djkurlander

Yes. And in retirement, I still code because I like the process of creating (hopefully cool) things. Even without remuneration. Ideally things that other people will use and benefit from in some way.

Nothing wrong with contacting the customer, and taking down the IP briefly until the customer can deal with their malware hosting toaster.

However, I can see the argument for giving the customer 24-48 hours to resolve the problem.

Yeah, that’s pretty interesting! You can also see a live view of the ASN/ISP leaderboard by going to https://knock-knock.net and choosing ISP from the carousel. That’s ordered by bot transaction count rather than IP count though.

It never ceases to amaze me that these ISPs don’t bother to shut down the botnets. They could do so very easily. For example, they could identify the IP address of every bot that hit this honeypot with their ASN with one API call: https://api.knock-knock.net/check-asn?asn=<asn number>. (See https://knock-knock.net/api). They just don’t care!

It's on github with an MIT license: https://github.com/djkurlander/knock-knock. Have fun!

I run an open source honeypot that collects these botnet scans and produces blocklists.

Blocklist download and configuration: https://knock-knock.net/blocklist

Honeypot dashboard, where you can see attempted attacks in realtime: http://knock-knock.net

API: http://knock-knock.net/api

Crafted that awesome response to your original query myself, and I am very human.

Good question. You can certainly proxy SIP. But what’s notable here is that the traffic comes directly from organizations that should be secure: banks, infrastructure, governments. For a proxy to explain it, the proxy exit node would have to be running inside those institutions, on their networks. So from a security standpoint it doesn’t really matter whether a botnet is running inside the company or the company is being used as a proxy hop. Either way, a machine on their network has been compromised.

(And your P.S. is spot on. The attacker bears none of the cost; the clean IP reputation and the blame land on the compromised third party.)

Much appreciated! Trying to help out the community with the honeypot & API, and it's always fascinating what attack patterns show up.

As mentioned above, wrote the blog post myself and had AI proofread and edit. As for the honeypot itself, I'm a greybeard computer scientist, and I architected the system very deliberately myself, using AI as a coding accelerator. Earlier in my career, moving from Assembly to C, I certainly appreciated the convenience of a higher level language. Same from C to C++ to Java/Lisp/Python to LLM. It's always a march to higher level languages and letting the computer do more work.

Wrote the blog post myself, and used AI to clear up typos and occasionally improve wording. I have a PhD in computer science, but I was initially planning to pursue journalism instead, so I like to think that I can write good :-).

Ha! Love it. Totally believe in it too.

I set up servers on the net that masquerade as a SIP relay by essentially supporting the protocol but with few authentication protections. Malware bots scan the IPv4 space looking for such machines that they can use as a relay. My honeypot is actually an extensible framework, and we also can mimic SSH, Telnet, HTTP, SMB, FTP, RDP, SMTP, MQTT, Node-Red, MODB, S7, and SNMP. Individual servers can easily be set up to scan any subset of those. Check out https://knock-knock.net to get a visual sense of what the honeypot is doing!

The actual blog post clarifies this as well. But still in some sense these organizations share some level of responsibility if it is their machines, attacking from their ASN.

Yes - I would have expected better from these institutions as well, but there's always going to be someone who brings their rogue laptop onto the corporate net. The key is how fast the security catches it. They can use the api that I describe in the blog to check my honeypot for their IPs. Very simple to put into a daily or hourly script.

Thanks! Just trying to keep the world safe from marauding Teddy Bears.

OP here.

See the hidden world of bot attacks and scanner chatter. Listen to Internet Background Radiation on a virtual Geiger counter.

Here we are capturing Internet chatter across 8 protocols: (SSH, Telnet, FTP, RDP, SMB, SIP, HTTP, and SMTP), targeting 8 servers distributed throughout the world.

Check out the 3D spinning globe heatmap. Explore the most popular usernames and passwords across a variety of protocols. See the ISP Wall of Shame.

If the info is coming in too fast and furious, hit the pause button (or space bar if you have a keyboard).

We are using a framework for deploying and displaying honeypot activity: https://github.com/djkurlander/knock-knock. Honeypots transmit their data (in JSON format) to a monitor that stores the info in a SQL database and publishes the info to redis. The front end service (using uvicorn) gathers this info and serves it to browsers via web sockets.

For just the dashboard without the explanation, visit https://knock-knock.net

Over 3 million (bot interactions) served!

The goal is to educate people (originally my kids) about one particular aspect of cybersecurity. I love it when people use the site for this purpose.

Yep, with ~80 knocks coming in per second and two 3D globe visualizations, it does make a lot of use of the browser. That said, it runs smoothly even on an iPhone browser. The server scales really well (longtime load average of 0.05 on a $6.75/year VPS :-).

