Harvesting SSH Credentials: Insights from My Honeypot Network

I worked at a place that had a lot of baremetal machines on the open internet.

I would occasionally scan the auth.log to see which users the bots were using and it was an interesting mix of:

- service accounts e.g. mysql, admin, etc

- individual names e.g. tom, ankit, alexei etc

I'm not sure about less targetted bots, but I gave a friend an account on my media server without locking off shell access (which she had no need for), and it turns out that she used the same password as she used for every other service. Something got hold of those (that something must have run on her machine while she was on my network as it was not an externally connectable service) found the account with that user+pass and got in.

I noticed PDQ because of a sudden and fairly constant flow of upstream data that was unusual from that machine, and finding the account & processes involved was easy. As well as installing something to run SSH scans (presumably for further propagation) and running what looked like a crypto-miner, it seemed to be forwarding HTTP(S) requests in a manner that suggested the machine had become part of a “residential proxy” network or similar. Maybe if it hadn't been so greedy I wouldn't have noticed so soon (it hadn't been able to, or hand't tried to, cover its traces, so I found the time of installation very easily as the account otherwise had no SSH activity).

Luckily there were no open root escalation attacks at the time (at least that it knew about) so I only needed to pave that account to get rid of everything, but combined with one of the LPE attacks that have been around over the years it could have caused me much more of a headache.

- Steal application credentials if posix perms or database privs are weak, attempt privilege escalation, install rootkit RATs Remote Access Trojans for persistence and hiding processes.

- Install Proxies, DDoS Agents, Bitcoin mining, proxy to SMTP servers, etc...

- If anything looks interesting on their console they will log in and poke around. The order of these events depends on the sophistication of the bot script. Most are very simple.

If you the target look like you have money they may install ransomware and encrypt some of your files. Now I want to watch the Beekeeper again as corny as it was, also a fun movie.

The most common things I observe:-

- Installing a cryptominer or persistence tool

- Sending spam (smtp)

- Using pre-obtained credentials to log into various ecommerce/social media sites

This was submitted 2 weeks ago https://news.ycombinator.com/item?id=48947548

Seems more entertaining than suitable for real analysis. At least I did not see any collected data. You can just watch what happens at this moment.

From watching it a while I came to the conclusion that adding a new authorized ssh key is a common first step.

Anonymizing network proxy.

> Been using ipgeolocation.io to fetch the additional information about the GEO locations, ASN information, etc.

ipgeolocation.io API - should be in the article as well - cheers

There's no such thing as an account with or without login permissions. Normally you need a git account. And that means you can log in to it. And then you have to try and configure your ssh server so that after logging into the git account, you can only run the git server (I forget the command). If a mistake is made with this configuration then you can log in or port forward or X forward or file transfer as git.

This is a terrible idea because it's blacklist-based security. Places like GitHub have their own ssh server that only runs the git server and nothing else.

    [1] - sftp ai@nochan.net

toor was a default password for many devices for decades.

Did you check out the statistics on the site? They listed 1233456, 12345, 1234,123 and 1 on the toplist of password.

If we are going to be clever we should follow the statistics and go for 12 that where not on the toplist!!

You are right.

12 - Rank 318

21 - Rank 523

I'm surprised that '12' is so low on the list.