Language Engineered Attacks

This week has been fairly quiet on the project because the end of term is fast approaching at university so I've been working on other modules. However, there have been some developments on the project.

There has been an interesting "trickle" brute-force attack happening over the past few days. To date, the attacking IP address has made 4,128 brute-force attempts using password variations such as:

• P@$$w0rd123456789
• P@$$w0rd$123456789
• P@$$W0RD0
• p@sswOrd123456789
• p@sswd123456

These attacks seem to be using some sort of language engineering based brute-force attack to create various misspellings on common password attempts such as, in the above example, the word "password".

As previously mentioned: these language engineering based brute-force attacks have been slowly trickling in over the past few days which can be seen below:

Duplicate Attacks

Another interesting observation arose this week when I duplicated the current honeypot (by simply taking an image of the system) and created a new virtual server. I'll be running the duplicate honeypot alongside the existing one to see how the attacks compare. The two honeypots have different IP addresses and are named alpha and charlie in the data below:

What the data above shows us is that the attacking IP address is using the exact same brute-force attack (i.e. the same usernames and passwords) and appears to be blindly attacking ranges of IP addresses which have port 22 open and accepting SSH connections.

Lack of Shell Attacks

In last week's post I analysed some recent attacks on the honeypot's shell CLI emulator. Unfortunately this week has seen zero attacks on the shell. I need to look into the shell emulator and check it's working on various SSH clients such as PuTTY.

New bits

Finally, I've added some new bits to this website: there's now a password tag cloud shown on every page of the website. This data being provided to this feature is live, so the tag cloud will update regularly as new passwords are attempted on the honeypot.

There's also a new section on this site called publications where I've added the project proposal and interim report for this project; both of which were handed in to university.

Image credit: generated with Wordle.net using data gathered from honeypot during initial testing phase.

Comments

There are no comments for this blog post yet

Add Comment