TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

Cowrie: a medium-interaction SSH and Telnet honeypot

127 pointsby Fazel94over 5 years ago

7 comments

mergyover 5 years ago
Caution for folks: I ran this for a few weeks and it was very informative. You see how simple many attacks really are, how many corporate assets are comprimised, and where most of the source attacking countries are.<p>But, there is a downside.<p>The downside is any site you put it on will be flagged and attacked 100x more since it registers as a vulnerable destination. After turning it off, the deluge of attacks for the site continues and I ended-up rigging a fail2ban setup to just deny if a destination port is hit. (See &gt;&gt; <a href="https:&#x2F;&#x2F;mergy.org&#x2F;2019&#x2F;08&#x2F;setting-up-a-killswitch-for-attacks-with-ufw-and-fail2ban-on-ubuntu-linux&#x2F;" rel="nofollow">https:&#x2F;&#x2F;mergy.org&#x2F;2019&#x2F;08&#x2F;setting-up-a-killswitch-for-attack...</a>)<p>But, it is fun and interesting to see. Highly recommend but know the legacy on that as well.
评论 #20796687 未加载
评论 #20796685 未加载
评论 #20800290 未加载
segfaultbuserrover 5 years ago
&gt; <i>records the interactions of hackers</i><p>Before you get too excited, I would say that a common mistake of inexperienced sysadmins is assuming all those brute-force attempts in the logs are results of those &quot;hackers&quot; and &quot;crackers&quot;, it&#x27;s not, not even a scriptkid.<p>All you can get by running a honeypot, like this one, is pretty boring activities by soulless, ancient worms and viruses, or automatic global Internet scanners running 24x7, not humans. Most of those are not even worth your time to block (e.g. if you only use strong password or pubkey, there are few reasons to fail2ban).<p>It&#x27;s nothing personal. Any machine will be port scanned, vuln probed, brute forced, blindly hit with ancient &quot;1 shot&quot; exploits (e.g. ?file=..&#x2F;..&#x2F;..&#x2F;etc&#x2F;passwd ). This is how the Internet works.<p>Another lesson is: <i>never</i> run any unsecured webserver&#x2F;service on the public Internet, <i>never ever</i>, not even for debugging, period. Don&#x27;t listen 0.0.0.0:80 if you have just installed your PHP management system, don&#x27;t reset your forgotten MySQL password by disabling privilege checking before turning off networking first, if you just installed a new VPS with root password 123456 in a morning, don&#x27;t wait until afternoon, change it immediately, etc.<p>The reason is exact the opposite, not because of &quot;hackers&quot; but those stupid worms. Ordinary life is boring: if you run a webserver with password 123456 (e.g. for debugging an issue on a disposable server - just for 20 minutes, you think, then you forgot it), you won&#x27;t (or unlikely) to see someone hacking into your system, but it&#x27;s a certainty that one of those stupid worms&#x2F;viruses would infect your machine within hours, sometimes it&#x27;s as quick as having your lunch. And it probably won&#x27;t do much damage, but you would spend your time to reinstall the system again...
评论 #20794958 未加载
评论 #20795569 未加载
评论 #20794661 未加载
评论 #20795520 未加载
评论 #20795705 未加载
评论 #20795358 未加载
评论 #20794826 未加载
HocusLocusover 5 years ago
I opened up port 23 telnet and had it connect immediately to a playable Crowther &amp; Woods&#x27; original adventure,<p>YOU ARE STANDING AT THE END OF A ROAD BEFORE A SMALL BRICK BUILDING. AROUND YOU IS A FOREST. A SMALL STREAM FLOWS OUT OF THE BUILDING AND DOWN A GULLY.<p>In a year and a half I had logged over a million probes. No humans at all. I would have known because they would have typed something to do with the game or tried to play it. So I must conclude no one is checking the logs of the worms either.
评论 #20795361 未加载
评论 #20795673 未加载
评论 #20795339 未加载
IanGabesover 5 years ago
My team and i run some different honeypot solutions, and we base a lot of them off of cowrie. As pointed out by previous comments, most interactions are not so interesting, except for the fact that many cowrie based honeypots imitating IoT devices have their attackers running a simple script that pulls down a number of second stage binaries, for a variety of cpu architectures.<p>One downside to running software like cowrie is that generally speaking crawlers like shodan will be able to figure out that you are running a honeypot, and will have you fingerprinted in a hurry.<p>A better strategy for increasing the cost of an attack is actually implementing something i read about on HN called a ssh tarpit, where one can &quot;hang&quot; an incoming ssh connection indefinitely. A lot of the attacks on honeypots are automated, so instead of having a 3 second attack, one can waste the attackers time for about 30s to 1m on average as these scripts have very generous timeouts (and sometimes no timeouts at all).
评论 #20796022 未加载
评论 #20795561 未加载
CliffStollover 5 years ago
Wish that this were available 33 years ago...
评论 #20795042 未加载
评论 #20795378 未加载
corditeover 5 years ago
any examples of replay logs on asciinema or even youtube?<p>Just curious about what these look like
评论 #20796665 未加载
iforgotpasswordover 5 years ago
I want to give this a try. Years ago I stumbled upon a similar project written in python which I don&#x27;t remember the name of, but something about its handshake must have been fishy as most clients disconnected again right away without trying to authenticate. (The initial version string sent by the server looked fine but I wasn&#x27;t motivated enough to dig any further.)
评论 #20794830 未加载
评论 #20794515 未加载