News for hackers. Stuff that matters.

A comment on What You Get After Running an SSH Honeypot for 30 Days. Parent comment

Re:What You Get After Running an SSH Honeypot for 30 Days by lucianbr on Sunday June 16, 2024 @10:04AM (#40697160)
Doesn't seem terribly useful. I mean it only obscures that it prints "ok". If you're looking at the logs, you probably already figured out someone is attacking you, and if you didn't, seeing "echo ok" will not help you figure it out.

If the only thing the command does is "obscure what it does", then the only thing it obscures is "obscure what it does". I guess there's no requirement that whoever writes these scripts is a genuis.

[ Parent | on HN ]
Re:What You Get After Running an SSH Honeypot for 30 Days by Retr0id on Sunday June 16, 2024 @10:59AM (#40697567)
People writing malware generally don't want to deploy it on honeypots, because then they're handing their payload (and other tradecraft) directly to analysts.

So often the first stage is an attempt at honeypot detection, or more broadly, device fingerprinting.

A bad honeypot might not even run a real /bin/sh, and this detects that right off the bat.

[ Parent | on HN ]
Re:What You Get After Running an SSH Honeypot for 30 Days by lucianbr on Wednesday June 19, 2024 @10:55AM (#40728898)
That makes a lot more sense than "it obscures the obscure thing it does to obscure itself".
[ Parent | on HN ]