好的，我现在需要帮用户总结一篇文章的内容，控制在100字以内。用户的要求是直接写描述，不需要开头语。 首先，我得通读文章，理解主要内容。文章讲的是蜜罐技术，特别是中等交互的蜜罐是否容易被攻击者识别。作者提到攻击者可以通过模拟系统中的漏洞，比如SSH和telnet服务器的不完全仿真，安装假包或使用特定用户名密码来检测蜜罐。 接着，作者举了一个例子，攻击者用了不可能有效的凭证成功登录，从而判断连接到了蜜罐。最后提到他们不会特别阻止这类检测，因为蜜罐通常连接动态IP的家用网络，攻击者的IP列表容易过时，并且主要关注互联网范围内的扫描而非定向攻击。 现在我需要将这些要点浓缩到100字以内。重点包括：中等交互蜜罐易被识别、攻击者使用特定方法检测、攻击者成功登录后发现蜜罐、作者不打算隐藏蜜罐的原因。 组织语言时要简洁明了，确保涵盖所有关键点。可能的结构是：说明问题、攻击者的方法、例子、作者的态度和原因。 检查字数是否符合要求，并确保表达清晰准确。 </think> 文章讨论了中等交互型蜜罐易被攻击者识别的问题。攻击者通过检测模拟系统漏洞或使用特定用户名密码组合来判断是否连接到蜜罐。例如，攻击者使用无效凭证成功登录后意识到目标为蜜罐。作者认为无需隐藏蜜罐，因其通常连接动态IP网络且主要用于监测互联网范围扫描而非定向攻击。 2026-4-8 14:23:28 Author: isc.sans.edu(查看原文) 阅读量:12 收藏
One question that often comes up when I talk about honeypots: Are attackers able to figure out if they are connected to a honeypot? The answer is pretty simple: Yes!
Most "medium interaction" honeypots, like the one we are using, are just simulating various systems. These simulations are incomplete. For example, we are using the "Cowrie" honeypot to emulate SSH and telnet servers. Once an attacker is connected, any package they are installing will appear to install. In the past, I have written about attackers attempting to install bogus packages. If the install appears to succeed, the attacker knows they are connected to a honeypot. Some attackers look for SSH artifacts, such as the number and types of ciphers supported by SSH.
Today, I noticed one attacker, (IP address 45.135.194.48), using another common trick: Cowrie will often allow attackers to connect "randomly". The effect is that various username and password combinations appear to work. In this case, the attacker used usernames and passwords that are highly unlikely to work. If they succeed, they know they are connected to a honeypot. Here are some of the usernames and passwords used:
| username | password |
|---|---|
| admin | definitely_not_valid_creds |
| honeypot | indexer |
| honeypotter | imaginegettingindexed |
| xXhoneypotXx | P@ssw0rd1337! |
| youjustgotindexed | getindexedretard |
Will we do anything to block these types of requests? Maybe... I am not sure it is important enough to "hide" honeypots. One advantage we have is that many of our honeypots are connected to home networks with dynamic IPs. As a result, any IP address list an attacker will create is somewhat ephemeral. Secondly, we are mostly interested in internet-wide scans. We are not going to detect targeted attacks or zero days.
--
Johannes B. Ullrich, Ph.D. , Dean of Research, SANS.edu
Twitter|
如有侵权请联系:admin#unsafe.sh