🥇Trap (tarpit) rau cov khoom sib txuas SSH

Nws tsis pub leejtwg paub tias Internet yog ib puag ncig muaj kev ntxub ntxaug heev. Thaum koj tsa tus neeg rau zaub mov, nws tam sim ntawd raug kev tawm tsam loj thiab ntau yam tshuaj ntsuam. Piv txwv li honeypot los ntawm kev ruaj ntseg guards koj tuaj yeem kwv yees qhov ntsuas ntawm cov khib nyiab no. Qhov tseeb, ntawm qhov nruab nrab neeg rau zaub mov, 99% ntawm cov tsheb yuav ua phem.

Tarpit yog qhov chaw ntxiab uas siv los ua kom qeeb cov kev sib txuas. Yog tias qhov system thib peb txuas rau qhov chaw nres nkoj no, koj yuav tsis tuaj yeem kaw qhov kev sib txuas sai sai. Nws yuav tsum nkim nws cov peev txheej thiab tos kom txog thaum lub sijhawm sib txuas, lossis txiav nws tus kheej.

Feem ntau, tarpits yog siv los tiv thaiv. Cov txheej txheem tau tsim thawj zaug los tiv thaiv cov kab mob hauv computer. Thiab tam sim no nws tuaj yeem siv los rhuav tshem lub neej ntawm spammers thiab cov kws tshawb fawb uas koom nrog kev tshawb xyuas dav dav ntawm txhua tus IP chaw nyob hauv kab (piv txwv ntawm Habré: Austria, Ukraine).

Ib tug ntawm cov thawj tswj hwm lub npe hu ua Chris Wellons pom tau tias nkees ntawm saib qhov kev txaj muag no - thiab nws tau sau ib qho kev pab cuam me me. Tsis kawg, ib lub tarpit rau SSH uas ua rau cov kev sib txuas tuaj. Qhov kev zov me nyuam qhib qhov chaw nres nkoj (qhov chaw nres nkoj default rau kev sim yog 2222) thiab ua txuj ua tus neeg rau zaub mov SSH, tab sis qhov tseeb nws tsim kev sib txuas tsis kawg nrog cov neeg tuaj txog kom txog thaum nws tso tseg. Qhov no yuav txuas ntxiv rau ob peb hnub lossis ntau dua kom txog thaum tus neeg siv khoom poob.

Installation ntawm kev siv hluav taws xob:

$ make
$ ./endlessh &
$ ssh -p2222 localhost

Lub tarpit siv tau zoo yuav siv ntau qhov kev pab los ntawm tus neeg tawm tsam tshaj li ntawm koj. Tab sis nws tsis yog ib qho teeb meem ntawm cov peev txheej. Tus sau nws sau hais tiastias qhov kev zov me nyuam yog hom. Tam sim no nws muaj 27 tus neeg raug kaw, qee tus ntawm lawv tau txuas rau lub lis piam. Thaum lub ncov ntawm kev ua ub no, 1378 cov neeg siv khoom raug kaw rau 20 teev!

Hauv kev ua haujlwm hom, Endlessh server yuav tsum tau nruab rau ntawm qhov chaw nres nkoj ib txwm 22, qhov twg hooligans khob en masse. Cov lus pom zoo txog kev ruaj ntseg ib txwm qhia kom txav SSH mus rau lwm qhov chaw nres nkoj, uas tam sim ntawd txo qhov loj ntawm cov cav los ntawm qhov kev txiav txim ntawm qhov loj.

Chris Wellons hais tias nws txoj haujlwm siv ib kab lus ntawm qhov tshwj xeeb RFC 4253 mus rau SSH raws tu qauv. Tam sim ntawd tom qab kev sib txuas TCP tau tsim, tab sis ua ntej kev siv crypto txiaj, ob tog yuav tsum xa ib txoj hlua qhia. Thiab tseem muaj lus ceeb toom: "Tus neeg rau zaub mov tuaj yeem xa lwm kab ntawm cov ntaub ntawv ua ntej xa cov kab version"Cov. Thiab tsis txwv ntawm qhov ntim ntawm cov ntaub ntawv no, koj tsuas yog yuav tsum pib txhua kab nrog SSH-.

