{"id":263,"date":"2013-01-28T05:00:47","date_gmt":"2013-01-28T05:00:47","guid":{"rendered":"http:\/\/www.randomnoun.com\/wp\/?p=263"},"modified":"2023-12-18T19:25:24","modified_gmt":"2023-12-18T19:25:24","slug":"intruder-alert","status":"publish","type":"post","link":"https:\/\/www.randomnoun.com\/wp\/2013\/01\/28\/intruder-alert\/","title":{"rendered":"Intruder alert"},"content":{"rendered":"
\"Danger<\/a>
Danger Will Robinson!<\/a><\/figcaption><\/figure>\n

So I’ve been running a Secure shell honeypot<\/b> for about a year or so, so might as well open up the log files and see what people have been l33ting<\/a> these days.<\/p>\n

For the uninitiated, or for normal people, Secure shell (or SSH)<\/a> is the traditional method that people log in remotely to Linux (or other unix-based) servers. <\/p>\n

A honeypot<\/a> pretends<\/b> to be a standard login server, but instead of logging into a real server, it allows would-be hackers to fairly easily guess their way into a sandbox environment, where they can be prodded and observed to see what they get up to. <\/p>\n

The honeypot reacts like a normal server would, logging any input that it receives, and pretends to do the sorts of things that people normally try to do when they gain unauthorised access to a computer system (i.e. the electronic equivalent of putting graffiti in the toilet stalls<\/a> and having their way with the photocopier<\/a>).<\/p>\n

And now, what with Julia Gillard declaring a new War on Technology<\/a> and throwing money at a new “cyber security centre”<\/a> (which will certainly<\/b> be money well spent), it should be every citizen’s prerogative<\/b> to try to see what the evil commies<\/b> are getting up to on their computer networks.<\/p>\n

So after pretty much a full day<\/b> of number-crunching and regexing the 2012 logfiles, and a second full day of fiddling about with databases and wordpress, this is what I’ve got:<\/p>\n

Executive Summary<\/h2>\n