He helu helu no 24 mau hola ma hope o ka hoʻokomo ʻana i ka honeypot ma kahi node Digital Ocean ma Singapore
Pew Pew! E hoʻomaka koke kākou me ka palapala hoʻouka kaua
Hōʻike kā mākou palapala ʻāina ʻoluʻolu i nā ASN kūʻokoʻa e pili ana i kā mākou Cowrie honeypot i loko o 24 mau hola. Pili ka melemele i nā pilina SSH, a pili ka ʻulaʻula me Telnet. ʻO ia mau animation e hoʻohauʻoli pinepine i ka papa alakaʻi o ka hui, hiki ke kōkua i ka loaʻa kālā hou aku no ka palekana a me nā kumuwaiwai. Eia nō naʻe, loaʻa i ka palapala ʻāina kekahi waiwai, e hōʻike pono ana i ka laha ʻāina a me ka hoʻonohonoho ʻana o nā kumu hoʻouka kaua ma kā mākou mea hoʻokipa i nā hola 24 wale nō. ʻAʻole hōʻike ka animation i ka nui o ke kaʻa mai kēlā me kēia kumu.
He aha ka palapala 'āina Pew Pew?
Palapala Pew Pew Ua , maʻa mau i nā animated a nani loa. He ala maikaʻi ia e kūʻai aku ai i kāu huahana, i hoʻohana ʻia e Norse Corp. Ua hoʻopau maikaʻi ʻia ka hui: ua ʻike ʻia ʻo nā animation nani wale nō kā lākou pono, a ua hoʻohana lākou i ka ʻikepili fragmentary no ka nānā ʻana.
Hana ʻia me Leafletjs
No ka poʻe makemake e hoʻolālā i kahi palapala hoʻouka kaua no ka pale nui ma ke kikowaena hana (makemake kou haku), aia kahi waihona. . Hoʻohui mākou me ka plugin , lawelawe Maxmind GeoIP - .
WTF: he aha kēia ʻo Cowrie honeypot?
ʻO ka Honeypot kahi ʻōnaehana i kau ʻia ma ka pūnaewele e hoʻowalewale i nā mea hoʻouka. ʻAʻole hewa nā pilina i ka ʻōnaehana a ʻae iā ʻoe e ʻike i ka mea hoʻouka me ka hoʻohana ʻana i nā lāʻau kikoʻī. ʻAʻole wale nā ʻike pili maʻamau i mālama ʻia e Logs, akā ʻike pū kekahi i ka ʻike hālāwai e hōʻike ana nā ʻenehana, nā hana a me nā kaʻina hana (TTP) mea komo hewa.
hanaia no Nā moʻolelo pili SSH a me Telnet. Hoʻokomo pinepine ʻia kēlā mau honeypots ma ka Pūnaewele e nānā i nā mea hana, nā palapala a me nā pūʻali o nā mea hoʻouka.
ʻO kaʻu leka i nā hui e manaʻo nei ʻaʻole lākou e hoʻouka ʻia: "Ke nānā ikaika nei ʻoe."
— James Snook
He aha ka mea i loko o nā lāʻau?
Huina helu o na pili
Ua ho'āʻo pinepine ʻia ka hoʻohui ʻana mai nā pūʻali koa he nui. He mea maʻamau kēia, no ka mea he papa inoa piha o nā palapala hōʻeha a hoʻāʻo i kekahi mau hui. Hoʻonohonoho ʻia ka Cowrie Honeypot e ʻae i kekahi inoa inoa a me nā hui ʻōlelo huna. Hoʻonohonoho ʻia kēia ma waihona user.db.
Ka honua o nā hoʻouka kaua
Ke hoʻohana nei i ka ʻikepili geolocation Maxmind, helu wau i ka helu o nā pilina mai kēlā me kēia ʻāina. Ke alakaʻi nei ʻo Brazil a me Kina ma kahi ākea ākea, a nui pinepine ka walaʻau mai nā scanners e hele mai ana mai kēia mau ʻāina.
Mea nona ka poloka pūnaewele
ʻO ka noiʻi ʻana i nā mea nona nā poloka pūnaewele (ASN) hiki ke ʻike i nā hui me ka nui o nā pūʻali hoʻouka kaua. ʻOiaʻiʻo, ma ia mau hihia pono ʻoe e hoʻomanaʻo mau i ka nui o nā hoʻouka ʻana mai nā pūʻali maʻi maʻi. He mea kūpono ke manaʻo ʻaʻole naʻaupō ka hapa nui o nā mea hoʻouka e nānā i ka Pūnaewele mai kahi kamepiula home.
