Tag Info

Hot answers tagged

11

Has anyone else tried this: Certainly, yes. Almost every anti-spam service out there uses them, the industry term is "spamtraps" How do you go about doing it? Normally, find an address in one of the domains which receives a lot of spam and confirm with the owner that it is not in use and they have no plans to resurrect it. This process can be ...


11

Yes, Stephen Murdoch at the University of Cambridge has done it, earlier this year. You can read his results in the Security Research Group blog; the initial experiment is discussed in this article, and some more results appear in this article. My personal favourite bit was For example, there was a log-in attempt for the usernames “root” and “dark” ...


8

There are a few books on the subject (although I've never bothered with them), however I can recommend you some readily updated websites: The always interesting honeyblog The European Network of Affined Honeypots has many recent papers and presentations The Honeynet Project has some good papers Distributed honeypot management software and a video ...


5

Project Honey Pot may give you some ideas as to methods and effectiveness. If you want, you can subscribe to their blacklist and let them handle all this. I am confused as to what you mean by "legitimate senders using harvested addresses" - I would, in almost all cases, deem such a sender illegitimate by definition.


4

i have not tried this method, but i think [ unless you handle tens of thousands of mailboxes ] you'll be much better off using anti-spam system that takes decision based on multiple rbls and content checks like dcc / razor / pyzor. many rbls use spam traps on much wider scale than i think you could deploy.


4

Since SSH attacks are dictionary-attacks with some flair, downloading a text file of a dictionary would provide you with a lot of potential passwords. It wouldn't hurt to set up a honeypot as that would provide you with more common passwords. If you feel lazy however, you could download a plaintext of password dumps from major websites, as there are plenty ...


4

If you want to allow legitimate SSH logins while disallowing (via honeypot) fake, I'd change tack. Put your SSHD on another port, like 2323 or some other oddball port, and forward connections to that. Ideally you have a separate machine for that, so you can tell your router to forward port 2323 to internal machine XYZ port 22. Open port 22 to be forwarded ...


3

14.1.0.0 with the subnetmask 255.255.255.0 is no valid host address! It is the address of the subnet. Try using another IP for your host (like 14.1.0.1)


3

You can't. At least not with the standard ssh. You need to edit the source code (auth.c is the file to look at) and recompile the software. It is a damn stupid idea though, unless you are specifically building a honey-pot system. Doing this violates the whole purpose of the secure shell. The system-log is readable by most users on the system so as soon as ...


3

You want Honeyd - Honeyd is a small daemon that creates virtual hosts on a network. The hosts can be configured to run arbitrary services, and their personality can be adapted so that they appear to be running certain operating systems. Honeyd enables a single host to claim multiple addresses - I have tested up to 65536 - on a LAN for network simulation. ...


3

With the relative scarcity of IPv4 addresses, I'd guess that you'll have a hard time finding a host that will be willing to part with "a lot of IP addresses". From what I've been able to gather, most people who are running honeypot servers are associated with either Universities or other organizations that have access to a large IP space to begin with.


2

You could write something for fail2ban to parse iptables rules, and ban ips that hit particular ports.


2

Honeypots are extremally useful for any environment and they don't need to be anything fancy or crazy. Examples that we do: -Create a fake account on or mailserver (say userX) with a few fake links in his mailbox (things like user directory link, payment link, etc all pointing to an internal server). Now we monitor any access to these pages via the logs ...


2

My concern with blacklisting every sender is that it is fairly easy to spoof who sent an email.


2

Hmm... Just adding my opinion to the discussion. I don't think this method has a good success rate. Just had a look on a bunch of Spams. Generally spammers use fake email addresses while spamming and they never use the same address again and again. So blacklisting the Email addresses or Domains would not be a good solution. But your hidden address thing ...


2

Here someone describes an approach using PAM with a customized module. Haven't tried this myself, but it seems to be what you're looking for.


2

You can achieve this by patching the auth.c file of opensshd. But it is never a good idea to store passwords to a log file because you will end up logging successful logins too. There is an article talking about this issue here You can also try to edit sshd_config and set the LogLevel of SyslogFacility to VERBOSE SyslogFacility AUTH LogLevel VERBOSE ...


1

It's very possible whatever network your behind does not allow outbound connections to port 49153. One way to avoid this is to use the Java based client in your browser provided by Amazon.


1

Is it the same for me blocking these pages or will they see the 403 Forbidden page? Blocked images, including favicon, does not result in a 403 page being displayed. The image will simply not be displayed in the same fashion as if it was not found.


1

That's pretty easy with telnet. You could do something like this: open a command prompt (Execute cmd on Windows) and type these three lines: telnet www.yoursite.com 80 GET /favicon.ico HTTP/1.1 host: www.yoursite.com Type twice for an output Type Ctrl+C to return to command prompt You will get a nice output with headers and html. Tips for those of ...


1

Using a tool like fail2ban as a starting point will allow you to treat those trying to brute-force differently from legitimate users. Usually fail2ban will just reject the connections, but I guess it wouldn't be hard to modify it to redirect the connections to a honeypot instead. The tricky part is actually going to be the host key. On one hand you don't ...


1

14.1.0.0/24 (/24 -> netmask = 255.255.255.0) is a "Network ID". it is a reserved address, and cannot be used for hosts. Valid addresses go from 14.1.0.1-14.1.0.254 (.255 is reserved as a broadcast address).


1

I cant think of a useful thing to do, but you can have code to redirect the scanner back to the connecting ip address. Or if you don't mind the open connections, have some php or other code sleep for 5-10 seconds or more before sending a redirect, a 404, or some 500 error.


1

You can only set gateways on local subnets. This is because once you give a packet to another machine, it's free to route the packet any way it wants. So you might say "look, I want to route this packet destined for 14.1.0.1 via 10.156.149.144, so to get the packet there I'll pass it to 10.156.16.1", and then when you hand the packet to 10.156.16.1, it ...


1

I have done this. I noticed in my logs certain invalid addresses getting hit again and again. These are addresses that were never active or posted anywhere. So I setup a mailbox that sends those emails to sa-learn to help train spamassassin's Bayesian database. I've never tested the effectiveness of this in any way, but I'm not too worried about it as it ...


1

My first though was that this would be of little value since the addresses are always changing. But in my experience, spammers often send to a load of addresses@yourdomain.com - almost in a brute forced way. It might be worth setting an address up (say adam@yourdomain.com) and filtering not on the from address or IP, but on content - filter out any email ...


1

Our anti-spam product allows us to do this, an automated blacklist of everything sent to a honeypot. Here are a couple of the bullet points: You post an email address on your website such that bots can find it and pick it up, but no real person would see it or send messages to that address. You tell your anti-spam product to monitor incoming email sent to ...


1

I put an address in a comment on my main page. It gets about 5 emails a day.


1

In theory you can avoid the slow load time by making your blackhole list part of your root hints file (e.g. via $INCLUDE) and then changing that file from being a hint to a master. That last bit is necessary to prevent your server from download the real root hints from the internet. e.g. in named.ca: a.root-servers.net. IN A .... m.root-servers.net. IN ...



Only top voted, non community-wiki answers of a minimum length are eligible