pseudo honeypot ip blocker. you could auto drop traffic from people sniffin where/when they should not be
this post was submitted on 24 Aug 2024
16 points (100.0% liked)
Programming
423 readers
12 users here now
Welcome to the main community in programming.dev! Feel free to post anything relating to programming here!
Cross posting is strongly encouraged in the instance. If you feel your post or another person's post makes sense in another community cross post into it.
Hope you enjoy the instance!
Rules
Rules
- Follow the programming.dev instance rules
- Keep content related to programming in some way
- If you're posting long videos try to add in some form of tldr for those who don't want to watch videos
Wormhole
Follow the wormhole through a path of communities !webdev@programming.dev
founded 1 year ago
MODERATORS
Would it even need to pretend it is open? If it can fake a port being open then it can tell when a close port is being pinged. So can outright block connections from those IPs without ever pretending it is open?
sure, if you want to be that black and white about it.. but with this you maybe could glean more information about the attempt and have more granular logic.
What extra information could you gather? Note I assume we are talking about a fake open port here, not an active service listening on a port that can communicate with the attacker. That could be done without eBPF though - so what advantage would eBPF have here?
And I assume this is more on the level of responding to pings than creating full connections? At which point you are only dealing with a single packet from the sender. So what value does responding give you here?
port knocking maybe?
Port knocking does not require open ports though? It works by trying to connect to closed ports in a specific sequence does it not?
or maybe fake ports?
What is a fake port?
Presumably, OP doesn't know the concept of a honeypot, so: https://en.wikipedia.org/wiki/Honeypot_(computing)
Basically, it's a decoy system, which an attacker will likely target.
You can't pretend an open port is closed, because an open port is really just a service that's listening. You can't pretend-close it and still have that service work. The only thing you can do is firewalling off the entire service, but presumably, any competent distro will firewall off all services by default and any service listening publicly is doing so for a good reason.
I guess it comes down to whether they feel like it's worth obfuscating port scan data. If you deploy that across all of your network then you make things just a little bit more annoying for attackers. It's a tiny bit of obfuscation that doesn't really matter, but I guess plenty of security teams need every win they can get, as management is always demanding that you do more even after you've done everything that's actually useful.
You can’t pretend-close it and still have that service work.
indeed, a service on a port would no longer properly work. However, pretending that an open port is closed is possible the same way when pretending that's open
Maybe a port that is actually open doesn't look as interesting
how so?
From an attacker perspective you would do a quick scan to find open ports, then focus on those ports with more expensive/slower scans to find out what is running on those ports. If everything reports open then what ports do you focus on first? So not so much that actually open ports are less interesting, but that actually open ports are harder to find among all the ports.
Do you youself understand what you're talking about?
then focus on those ports with more expensive/slower scans to find out what is running on those ports.
What do you mean by "focus on those ports"? What are "more expensive/slower scans"?
If everything reports open
not every port gets reported to be open but only some of them
what ports do you focus on first?
me? or an attacker? he could work with any ports he wishes
Do you youself understand what you’re talking about?
I am by no means an expert in this area. But I have some understanding of how things work.
What do you mean by “focus on those ports”? What are “more expensive/slower scans”?
There are many different levels of scans you can do on ports - the first and simplest is just trying to connect to see if the port is open. But that only tells you if the port is open. You then need to try and figure out what service is running on the port which is done by trying to communicating with it and seeing what it replys with. E.g. sending a http request to see if a http server is listing, or trying to start a tls connection for https). Once you know what service is running you can make additional queries to try and figureout what version it is running which can tell you what vulnerabilities it is exposed to. Each of these might need a different connection, and you might need to cycle through many different queries to get a response from the server - all of that is far more expensive than just checking to see if the port is open.
So you generally want to preform a quick scan of open ports, then follow up on a deeper scan of those ports to gather more information about what is running on the port. Nmap, the tool generally used for this, has these different modes you can tell it to scan in and is able to do simple TCP connection scans, or more detail scans for detecting the service an OS (and their versions) as well.
not every port gets reported to be open but only some of them
That was a hypothetical, not having read whatever article you are talking about. But I would assume that a eBPF tool that fakes open ports would do so to pretend a large number of ports are open at least. Though that is just speculation on my part.
me? or an attacker? he could work with any ports he wishes
That is from an attackers perspective.
Ok, back to this then:
If everything reports open then what ports do you focus on first?
I don't see an issue here. An attacker would be overwhemed with choise and excitement so that he wouldn't be able to decide which port to choose first, get stuck for a several months unable to decide? He'd toss a coin then.
Its costs him time - which is the point. They would have to do more detailed checks on every port which costs them time. Attackers are typically scanning loads of ports over large ranges of IPs, any small slow down on each can drastically slow down their overall progress making the attack less feasible and more expensive to undertake.
but an attacker isn't obliged to take on all the open ports, he could work with some of them - the ones that may seem the most interesting to him
Yes, which limits the amount of ports they can search and thus can be used to hide things on less popular ports. It is not going to stop an attacker. Just makes their job a bit harder or less complete.