E wehe i nā awa ma nā ʻōnaehana hoʻouka (ka ʻikepili mai Shodan.io)
Ke holo nei i ka papa inoa IP ma o ka maikaʻi hoomaopopo koke nā ʻōnaehana me nā awa hāmama a heaha keia mau awa? Hōʻike ka kiʻi ma lalo nei i ka neʻe ʻana o nā awa hāmama e ka ʻāina a me ka hui. Hiki ke ʻike i nā poloka o nā ʻōnaehana i hoʻohālikelike ʻia, akā i loko hāpana liʻiliʻi ʻAʻohe mea kupaianaha i ʻike ʻia, koe wale nō ka helu nui 500 mau awa hamama ma Kina.
ʻO kahi ʻike hoihoi ʻo ka nui o nā ʻōnaehana ma Brazil i loaʻa ʻaʻole wehe 22, 23 ai ole ia, nā awa ʻē aʻe, e like me ka Censys a me Shodan. ʻIke ʻia he mau pilina kēia mai nā kamepiula mea hoʻohana hope.
Bots? ʻAʻole pono
ʻikepili no na awa 22 a me 23 ua hoike mai lakou i kekahi mea e ia la. Ua manaʻo wau ʻo ka hapa nui o nā scans a me nā ʻōlelo huna mai nā bots. Hoʻolaha ka palapala ma nā awa hāmama, koho ʻana i nā ʻōlelo huna, a kope iā ia iho mai ka ʻōnaehana hou a hoʻomau i ka hoʻolaha ʻana me ke ʻano like.
Ma ʻaneʻi hiki iā ʻoe ke ʻike i kahi helu liʻiliʻi wale nō o nā pūʻali e nānā ana i ka telnet i wehe ʻia ke awa 23 i waho.
Nā pilina home
ʻO kekahi ʻike hoihoi ʻo ia ka nui o nā mea hoʻohana home ma ka laʻana. Ma ka hoʻohana ʻana huli huli Ua ʻike au i nā pilina 105 mai nā kamepiula home kikoʻī. No nā pili home he nui, hōʻike ka huli DNS hulina i ka inoa host me nā huaʻōlelo dsl, home, cable, fiber, a pēlā aku.
E aʻo a e ʻimi: E hoʻokiʻekiʻe i kāu Honeypot ponoʻī
Ua kākau wau i kahi aʻo pōkole pehea e . E like me ka mea i ʻōlelo ʻia, i kā mākou hihia ua hoʻohana mākou i Digital Ocean VPS ma Singapore. No nā hola 24 o ka nānā ʻana, he mau keneta maoli ke kumukūʻai, a ʻo ka manawa e hōʻuluʻulu ai i ka ʻōnaehana he 30 mau minuke.
Ma kahi o ka holo ʻana iā Cowrie ma ka pūnaewele a hopu i ka walaʻau āpau, hiki iā ʻoe ke pōmaikaʻi mai ka honeypot ma kāu pūnaewele kūloko. E hoʻonohonoho mau i kahi leka inā hoʻouna ʻia nā noi i kekahi mau awa. ʻO kēia ka mea hoʻouka kaua i loko o ka pūnaewele, a i ʻole he limahana hana, a i ʻole kahi scan vulnerability.
haʻina
Ma hope o ka nānā ʻana i nā hana a ka poʻe hoʻouka kaua ma kahi o XNUMX mau hola, ʻike ʻia ʻaʻole hiki ke ʻike i kahi kumu o ka hoʻouka ʻana i kekahi hui, ʻāina, a i ʻole ka ʻōnaehana hana.
Hōʻike ka puʻunaue ākea o nā kumu i ka paʻa mau ʻana o ka walaʻau scan a ʻaʻole pili i kahi kumu kikoʻī. ʻO ka mea hana ma ka Pūnaewele pono e hōʻoia i kā lākou ʻōnaehana mau pae palekana. He hopena maʻamau a kūpono no SSH e neʻe ka lawelawe i kahi awa kiʻekiʻe kiʻekiʻe. ʻAʻole kēia e hoʻopau i ka pono no ka pale ʻana i ka ʻōlelo huna a me ka nānā ʻana, akā ma ka liʻiliʻi e hōʻoia ʻaʻole i hoʻopaʻa ʻia nā lāʻau e ka nānā mau ʻana. ʻO nā pili awa kiʻekiʻe e ʻoi aku ka maikaʻi o ka hoʻouka ʻana, he mea hoihoi paha iā ʻoe.
I ka manawa pinepine, aia nā awa telnet i wehe ʻia ma nā mea hoʻokele a i ʻole nā mea hana ʻē aʻe, no laila ʻaʻole hiki ke neʻe maʻalahi i kahi awa kiʻekiʻe. и ʻo ia wale ke ala e hōʻoia ai ua paʻa ʻia kēia mau lawelawe. Inā hiki, ʻaʻole pono ʻoe e hoʻohana iā Telnet; ʻaʻole i hoʻopili ʻia kēia protocol. Inā makemake ʻoe a ʻaʻole hiki ke hana me ka ʻole, a laila e nānā pono iā ia a hoʻohana i nā ʻōlelo huna ikaika.
Source: www.habr.com