Hiding Behind Multiple IPs

This week's blog post will be fairly brief as I've not had a lot of time to work on the project due to other commitments (mostly end of university term and run-up to Christmas).

Last week I set up a pure honeypot running under Ubuntu. I was hoping to discuss details of attacks that took place on the pure honeypot in this week's post - but I've not had a chance to run the honeypot for long this week.

I want to ensure I can be near my computer for pretty much a whole day so I can run the honeypot and monitor its logs. The only free day I had was yesterday and, frustratingly, there were zero attacks on the honeypot yesterday.

Also, attacks on the low-interaction C honeypot have dropped over the past few days. The table below shows the number of attacks on the honeypot over the past 10 days:

The table above shows that Sunday the 8th of December saw the busiest day yet for the low-interaction honeypot with 2,193 brute-force attempts, but that today and yesterday have only seen 7 and 6 brute-force attacks respectively.

Multiple IP Addresses; Same Attack

One noticeable attack this week came from 2 separate IP addresses but contained the exact same attack:

The data above shows that an attack came from 2 different IP addresses: 54.***.***.*** (Ireland) and 122.***.***.** (Australia). This could perhaps be the same attacker using two different IP addresses or two separate attacks using the same attack script. Due to the time of the attacks being so close together, it seems more probable that it's the same attacker hiding behind 2 different IP addresses.

Again, a similar attack coming in from multiple IP addresses is shown below:

The table above shows that the attacking IP addresses are 113.*.***.* (China), 190.***.***.** (Chile) and 46.***.***.** (Germany) and that, despite appearing to originate from different IP addresses, the attacks are the same. These brute-force attacks consisted of no more than the username "root" and the passwords "root", "password", "111111" and "123456".

This data strongly supports the theory that attackers are hiding behind the masks of multiple IP addresses. This also means that the number of unique IP addresses that attack the honeypot is not a good indicator to the the number of unique attackers that are attacking the honeypot.

Finally, this week I've also been working on my book review for Jon Erickson's Hacking: The Art of Exploitation. I'm about half way through writing the review, so aiming to publish the post next week.

Image credit: "Masks" by ohad*, flickr.com/photos/ohadby/26168831

About the author

Simon Bell is an award-winning Cyber Security Researcher, Software Engineer, and Web Security Specialist. Simon's research papers have been published internationally, and his findings have featured in Ars Technica, The Hacker News, PC World, among others. He founded Secure Honey, an open-source honeypot and threat intelligence project, in 2013. He has a PhD in Information Security and a BSc in Computer Science.

Follow Simon on Twitter: @SimonByte