VMware

It took just 12 seconds – Catching hackers with a honey

It took just 12 seconds – Catching hackers with a honey pot!

#seconds #Catching #hackers #honey

“2GuysTek”

It took just 12 seconds for a computer I put directly on the Internet to get attacked. Within an hour, the system experienced nearly 17 thousand attacks, and within a 24-hour period, the system logged nearly 263 thousand different attacks. The Internet is a dangerous place, and without a…

source

 

To see the full content, share this page by clicking one of the buttons below

Related Articles

12 Comments

  1. Hi, I installed t-pot standard but I have several messages in the meerkat panel: (The field "ip_rep.keyword" associated with this object no longer exists in the data view. Please use another field.), that error is repeated in several of the kibana tools: "ElasticPot", "Cowrie", "Dioanea" "T-pot", "qHoneypots", "Fatt". Actually I have other messages in Suricata: "http.http_content_type.keyword", "ssh.client.software:version.keyword", "fileinfo:magic.keyword", etc.

    Can it be corrected?

  2. Video suggestion:

    Setting up pi-hole to support multiple vlans (the OS/device has IP’s on iot/guest/home/and such) and responds to the different queries.

    Another suggestion:
    Setup a speedtest monitoring solution that includes ping tracking for uptime and IP results ( say ping yahoo and show which IP responds ) and for the speedtest track local as well as cross country test server results.

  3. What is the audience you want to catch? If you want to try it, your main problem is not, how to install Debian. If you don't know how to install Debian, stay away from this type of tools. Most user will have a WiFi router with a firewall maintained by the ISP, so you should not catch any hack. In that environment installing the honey pot on Debian is mostly completely useless.
    For most users the threat is coming from emails, social media or from browsing. The last 10 years I had two hacks, one through the browser and one through the email of an old collegae (who had been hacked), who claimed to send me an email with a photo of the two of us 🙁 🙁 I'm lucky, I use OpenZFS, so I roll back the system to a time before the hack. Note that the OpenZFS snapshots are read only.
    I'm waiting impatiently on a true immutable system, like the one announced by Ubuntu for 24.04. I don't like systems with two instances, where only one of the two, the current instance is immutable. I prefer the rollback of OpenZFS, no hassle during normal operation 🙂

Leave a Reply