Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Watch bots interact with an SSH honeypot in real time

honeypotlive.cc

Post reply on HN
Print view View original

11–20 of 75 posts

Re: Show HN: Watch bots interact with an SSH honeypot in real time

#12

Post by ryandrake »

rkagerer wrote: post #10
tusksm wrote: post #2

Hi HN, I maintain several web servers and kept seeing a constant stream of SSH login attempts. At some point I became curious: what do these bots actually try to do after they get in? I set up a Cowrie SSH honeypot and built a small live dashboard around its JSON logs. Cowrie listens on port 22, a Python service follows the log and streams events over WebSockets, and Nginx serves the frontend. The whole thing current…

Some kind of source IP masking would be prudent. As you pointed out, some of those machines are compromised, and you aren't making their owners' lives any easier. Bad actors might use the data you're publishing to fingerprint specific exploits to which the machines are vulnerable, multiplying the problem. If producing an IP blacklist is one of your aims, divorcing it from any specific traffic would be more responsibl…

> Some kind of source IP masking would be prudent. As you pointed out, some of those machines are compromised, and you aren't making their owners' lives any easier.

Hard for me to find much sympathy for negligent users who unintentionally allowed their home computers or phones to join a malicious botnet, or their ISPs who aren't stopping the activity. Even if it is my own grandma's PC.

I agree about the content though, there probably are a lot of actually innocent victims' personal information in the traffic itself.

Re: Show HN: Watch bots interact with an SSH honeypot in real time

#13

Post by CookieCrisp »

LorenDB wrote: post #8
p1anecrazy wrote: post #4

Earlier quoted context omitted.

Hi, this is very interesting, thanks. While trying to educate myself about honeypots I came across this ( https://securehoney.net/ ). The aggregations of popular logins and IP locations seem interesting.

From that site: Files uploaded 25,522 (46 unique) Malware uploaded 7,735 (43 unique) I wonder what 3 files were so common that they were uploaded 17,787 times instead of malware.

Probably the ssh key

Re: Show HN: Watch bots interact with an SSH honeypot in real time

#15

Post by taftster »

ryandrake wrote: post #12
rkagerer wrote: post #10

Earlier quoted context omitted.

Some kind of source IP masking would be prudent. As you pointed out, some of those machines are compromised, and you aren't making their owners' lives any easier. Bad actors might use the data you're publishing to fingerprint specific exploits to which the machines are vulnerable, multiplying the problem. If producing an IP blacklist is one of your aims, divorcing it from any specific traffic would be more responsibl…

> Some kind of source IP masking would be prudent. As you pointed out, some of those machines are compromised, and you aren't making their owners' lives any easier. Hard for me to find much sympathy for negligent users who unintentionally allowed their home computers or phones to join a malicious botnet, or their ISPs who aren't stopping the activity. Even if it is my own grandma's PC. I agree about the content thoug…

Easy for you to say, assuming your PC is clean. I don't think negligent is the right word though. Ignorant maybe? Or some form of naivety? The negligence might be on software or hardware vendors, but grandma isn't to blame for the problem.
Post reply on HN