Nhamba dzemaawa makumi maviri nemana mushure mekuisa poto yehuchi pane Digital Ocean node muSingapore

Pew Pew! Ngatitangei ipapo nemepu yekurwisa

Mepu yedu yepamusoro inotonhorera inoratidza akasiyana maASN akabatana neCowrie honeypot yedu mukati memaawa makumi maviri nemana. Yero inoenderana neSSH yekubatanidza, uye tsvuku inoenderana neTelnet. Mapikicha akadai anowanzo kufadza boka revatungamiriri vekambani, izvo zvinogona kubatsira kuchengetedza mari yakawanda yekuchengetedza uye zviwanikwa. Nekudaro, iyo mepu ine kukosha kwayo, ichiratidza zvakajeka kupararira kwenzvimbo uye kwesangano kwenzvimbo dzekurwiswa kweanotigamuchira mumaawa makumi maviri nemana chete. Iyo animation hairatidze huwandu hwetraffic kubva kune yega yega.

Chii chinonzi Pew Pew mepu?

Pew Pew Mepu - ichi chi kuona kwe cyber kurwiswa, kazhinji inorarama uye yakanaka kwazvo. Inzira yakanakisa yekutengesa chigadzirwa chako, chinoshandiswa zvisina mbiri neNorse Corp. Iyo kambani yakapera zvakashata: zvakazoitika kuti mifananidzo yakanaka yaive mukana wavo chete, uye vakashandisa zvidimbu zvidimbu zvekuongorora.

Yakagadzirwa neLeafletjs

Kune avo vanoda kugadzira mepu yekurwisa yeiyo hombe skrini munzvimbo yekushanda (mukuru wako anoifarira), kune raibhurari. leafletjs. Tinozvibatanidza ne plugin Leaflet migration layer, Maxmind GeoIP sevhisi - uye waita.

WTF: chii ichi Cowrie honeypot?

Honeypot isystem inoiswa panetiweki zvakananga kukwezva vanorwisa. Kubatanidza kune sisitimu kunowanzo kusiri pamutemo uye kunobvumidza iwe kuti uone anorwisa uchishandisa akadzama matanda. Marogi anochengetedza kwete chete ruzivo rwekubatanidza rwenguva dzose, asiwo ruzivo rweseshini inoratidza matekiniki, matekiniki uye maitiro (TTP) mupandiri.

Honeypot Cowrie rakagadzirirwa SSH uye Telnet yekubatanidza marekodhi. Huchi dzakadaro dzinowanzoiswa paInternet kuti dzitevere zvishandiso, zvinyorwa uye mauto evanorwisa.

Mharidzo yangu kumakambani anofunga kuti haazorwiswi: "Uri kutarisa zvakaoma."
—James Snook

Chii chiri mumatanda?

Nhamba yese yezvibatanidza

Pakadzokororwa kuedza kubatanidza kubva kune vakawanda vanogamuchira. Izvi zvakajairika, sezvo zvinyorwa zvekurwisa zvine runyorwa ruzere rwezvitupa uye edza misanganiswa yakati wandei. Iyo Cowrie Honeypot inogadziriswa kuti igamuchire imwe zita rekushandisa uye password musanganiswa. Izvi zvakagadzirirwa mukati user.db file.

Geography yekurwisa

Ndichishandisa data yeMaxmind geolocation, ndakaverenga nhamba yekubatanidza kubva kunyika imwe neimwe. Brazil neChina dzinotungamira nemuganho wakafara, uye kazhinji kunowanzoita ruzha kubva kuma scanner anobva kunyika idzi.

Network block muridzi

Kutsvaga varidzi vemanetiweki blocks (ASN) vanogona kuona masangano ane huwandu hukuru hwekurwisa mauto. Ehe, mumamiriro ezvinhu akadaro iwe unofanirwa kugara uchiyeuka kuti kurwiswa kwakawanda kunobva kune vane hutachiona. Zvine musoro kufunga kuti vazhinji vanorwisa havasi kupusa zvakakwana kuti vatarise Network kubva pakombuta yekumba.

