Live data from Hacker News

TFTP Honey Pot Results

bruceediger.com

41–47 of 47 posts

Re: TFTP Honey Pot Results

#41

Earlier quoted context omitted.

You just need more esoteric hobbies.

What's hot (or "not yet hot" rather) these days?

Whatever it is, if it's computer-related, it's certainly been overrun by marketing companies.

How about amateur chemistry? Or ham radio?

Re: TFTP Honey Pot Results

#43
post #3

I love investigating internet background radiation, this is interesting research. I've definitely seen spa504g.cfg (IP Phone) and spa112.cfg (Cisco analog terminal adapter) before; you should actually serve these a proper config file and spin up a disposable SIP server so you can (potentially) call them on the phone, send them a fax or even better ATDT ;) Though, come to think of it these requests are more likely fro…

Were the spa504g.cfg pulls coming from the same infosec scanner IPs as everything else or from another source? Curious whether the targeted-looking requests actually separate out from the background noise.

Re: TFTP Honey Pot Results

#44
post #3

I love investigating internet background radiation, this is interesting research. I've definitely seen spa504g.cfg (IP Phone) and spa112.cfg (Cisco analog terminal adapter) before; you should actually serve these a proper config file and spin up a disposable SIP server so you can (potentially) call them on the phone, send them a fax or even better ATDT ;) Though, come to think of it these requests are more likely fro…

Were the spa504g.cfg pulls coming from the same infosec scanner IPs as everything else or from another source? Curious whether the targeted-looking requests actually separate out from the background noise.

Different source.

Re: TFTP Honey Pot Results

#45
post #41

Earlier quoted context omitted.

What's hot (or "not yet hot" rather) these days?

Whatever it is, if it's computer-related, it's certainly been overrun by marketing companies. How about amateur chemistry? Or ham radio?

Yeah, that first part is certainly how it feels.

Thanks for the recommendations and for being taken seriously :) Chemistry is actually something I have considered before, so not so far out there. Thanks!

Re: TFTP Honey Pot Results

#46
post #27
post #18

Earlier quoted context omitted.

I almost got kicked off an early ISP for echo “+++ATH0” > ~/.plan On the shell host they provided, it would reliably hang up lots of modems if someone ‘fingered’ you back in the day. You could do it in busy IRC channels well onto the 2000’s and still see some people drop off line.

That only works on modems that don't support the (patented) delay requirement betwixt +++ and a command that Hayes instituted...which was actually quite a large percentage of them by the time v.34 came 'round. Plus, the string needs to come from the DTE side of things (the user's local PC), not the remote end. So, with finger and IRC channels alike: The hack relies upon the ISP's modem to behave in that way, and not…

First I've heard of ATHD command. Pretty sure my modem would ignore anything after ATH, and if you did ATDT would fail without a dial tone. But obviously, you couldn't send them as one command, but as separate commands. That might work in the same packet, so +++ATH\nATDTxxx but I suspect that you'd probably need a lot of \n as padding to introduce sufficient delay after the ATH.

Re: TFTP Honey Pot Results

#47
post #27

Earlier quoted context omitted.

That only works on modems that don't support the (patented) delay requirement betwixt +++ and a command that Hayes instituted...which was actually quite a large percentage of them by the time v.34 came 'round. Plus, the string needs to come from the DTE side of things (the user's local PC), not the remote end. So, with finger and IRC channels alike: The hack relies upon the ISP's modem to behave in that way, and not…

First I've heard of ATHD command. Pretty sure my modem would ignore anything after ATH, and if you did ATDT would fail without a dial tone. But obviously, you couldn't send them as one command, but as separate commands. That might work in the same packet, so +++ATH\nATDTxxx but I suspect that you'd probably need a lot of \n as padding to introduce sufficient delay after the ATH.

I think I tested the combined command locally once (not with 911) and it worked. But that was 30-ish years ago and I might be misremembering. :)

Separating the commands and adding some (even small) delay would add a good amount of certainty, though. Absolutely. That's a good method. I think modems expect CR instead of LF as command termination, though, which suggests \r instead of \n.

Either way, for more haunted computer goodness: M2L3 before the dial command. This silences the dialtone and the dialing, and maximizes the loudness of the person that answers.

Post reply on HN