Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Endlessh: An SSH Tarpit

github.com

Post reply on HN
Print view View original

21–30 of 107 posts

Re: Endlessh: An SSH Tarpit

#21

Post by toyg »

belorn wrote: post #18
xoa wrote: post #8

Are tarpits still of use these days? I sort of figured that even modern script mass attackers have gotten professionalized and sophisticated enough that they can deal with trivial timeouts and the like. I could see actual honeypots still being of use for researchers or blue teams at organizations that are real targets, and ML might even open up some interesting new ways to make those more engaging for longer. But a t…

For individuals and smaller orgs the easiest and by experience the best practice is to use a certificate (or generated and never to be reused password) for ssh authentication, install server monitoring, and then simply observe if the spam from random drive-by causes enough resource drain that would validate further work. Most likely it won't. Running a tar pit is a bit like installing a trap on a bike in order to tea…

> Running a tar pit is a bit like installing a trap on a bike in order to teach bike thieves a lesson.

It's more like approaching a thief and persuading him to steal some bike "just around the corner", then guiding him around endlessly. While he's following you, he's also not stealing anything from anyone, his attention (which is naturally finite) gets drained - even just a little bit - to the benefit of the community as a whole. It's not necessarily about vengeance.

Re: Endlessh: An SSH Tarpit

#22

Post by nadavami »

jk563 wrote: post #12
DarkWiiPlayer wrote: post #9

Reminds me of the dungeon I built for web crawlers to have fun collecting email addresses at https://darkwiiplayer.com/bot-dungeon xD

Does it only go to level 100?

It seems to go to as many characters as you can fit in the URL. Each new character after /bot-dungeon/ is a new level.

Pretty clever!

Re: Endlessh: An SSH Tarpit

#23

Post by k33n »

The tarpit approach is a double-edged sword. Sure, you're keeping some script kiddie's machine locked up (maybe), but you're also keeping socket connections open and wasting resources on the machine they are targeting. A much more efficient approach is using fail2ban and a firewall to just drop traffic from offenders.

Re: Endlessh: An SSH Tarpit

#25

Post by kachnuv_ocasek »

xoa wrote: post #8

Are tarpits still of use these days? I sort of figured that even modern script mass attackers have gotten professionalized and sophisticated enough that they can deal with trivial timeouts and the like. I could see actual honeypots still being of use for researchers or blue teams at organizations that are real targets, and ML might even open up some interesting new ways to make those more engaging for longer. But a t…

> if something takes more than a few seconds just skip it (and maybe flag it as a tarpit for punishment)

Good. Isn't that the point? Also, I like your use of the word punishment as something negative in this context.

Re: Endlessh: An SSH Tarpit

#27

Post by venatiodecorus »

toyg wrote: post #21
belorn wrote: post #18

Earlier quoted context omitted.

For individuals and smaller orgs the easiest and by experience the best practice is to use a certificate (or generated and never to be reused password) for ssh authentication, install server monitoring, and then simply observe if the spam from random drive-by causes enough resource drain that would validate further work. Most likely it won't. Running a tar pit is a bit like installing a trap on a bike in order to tea…

> Running a tar pit is a bit like installing a trap on a bike in order to teach bike thieves a lesson. It's more like approaching a thief and persuading him to steal some bike "just around the corner", then guiding him around endlessly. While he's following you, he's also not stealing anything from anyone, his attention (which is naturally finite) gets drained - even just a little bit - to the benefit of the communit…

well what they're saying is sure you can do this but this hypothetical bike thief isn't going to follow you very far. ime this would seem to be the case. most ssh spam is very dumb, just looking for low hanging fruit w/ default credentials, and will likely move on very quickly without success.

Re: Endlessh: An SSH Tarpit

#28

Post by cornstalks »

kachnuv_ocasek wrote: post #25
xoa wrote: post #8

Are tarpits still of use these days? I sort of figured that even modern script mass attackers have gotten professionalized and sophisticated enough that they can deal with trivial timeouts and the like. I could see actual honeypots still being of use for researchers or blue teams at organizations that are real targets, and ML might even open up some interesting new ways to make those more engaging for longer. But a t…

> if something takes more than a few seconds just skip it (and maybe flag it as a tarpit for punishment) Good. Isn't that the point? Also, I like your use of the word punishment as something negative in this context.

> I like your use of the word punishment as something negative in this context.

Some people decide to launch a DDOS attack or something like that in retaliation. It doesn't always happen, but there have been instances of an attacker being thwarted and then trying to punish the victim (who successfully defended themself) in some other way.

Re: Endlessh: An SSH Tarpit

#29

Post by xoa »

cornstalks wrote: post #28
kachnuv_ocasek wrote: post #25

Earlier quoted context omitted.

> if something takes more than a few seconds just skip it (and maybe flag it as a tarpit for punishment) Good. Isn't that the point? Also, I like your use of the word punishment as something negative in this context.

> I like your use of the word punishment as something negative in this context. Some people decide to launch a DDOS attack or something like that in retaliation. It doesn't always happen, but there have been instances of an attacker being thwarted and then trying to punish the victim (who successfully defended themself) in some other way.

Yeah, this is what I had in mind. Right now the economics there seem in favor of attackers since botnet resources for low level DDOS are plentiful. While major players have plenty of measures for mitigation, for a residential/SOHO/SMB/smaller NPO even a very cheap DDOS or actual more focused (but still automated) hunt for vulnerabilities and unpatched targets might cause real trouble. Economics works both ways unfortunately, efforts like tarpits in principle aim to make mass scans more expensive and troublesome reducing the incentives. But attackers in turn can work to make it more expensive and troublesome to run tarpits or the like, and certainly have incentive to see them not spread. So who has the best multipliers and resources?

If "we" (both the overall world community and subsections) were able significantly reduce the resources available to attackers for DDOS making vengeance/example setting more expensive that'd help. But it seems like it's going the other way if anything :(

Re: Endlessh: An SSH Tarpit

#30

Post by pnutjam »

xoa wrote: post #8

Are tarpits still of use these days? I sort of figured that even modern script mass attackers have gotten professionalized and sophisticated enough that they can deal with trivial timeouts and the like. I could see actual honeypots still being of use for researchers or blue teams at organizations that are real targets, and ML might even open up some interesting new ways to make those more engaging for longer. But a t…

Don't forget fail2ban or something similar. 2 hour lockout after 4 bad tries does wonders to discourage bots.
Post reply on HN