Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Watch bots interact with an SSH honeypot in real time

honeypotlive.cc

Post reply on HN
Print view View original

61–70 of 75 posts

Re: Show HN: Watch bots interact with an SSH honeypot in real time

#61

Post by exiguus »

reaperducer wrote: post #24
drcongo wrote: post #11

You know what extra data would be cool? If you hit `curl https://ip.guide/{src_ip} ` and got back the ASN and country etc and added a leaderboard. In my own experiments in this area I've been gobsmacked by how much malicious traffic comes from Azure.

In my own experiments in this area I've been gobsmacked by how much malicious traffic comes from Azure. I'm currently fighting this battle. As of this morning: 80% of malicious traffic comes from Azure. 10% from Digital Ocean. 5% from AWS. 5% from GCP.

I have a similar experience with a tendency to Digital Ocean. Actually, I semi-automatically collect IPs that are banned by (mostly SSH) fail2ban and eBPF bans from dnsdist. These IPs are then merged into CIDRs, which are used as ipsets in a firewall ban chain. The IPs are collected on around ~20 Machines with public, static IPv4 and IPv6 addresses. Most of the Machines are in Canada and Europe.

However, I have statistics for the CIDRs based on their whois record that look like:

CIDRs used: 1255

Already cached: 1252

Skipped uncached targets: 0

IPs scanned total: 985300

Estimated throttled wait: 0.10 minutes

== Country codes ==

Metric: Top 10 of 90 unique country codes

Total: 1183 country codes total and 90 unique country codes in 1255 targets

  US  287
  CN  132
  NL  88
  VN  53
  DE  51
  HK  45
  AU  38
  ID  36
  RU  33
  CA  27
== Regions ==

Metric: Top 10 of 29 unique regions

Total: 334 regions total and 29 unique regions in 1255 targets

  CO  48
  FL  40
  WA  37
  QLD  32
  GA  26
  NY  25
  CA  23
  TX  17
  QC  15
  UT  14
== Origin ASNs ==

Metric: Top 10 of 382 unique origin ASNs

Total: 805 origin ASNs total and 382 unique origin ASNs in 1255 targets

  AS16276  26
  AS132203  24
  AS24086  18
  AS38731  18
  AS7552  18
  AS24940  17
  AS9808  15
  AS135377  14
  AS137718  13
  AS62390  11
== Netnames ==

Metric: Top 10 of 630 unique netnames

Total: 1157 netnames total and 630 unique netnames in 1255 targets

  RIPE  38
  MSFT  31
  SINGLEHOP  25
  ACEVILLEPTELTD-SG  21
  VIETTEL-VN  18
  CMNET  17
  APNIC  16
  CHINANET-GD  14
  VOLCANO-ENGINE  13
  UCLOUD-HK  11
== Org names ==

Metric: Top 10 of 222 unique org names

Total: 703 org names total and 222 unique org names in 1255 targets

  RIPE Network Coordination Centre  55
  DigitalOcean, LLC  40
  Asia Pacific Network Information Centre  32
  Microsoft Corporation  31
  Internap Holding LLC  25
  HostPapa  23
  Korea Telecom  20
  Hetzner Online GmbH  17
  China Mobile  16
  ReliableSite.Net LLC  16
== Organizations ==

Metric: Top 10 of 236 unique organizations

Total: 691 organizations total and 236 unique organizations in 1255 targets

  RIPE Network Coordination Centre (RIPE)  55
  DigitalOcean, LLC (DO-13)  40
  Asia Pacific Network Information Centre (APNIC)  32
  Microsoft Corporation (MSFT)  31
  Internap Holding LLC (IC-1425)  25
  HostPapa (HOSTP-7)  23
  ORG-HOA1-RIPE  17
  ORG-CM1-AP  16
  ReliableSite.Net LLC (RL-323)  15
  FranTech Solutions (SYNDI-5)  13
== Domains ==

Metric: Top 10 of 534 unique domains

Total: 2581 domains total and 534 unique domains in 1255 targets

  rdap.arin.net  404
  apps.db.ripe.net  83
  chinatelecom.cn  63
  vnnic.vn  58
  ripe.net  55
  www.ripe.net  53
  apnic.net  46
  digitalocean.com  44
  ovh.net  38
  www.as14061.net  35
I deleted the (abuse) mail section. Because. 99% of the IPs are IPv4. In the IPset are mostly /32 but also a lot of ~/24 and rarely ~/16 segments. RIPE, ARIN and APNIC comes into play because some CIDR blocks are somewhat generously sized and block multiple network segments belonging to different organizations at the same time. E.g. this hides BR from the stats (because the ipset mostly bans every provider from BR).