Thanks!

OP here. Check out the new https://knock-knock.net. v1 got 40,000+ visits from HN alone, hoping you'll find v2 worth checking out too.

Watch bots trying to break into my honeypots, gain access to my files, place expensive VOIP calls, attack my HTTP server, and relay SPAM email. The new knock-knock.net shows you SSH, Telnet, FTP, RDP, SMB, SIP, HTTP, and SMTP attacks in real-time: where they are coming from (check out the spinning globe heat-map!), the most common usernames and passwords, info on why some of those usernames and passwords are being used, the worst offending IPs, and of course the ISP wall of shame. View the stats for the protocols together, or filter by protocol. All presented in what I hope is a very cool UI.

The new knock-knock.net aggregates attack info from multiple servers around the world and presents the info in one place, hence you'll see attacks come in at a furious pace, and may want to use the pause button (or space bar). Turning on audio (the speaker icon) lets you hear what some have called the "background radiation of the internet" on a virtual geiger counter. This is intended to be a fun, educational site, not a serious cybersecurity tool.

A few random, interesting things:

1) The locations of the bots doing the various protocol attacks differ pretty dramatically. For example, Romania, Poland, and the Netherlands are currently big for SSH bots, India leads for SMB, China is tops for RDP, and France for SIP, but the US is #1 overall.

2) SMTP attempts are usually sentry emails. SMTP bots first try to send an email to themselves so they can tell the server is a working relay. Notice that nearly all of the emails include my IP address in the subject or body (it appears here redacted as <target-ip>) so they can tell the relay is operative.

3) The Internet has been blocked for nearly all of the citizens of Iran since the January protests. However, I found it surprising that attacks still originate from servers there.

4) RDP and SIP bots will connect to a server and spam it practically non-stop. I had to set up an autoban for these protocols at 2,000 knocks - much lower than the 10,000 knock ban set for the other protocols.

5) As of this posting, we're still waiting for knocks from several African countries. They tend to have fewer internet servers than the rest of the world. However, we did get knocks from Jersey (the island, not the state or cow), Nauru (~10K people), and Monaco (~2 km^2). Surprising that we're still waiting for EU member Slovenia!

6) We've even seen knocks from space! Well from ISP SpaceX/Starlink anyway. You would think this would be expensive, but bots are often replicated on machines they infect, and they aren't paying the bills.

7) The worst offending ISP is ironically named "Unmanaged Ltd." Interestingly, it was previously DigitalOcean, but shortly after v1 was posted to HN and r/digital_ocean, and user comments skewered that ISP, their bot attacks dropped over 99%! Coincidence? Maybe. Maybe not.

Works great on desktop or mobile — try it out and let me know what you think. Happy to answer questions and take suggestions.

For a tutorial, see https://knock-knock.net/summary.

To see the original v1 knock-knock.net (collecting data for 90 days), visit: https://v1.knock-knock.net.

If the aggregated v2 site is too fast for you, visit a single feeder server (e.g. https://la5.knock-knock.net).

The source lives at https://github.com/djkurlander/knock-knock.

Thanks. I'd like to better understand the origin of DO's bot activity, and look forward to your report!

It has been 24 hours since this post went up, so here are some fun stats.

During this time, there were 13,024 knocks on the server from 368 unique IPs. That's ~35 knocks per bot.

During this time, thanks to Hacker News, there were 23,556 visits to knock-knock.net by 15,946 humans. That's ~1.5 visits per human.

So in the last 24 hours, we actually had nearly twice the number of human visits than bot visits, and 368 bots put on a show for 16,000 humans!

Ah, that makes sense. I’ve been wondering why DigitalOcean has so much of the bot traffic.

Hadn’t considered it, but that’s a nice idea. All of the necessary info, with time stamps, is already recorded in a SQL database, so it wouldn’t be difficult to replay events.

Thanks for pointing that out. T-Pot is cool and a more general honeypot framework. Potentially I could have built knock-knock.net on top of T-Pot.

Fail2ban would cut down on the noise quite a bit. I’ve installed it on other servers and have recommended it to others. But then we wouldn’t have all of this beautiful bot traffic to visualize.

Though strong passwords or preferably ssh keys are important, there will always be servers with weak passwords.

And DO doesn’t have to side with individual abuse reporters. If they cared, they could spend a fraction of an hour setting up the knock-knock software on one of their own servers, and generate their own list of abusive IPs. They just don’t care.

No, knock-knock.net is not hosted on DigitalOcean, and all 4 of my other knock-knock servers, using different providers, and distributed geographically currently have DigitalOcean as the worst offending provider.

My understanding is that they are a more general purpose data collection, and visualization framework. Potentially you could build something like this with that software, but they do not have knock-knock.net’s functionality built in.