible, most exploits happen on buffer overflows on user-received custom data. and since this is not allocating any buffer to receive anything (besides internal connection structures that are filled by the OS), the attack/exploit surface on this one is really tiny, if existent at all.

Re: Endlessh: An SSH Tarpit

#15

Post by seqizz » Wed, Sep 16, 2020, 12:51 PM UTC

I'd rather have a trusted common list of known abusers' IPs. But I think that's harder to maintain.

Re: Endlessh: An SSH Tarpit

#16

Post by mortehu » Wed, Sep 16, 2020, 1:02 PM UTC

seqizz wrote: post #15

I'd rather have a trusted common list of known abusers' IPs. But I think that's harder to maintain.

That's called a DNSBL, and there are many of them, mostly for email spam though.

https://www.dnsbl.info/

Re: Endlessh: An SSH Tarpit

#17

Post by jdc » Wed, Sep 16, 2020, 1:12 PM UTC

xoa wrote: post #8

Are tarpits still of use these days? I sort of figured that even modern script mass attackers have gotten professionalized and sophisticated enough that they can deal with trivial timeouts and the like. I could see actual honeypots still being of use for researchers or blue teams at organizations that are real targets, and ML might even open up some interesting new ways to make those more engaging for longer. But a t…

Depends on your threat model and how playful you are.

Re: Endlessh: An SSH Tarpit

#18

Post by belorn » Wed, Sep 16, 2020, 1:24 PM UTC

xoa wrote: post #8

Are tarpits still of use these days? I sort of figured that even modern script mass attackers have gotten professionalized and sophisticated enough that they can deal with trivial timeouts and the like. I could see actual honeypots still being of use for researchers or blue teams at organizations that are real targets, and ML might even open up some interesting new ways to make those more engaging for longer. But a t…

For individuals and smaller orgs the easiest and by experience the best practice is to use a certificate (or generated and never to be reused password) for ssh authentication, install server monitoring, and then simply observe if the spam from random drive-by causes enough resource drain that would validate further work. Most likely it won't.

Running a tar pit is a bit like installing a trap on a bike in order to teach bike thieves a lesson. It won't really reduce the problem, but for a lot of people the idea of vengeance gives a bit of a warm happy feeling.

Re: Endlessh: An SSH Tarpit

#19

Post by ravi-delia » Wed, Sep 16, 2020, 1:25 PM UTC

codeulike wrote: post #11

klodolph wrote: post #7

Earlier quoted context omitted.

> I'm not sure we should be writing new network connected daemons in C though. In general, yes. However, in this case--no, that's not helpful advice--because this program doesn't actually receive input from clients! Kind of hard to trigger exploitable behavior on a program that only sends output.

Kind of hard to trigger exploitable behavior on a program that only sends output. It wouldn't suprise me to find there were still possible exploits

Crucially, endlessh has a smaller codebase than some shell scripts I've written. If you have ever used any program written with even a single line of Python, you have more to worry about than a 843 line program that appends a string to a socket.

Re: Endlessh: An SSH Tarpit

#20

Post by verroq » Wed, Sep 16, 2020, 1:30 PM UTC

This would have been fun to put onto production machines. We had a botnet that was running ssh bruteforce with 10s requests per second with unique IPs. It stopped after we disabled password auth.