Qhov no yog raws nraim li qhov kev pab cuam Endlessh ua: nws xa kawg kwj ntawm randomly generated cov ntaub ntawv, uas ua raws li RFC 4253, uas yog, xa ua ntej authentication, thiab txhua kab pib nrog SSH- thiab tsis pub tshaj 255 tus cim, suav nrog cov kab ntawv xaus. Feem ntau, txhua yam yog raws li tus qauv.

Los ntawm lub neej ntawd, qhov kev zov me nyuam tos 10 vib nas this ntawm kev xa cov pob ntawv. Qhov no tiv thaiv tus neeg siv khoom los ntawm lub sijhawm, yog li tus neeg siv khoom yuav raug daig mus ib txhis.

Txij li thaum cov ntaub ntawv xa mus ua ntej cryptography yog siv, qhov kev pab cuam yog qhov yooj yim heev. Nws tsis tas yuav siv cov ntawv ciphers thiab txhawb ntau txoj cai.

Tus kws sau ntawv sim ua kom ntseeg tau tias cov khoom siv hluav taws xob siv tsawg kawg nkaus ntawm cov peev txheej thiab ua haujlwm tsis pom zoo ntawm lub tshuab. Tsis zoo li niaj hnub antiviruses thiab lwm yam "kev ruaj ntseg systems," nws yuav tsum tsis txhob ua rau koj lub computer qeeb. Nws tau tswj kom txo tau ob qho tib si kev khiav tsheb thiab kev siv lub cim xeeb vim kev siv software me ntsis ntxiv cunning. Yog tias nws tsuas yog tsim cov txheej txheem sib cais ntawm kev sib txuas tshiab, ces cov neeg tawm tsam tuaj yeem tsim DDoS nres los ntawm kev qhib ntau qhov kev sib txuas rau cov khoom siv hauv lub tshuab. Ib txoj xov ib qho kev sib txuas kuj tsis yog qhov kev xaiv zoo tshaj plaws, vim tias cov ntsiav yuav pov tseg cov peev txheej tswj cov xov.

Tias yog vim li cas Chris Wellons tau xaiv qhov kev xaiv hnyav tshaj plaws rau Endlessh: ib leeg-xov xov server poll(2), qhov twg cov neeg siv khoom hauv lub cuab yeej siv tsis muaj peev txheej ntxiv, tsis suav cov khoom siv hauv lub ntsiav thiab lwm 78 bytes rau kev taug qab hauv Endlessh. Txhawm rau zam kom tsis txhob faib tau txais thiab xa cov buffers rau txhua tus neeg siv khoom, Endlessh qhib lub qhov (socket) ncaj qha thiab txhais cov pob ntawv TCP ncaj qha, hla yuav luag tag nrho cov haujlwm ua haujlwm TCP / IP pawg. Qhov tsis tuaj yeem tsis xav tau txhua, vim peb tsis txaus siab rau cov ntaub ntawv tuaj.

Tus sau hais tias thaum lub sij hawm ntawm nws qhov kev pab cuam tsis paub hais txog lub hav zoov ntawm Python's asycio thiab lwm yam tarpits. Yog tias nws paub txog asycio, nws tuaj yeem siv nws cov txiaj ntsig hauv tsuas yog 18 kab hauv Python:

import asyncio
import random

async def handler(_reader, writer):
try:
while True:
await asyncio.sleep(10)
writer.write(b'%xrn' % random.randint(0, 2**32))
await writer.drain()
except ConnectionResetError:
pass

async def main():
server = await asyncio.start_server(handler, '0.0.0.0', 2222)
async with server:
await server.serve_forever()

asyncio.run(main())

