Actual article: https://www.gosecure.net/blog/2023/08/09/how-unparalleled-rd...

This is hilarious, and a fun exercise to try out if you want to learn how attacks are pulled off. It's worth having a few 'honey credentials' sitting in plaintext on the honeypot HDD and watch as the threat actors try to use them. Also worth enabling SSH and watch for login attempts like in this: https://brute.fail/

Man, what a way to malign bards.

Bard is a great class!

... certainly not the type to sit around and download porn all day, I'm sure...

That was my thought. Bards are underrated!

Also, bards are probably the least likely to download it as they are busy making it.

Well … played

The RDP interception tool used by the researchers: https://github.com/gosecure/pyrdp

I wonder if an "enterprise" version of this might exist so that companies can audit what their administrators do on high-impact systems.

I know CyberArk PAS has this feature, and there are others. https://docs.cyberark.com/PAS/11.6/en/Content/PASIMP/Configu...

RDP proxy tools certainly exist for gateway access to critical systems.

Doesn't publicizing this reduce its utility?

Most of these attacks are done with completely automated tools. Put in an IP range and off it runs. I doubt most users even realize when they get stuck in the honeypots. Just run the script and go off doing something else.

In 2016-2017 I opened telnet (23) and a special authless sshd on 22 that both went directly into Crowther & Woods' Adventure "You are standing at the end of a road before a small brick building. Around you is a forest. A small stream..." etc. and logged all keystrokes. To keep everything quaint and throttled I limited simultaneous connections to 1 and paced output to the 30 cps of a Bell 103 modem. After glancing through logs every day and performing a more comprehensive analysis after a year, of ~100k connections NOT ONE HUMAN was spotted playing the game. It's bots and worms all the way down.

Honeypots are fun. I documented how I ran one here: https://the-empire.systems/how-to-run-honeypot

The TL;DR is that I deployed heralding[0].

If I recall correctly, I think within two days of the server being online, there were over 50,000 attempts to login.

[0] https://github.com/johnnykv/Heralding