I SETUP A HONEYPOT AND GOT MORE THAN 3K SSH SESSIONS FROM HACKERS #threatanalysis #raspberrypi

From June 28, 2020, to August 3, 2020, I recorded more than ssh 3K sessions from all over the world.

To accomplish this, all I had to do was to expose a raspberry pi through my router’s DMZ running cowrie, “a medium to high interaction SSH designed to log brute force attacks and the shell interaction performed by the attacker”.

Sessions contained all kinds of ssh interactions: trojans, rootkits, and even friendly hello messages.

I also stored more than 1 week of network traffic, our little raspberry PI interacted with more than 8000 IP addresses.

My mission in this paper is to analyze thread data, including network data, session logs, and how honeypots can be leveraged to understand threads. I will also propose some mitigation strategies that could be implemented at the ssh server and OS levels.

#cowrie #tcpdump #malware #linux #programminglife #struggleisreal #codingmemes #marycondo #rustlang #learncoding #computerscience #computersciencemajor #computersciencestudent #cleancoding #cleanprogramming #ipsec #opsec 🤣

[djsnackcakes]

This looks like a fun way to get malware samples that exist in the wild

[vizionthing]

The music bad
The content good
dump the music, the content is more than enough

[Mrthfret]

Amazing presentation! Hands-on, real world examples of threats with explanations that were clear and concise with recommendations threat reduction practices. I'd hire you on the spot as Security Officer. Great stuff!

[jackmclane]

I could still percieve pieces of speech over the music when concentrating. You should increase the music volume some more...^^

[kaptn_kage]

remember, only YOU can provide yourself security

[EmptyCOS]

4:23 I know exactly what that URL is. They are used to infect devices for DDoS botnets. Greenhat hackers, skiddies, etc. use a tool called 'zmap' to scan the world for IPs with a port open, like 22 for ssh or 23 for telnet, they use a file called 'update' to brute force all of them, and they use 'loaders' to try to connect to these servers and execute a 'payload' on the server. That payload infects a device and they can DDoS with it. Most people who do that don't know anything about what they're doing, they're skids.

[riversiderocks]

Could you do a video where you set this up? Thanks!

[mateolopez]

Nice content! I like it
Next time try lowering the volume of the music, it's a bit too high I think

[woolfy]

I remember getting a lot of attacks once I opened up a SFTP server on my pi.(Just need port 22 open on the router) Running 'Fail2ban' was always fun to see how many people were trying to attack it on a regular basis. Unfortunately I could never get any of the honeypot software setup on it.

[VorpalForceField]

neat vid .. u music is way WAY to loud

[Hamsters]

Thanks for sharing this. I'm rethinking my plan to set up my raspberry pi to be exposed to the Internet through my router.

[FedericoGranata]

just pointing out the '-c' grep option: "Suppress normal output; instead print a count of matching lines for each input file" so you don't need to pipe the output to wc -l

[Alexander-vogv]

Dude great video your content looks like something someone with subscribers would make. Your going to make it big one day. Keep the good work up!

[brandonstevens]

Great video! Super interesting how it can still be a business to brute force servers like this.

[ThomasWSmith-wmxn]

This is really interesting! Thanks for the upload.

[WilliamFritzM]

He promised and delivered. This was a great video!

[zainahmed]

dudes mouth speak clearer than the youtube audio

[sayvilletech]

I had a DSL modem that logged attempted hacks into my network; on average I had one attempt every 3 minutes. The IP addresses were from around the world. As a network admin I even seen corporate devices hacked as part of a botnet, usually unpatched Linux devices such as security camera recording devices.

[mattpgarcia]

Great video brother!
If only we could get ISP's and the government on board with securing Networks for the average end user and not just Enterprise organizations. Buuuut if they did that then they wouldn't be able to do the under-the-table MITM type surveillance that they're guilty of themselves. Not to mention the advertising dollars that the huge corporations make by watching our every move. All these greedy bastards want to have a hand in the candy jar.. And it's all about money and control.
:/

[arsacode]

What I find amazing is that you were able to do all of this with your elbows