Asyncio yog qhov zoo tagnrho rau kev sau tarpits. Piv txwv li, tus nuv no yuav khov Firefox, Chrome, lossis lwm tus neeg siv khoom uas sim txuas rau koj tus neeg rau zaub mov HTTP rau ntau teev:

import asyncio
import random

async def handler(_reader, writer):
writer.write(b'HTTP/1.1 200 OKrn')
try:
while True:
await asyncio.sleep(5)
header = random.randint(0, 2**32)
value = random.randint(0, 2**32)
writer.write(b'X-%x: %xrn' % (header, value))
await writer.drain()
except ConnectionResetError:
pass

async def main():
server = await asyncio.start_server(handler, '0.0.0.0', 8080)
async with server:
await server.serve_forever()

asyncio.run(main())

Tarpit yog ib qho cuab yeej zoo rau kev rau txim rau cov neeg thab plaub hauv online. Muaj tseeb, muaj qee qhov kev pheej hmoo, ntawm qhov tsis sib xws, ntawm kev kos lawv cov xim rau cov cwj pwm txawv ntawm ib tus neeg rau zaub mov tshwj xeeb. Ib tug tej zaum yuav xav txog kev ua pauj thiab lub hom phiaj DDoS nres ntawm koj tus IP. Txawm li cas los xij, txog tam sim no tsis muaj qhov xwm txheej zoo li no, thiab tarpits ua haujlwm zoo.

Hubs:
Python, Cov ntaub ntawv kev ruaj ntseg, Software, System tswj

Tags:
SSH, Endlessh, tarpit, tarpit, ntxiab, asycio
Trap (tarpit) rau kev sib txuas SSH tuaj

Ib tug ntawm cov thawj tswj hwm lub npe hu ua Chris Wellons pom tau tias nkees ntawm saib qhov kev txaj muag no - thiab nws tau sau ib qho kev pab cuam me me. Tsis kawg, ib lub tarpit rau SSH uas ua rau cov kev sib txuas tuaj. Qhov kev zov me nyuam qhib qhov chaw nres nkoj (qhov chaw nres nkoj default rau kev sim yog 2222) thiab ua txuj ua tus neeg rau zaub mov SSH, tab sis qhov tseeb nws tsim kev sib txuas tsis kawg nrog cov neeg tuaj txog kom txog thaum nws tso tseg. Qhov no yuav txuas ntxiv rau ob peb hnub lossis ntau dua kom txog thaum tus neeg siv khoom poob.

Installation ntawm kev siv hluav taws xob:

$ make
$ ./endlessh &
$ ssh -p2222 localhost

Txij li thaum cov ntaub ntawv xa mus ua ntej cryptography yog siv, qhov kev pab cuam yog qhov yooj yim heev. Nws tsis tas yuav siv cov ntawv ciphers thiab txhawb ntau txoj cai.

import asyncio
import random

async def handler(_reader, writer):
try:
while True:
await asyncio.sleep(10)
writer.write(b'%xrn' % random.randint(0, 2**32))
await writer.drain()
except ConnectionResetError:
pass

async def main():
server = await asyncio.start_server(handler, '0.0.0.0', 2222)
async with server:
await server.serve_forever()

asyncio.run(main())

Asyncio yog qhov zoo tagnrho rau kev sau tarpits. Piv txwv li, tus nuv no yuav khov Firefox, Chrome, lossis lwm tus neeg siv khoom uas sim txuas rau koj tus neeg rau zaub mov HTTP rau ntau teev:

import asyncio
import random

async def handler(_reader, writer):
writer.write(b'HTTP/1.1 200 OKrn')
try:
while True:
await asyncio.sleep(5)
header = random.randint(0, 2**32)
value = random.randint(0, 2**32)
writer.write(b'X-%x: %xrn' % (header, value))
await writer.drain()
except ConnectionResetError:
pass

async def main():
server = await asyncio.start_server(handler, '0.0.0.0', 8080)
async with server:
await server.serve_forever()

asyncio.run(main())

Tau qhov twg los: www.hab.com

Trap (tarpit) rau kev sib txuas SSH tuaj

Ntxiv ib saib Отменить ответ