Re:Potential Weaponizing of Honeypot Logs
by avidiax on Saturday September 02, 2023 @03:33AM
(#37359265)
It's an interesting optimization problem for the attacker.
The most common passwords are problematic. They will frequently work, but they will work for the other guy, too. So then the question is "how do you pull up the ladder?"
Changing the password is simple, but likely to get the machine reimaged.
Looking at the login history would give an allowlist of subnets, which can be used to deny other attackers access, but hopefully without inconveniencing the owner into reimaging.
Re:Potential Weaponizing of Honeypot Logs
by Caligatio on Sunday September 03, 2023 @02:23AM
(#37368145)
I've never seen it used in this context; it usually is used in reference to a social program (i.e. you benefitted from something and then advocate for it to be abolished).
The most common passwords are problematic. They will frequently work, but they will work for the other guy, too. So then the question is "how do you pull up the ladder?"
Changing the password is simple, but likely to get the machine reimaged.
Looking at the login history would give an allowlist of subnets, which can be used to deny other attackers access, but hopefully without inconveniencing the owner into reimaging.