Learn from your attackers with a high interactivity SSH Honey Pot

Re:Learn from your attackers with a high interactivity SSH H... by 3fe9a03ccd14ca5 on Saturday January 04, 2020 @12:02AM (#21952975)

My experience with kippo was that it basically didn’t work. They’d come in and run a few commands and then ghost. I figured they had some easy way to find out if they were inside a honeypot that’s was immediately obvious to me.

[ Parent | on HN ]

Re:Learn from your attackers with a high interactivity SSH H... by mike_d on Saturday January 04, 2020 @12:47AM (#21953135)

Yup, Kippo is extremely easy to detect.

Full interaction honeypots based on NAT like this are also detectable if you look at RTT and TTL on packets pre-auth and post-auth.

[ Parent | on HN ]

Re:Learn from your attackers with a high interactivity SSH H... by frequentnapper on Saturday January 04, 2020 @01:45AM (#21953323)

in this case: check if a directory /home/honssh exists to detect that it's a honeypot?

[ Parent | on HN ]

Re:Learn from your attackers with a high interactivity SSH H... by robputt796 on Saturday January 04, 2020 @03:29AM (#21953686)

I think this would not work because the HonSSH server with the HonSSH user is hosting a proxy service. The user gets dumped into an actual vanilla looking Linux host at the backend.

[ Parent | on HN ]