Re: Show HN: Watch bots interact with an SSH honeypot in real time

#64

Post by left-struck »

tusksm wrote: post #2

Hi HN, I maintain several web servers and kept seeing a constant stream of SSH login attempts. At some point I became curious: what do these bots actually try to do after they get in? I set up a Cowrie SSH honeypot and built a small live dashboard around its JSON logs. Cowrie listens on port 22, a Python service follows the log and streams events over WebSockets, and Nginx serves the frontend. The whole thing current…

> a system fingerprinting script that appears designed to distinguish a real shell from a honeypot

Huh, so if you figure out what triggers this script into thinking your system is a honeypot, and then make your real system behave that way… unhackable /s

Re: Show HN: Watch bots interact with an SSH honeypot in real time

#66

Post by yjftsjthsd-h »

reaperducer wrote: post #24
drcongo wrote: post #11

You know what extra data would be cool? If you hit `curl https://ip.guide/{src_ip} ` and got back the ASN and country etc and added a leaderboard. In my own experiments in this area I've been gobsmacked by how much malicious traffic comes from Azure.

In my own experiments in this area I've been gobsmacked by how much malicious traffic comes from Azure. I'm currently fighting this battle. As of this morning: 80% of malicious traffic comes from Azure. 10% from Digital Ocean. 5% from AWS. 5% from GCP.

100% is from those 4 clouds?

Re: Show HN: Watch bots interact with an SSH honeypot in real time

#67

Post by tusksm »

micheloosterhof wrote: post #58

Cowrie author here! Yes this is the usual background noise on the internet! Cowrie (which I suspect is used here as well as the data generator) recently had a lot of updates, including now easy install from pip (pip install cowrie), and a much improved shell parser that’s much more capable of parsing attacker commands! https://github.com/cowrie/cowrie and get the full raw data in JSON or other formats to add geoip an…

[dead]

Re: Show HN: Watch bots interact with an SSH honeypot in real time

#68

Post by throawayonthe »

tusksm wrote: post #55
Fabricio20 wrote: post #53

Opened the website to be greeted with only spam of huge walls of random text, seems people are abusing the fun out of it! Would love to actually have seen some interesting bot patterns from the authors comments.

You're right. HN traffic quickly turned the live feed from bot activity into a wall of human-generated test payloads. I'm already working on truncating long values and grouping events by source. The next step will probably be rate limiting noisy sources and separating likely human test traffic from recurring automated behavior. The recurring bot patterns are the part I ultimately want the interface to surface, rather…

can't you just keep the honeypot secret and detached from the interface? i guess someone might start scanning ips until their message pops up but still

Re: Show HN: Watch bots interact with an SSH honeypot in real time

#69

Post by voakbasda »

inigyou wrote: post #54
fragmede wrote: post #50

Yeah I have an SSH daemon running on the default port at funky.nondeterministic.computer for people to hit, but it's mostly bots, which is no fun.

Do you allow them entry, present a fake prompt, and record what they do? Some time ago I did a little experiment by running `nc -l -p 23` (telnet) which connects the next incoming telnet connection to your console. Type in a simulated prompt like Password: or # and it'll be buffered until the connection comes in. Then see what the scanner sends.

Danger. I believe this opens a RCE hole if the attacker sends a properly crafted sequence of terminal escape codes.

Re: Show HN: Watch bots interact with an SSH honeypot in real time

#70

Post by drcongo »

exiguus wrote: post #61
reaperducer wrote: post #24

Earlier quoted context omitted.

In my own experiments in this area I've been gobsmacked by how much malicious traffic comes from Azure. I'm currently fighting this battle. As of this morning: 80% of malicious traffic comes from Azure. 10% from Digital Ocean. 5% from AWS. 5% from GCP.

I have a similar experience with a tendency to Digital Ocean. Actually, I semi-automatically collect IPs that are banned by (mostly SSH) fail2ban and eBPF bans from dnsdist. These IPs are then merged into CIDRs, which are used as ipsets in a firewall ban chain. The IPs are collected on around ~20 Machines with public, static IPv4 and IPv6 addresses. Most of the Machines are in Canada and Europe. However, I have stati…

Not sure why this got voted down to death, I found it interesting, thanks.
Post reply on HN