Vhura zviteshi pakurwisa masisitimu (data kubva kuShodan.io)

Kumhanyisa iyo IP runyorwa kuburikidza neyakanakisa Shodan API nokukurumidza anozivisa masisitimu ane madoko akavhurika uye zvii zviteshi izvi? Nhamba iri pazasi inoratidza kuwanda kwezviteshi zvakavhurika nenyika uye sangano. Zvingave zvichigoneka kuona mabhuroki eakakanganiswa masisitimu, asi mukati sampuli duku hapana chakatanhamara chinoonekwa, kunze kwenhamba huru 500 yakavhurika zviteshi muChina.

Chinhu chinonakidza chinowanikwa huwandu hukuru hwemasisitimu muBrazil ane kwete kuvhura 22, 23 kana zvimwe zviteshi, maererano naCensys naShodan. Zviripachena izvi zvinongedzo kubva kumakomputa ekupedzisira evashandisi.

Bots? Hazvina basa

dhata Censys kune zviteshi 22 ne23 vakaratidza chimwe chinhu chinoshamisa zuva iroro. Ndakafunga kuti ma scans akawanda uye password kurwisa kunobva ku bots. Iyo script inopararira pamusoro pezviteshi zvakavhurika, kufungidzira mapassword, uye inozvikopa pachayo kubva kuhurongwa hutsva uye inoramba ichipararira uchishandisa nzira imwechete.

Asi pano unogona kuona kuti nhamba diki chete yevatenzi vanoongorora telnet vane port 23 yakavhurika kunze.Izvi zvinoreva kuti masisitimu ari kukanganiswa neimwe nzira, kana vanorwisa vari kushandisa zvinyorwa nemaoko.

Zvisungo zvekumba

Chimwe chinonakidza chakawanikwa yaive nhamba huru yevashandisi vepamba mumuenzaniso. Nokushandisa reverse lookup Ndakaona 105 yekubatanidza kubva kumakomputa epamba chaiwo. Kune akawanda ekubatanidza epamba, reverse DNS lookup inoratidza zita remugamuchiri aine mazwi dsl, imba, tambo, fiber, zvichingodaro.

Dzidza uye Ongorora: Simudza Wako Wega Huchi

Nguva pfupi yadarika ndakanyora dzidziso pfupi yekuti ungaite sei isa Cowrie honeypot pane yako system. Sezvatotaurwa, kwatiri isu takashandisa Digital Ocean VPS muSingapore. Kwemaawa makumi maviri nemana ekuongorora, mutengo waive chaiwo masendi mashoma, uye nguva yekuunganidza sisitimu yaive maminetsi makumi matatu.

Panzvimbo pekumhanyisa Cowrie pawebhusaiti uye kubata ruzha rwese, unogona kubatsirwa kubva kuhuchi pane network yako yemuno. Gara uchiseta chiziviso kana zvikumbiro zvichitumirwa kune mamwe madoko. Uyu angave anorwisa mukati metiweki, kana mushandi anoda kuziva, kana scannerability.

zvakawanikwa

Mushure mekuona zviito zvevanorwisa kwemaawa makumi maviri nemana, zvinova pachena kuti hazvibviri kuziva nzvimbo yakajeka yekurwiswa mune chero sangano, nyika, kana kunyange hurongwa hwekushanda.

Kugovaniswa kwakakura kwemasource kunoratidza kuti ruzha rwe scan rinogara riripo uye harina hukama nekwakananga kwakabva. Chero ani anoshanda paInternet anofanira kuona kuti system yavo mazinga akawanda ekuchengetedza. Mhinduro yakajairika uye inoshanda ye SSH iyo sevhisi ichaenda kune isina kujairika yakakwirira port. Izvi hazvibvisi kudiwa kwekuchengetedzwa kwakasimba kwepassword uye kutarisa, asi zvirinani zvinova nechokwadi chekuti matanda haana kuvharwa nekugara achiongorora. High port connections inowanzove yakanangwa kurwiswa, izvo zvingave zvekufarira kwauri.

Kazhinji yakavhurika telnet ports iri pamarouter kana zvimwe zvishandiso, saka haigone kutamiswa nyore kuenda kuchiteshi chepamusoro. Ruzivo nezve ese akavhurika ports и attack surface ndiyo chete nzira yekuona kuti masevhisi aya akadzimwa moto kana kuremara. Kana zvichibvira, haufanirwe kushandisa Telnet zvachose; iyi protocol haina kuvharirwa. Kana iwe uchichida uye usingakwanise kuita pasina icho, saka nyatso tarisisa uye shandisa mapassword akasimba.

Source: www.habr.com