djkurlander

5 ms·

1.
by djkurlander 4d ago
Yes. And in retirement, I still code because I like the process of creating (hopefully cool) things. Even without remuneration. Ideally things that other people will use and benefit from in some way.
2.
by djkurlander 1mo ago
Nothing wrong with contacting the customer, and taking down the IP briefly until the customer can deal with their malware hosting toaster. However, I can see the argument for giving the customer 24-48 hours to resolve the problem.
3.
by djkurlander 1mo ago
Yeah, that’s pretty interesting! You can also see a live view of the ASN/ISP leaderboard by going to https://knock-knock.net and choosing ISP from the carousel. That’s ordered by bot transaction count rather than IP count t
4.
by djkurlander 1mo ago
It's on github with an MIT license: https://github.com/djkurlander/knock-knock . Have fun!
5.
by djkurlander 1mo ago
I run an open source honeypot that collects these botnet scans and produces blocklists. Blocklist download and configuration: https://knock-knock.net/blocklist Honeypot dashboard, where you can see attempted attacks in real
6.
by djkurlander 1mo ago
Crafted that awesome response to your original query myself, and I am very human.
7.
by djkurlander 1mo ago
Good question. You can certainly proxy SIP. But what’s notable here is that the traffic comes directly from organizations that should be secure: banks, infrastructure, governments. For a proxy to explain it, the proxy exit node would have t
8.
by djkurlander 1mo ago
Much appreciated! Trying to help out the community with the honeypot & API, and it's always fascinating what attack patterns show up.
9.
by djkurlander 1mo ago
As mentioned above, wrote the blog post myself and had AI proofread and edit. As for the honeypot itself, I'm a greybeard computer scientist, and I architected the system very deliberately myself, using AI as a coding accelerator. Earl
10.
by djkurlander 1mo ago
Wrote the blog post myself, and used AI to clear up typos and occasionally improve wording. I have a PhD in computer science, but I was initially planning to pursue journalism instead, so I like to think that I can write good :-).
11.
by djkurlander 1mo ago
Ha! Love it. Totally believe in it too.
12.
by djkurlander 1mo ago
I set up servers on the net that masquerade as a SIP relay by essentially supporting the protocol but with few authentication protections. Malware bots scan the IPv4 space looking for such machines that they can use as a relay. My honeypot
13.
by djkurlander 1mo ago
The actual blog post clarifies this as well. But still in some sense these organizations share some level of responsibility if it is their machines, attacking from their ASN.
14.
by djkurlander 1mo ago
Yes - I would have expected better from these institutions as well, but there's always going to be someone who brings their rogue laptop onto the corporate net. The key is how fast the security catches it. They can use the api that I d
15.
by djkurlander 1mo ago
Thanks! Just trying to keep the world safe from marauding Teddy Bears.
16.
International Revenue Share Fraud (IRSF)(knock-knock.net)
58 points by djkurlander 1mo ago|21 comments
17.
by djkurlander 4mo ago
OP here. See the hidden world of bot attacks and scanner chatter. Listen to Internet Background Radiation on a virtual Geiger counter. Here we are capturing Internet chatter across 8 protocols: (SSH, Telnet, FTP, RDP, SMB, SIP, HTTP, and SM
18.
Seeing and Hearing Internet Background Radiation(knock-knock.net)
3 points by djkurlander 4mo ago|1 comments
19.
by djkurlander 5mo ago
The goal is to educate people (originally my kids) about one particular aspect of cybersecurity. I love it when people use the site for this purpose. Yep, with ~80 knocks coming in per second and two 3D globe visualizations, it does make a
20.
by djkurlander 5mo ago
OP here. Check out the new https://knock-knock.net . v1 got 40,000+ visits from HN alone, hoping you'll find v2 worth checking out too. Watch bots trying to break into my honeypots, gain access to my files, place expensive V
21.
Show HN: Knock-Knock v2 – Visualizing bot attacks in multi-protocol Technicolor(v2.knock-knock.net)
3 points by djkurlander 5mo ago|3 comments
22.
by djkurlander 7mo ago
Thanks. I'd like to better understand the origin of DO's bot activity, and look forward to your report!
23.
by djkurlander 7mo ago
It has been 24 hours since this post went up, so here are some fun stats. During this time, there were 13,024 knocks on the server from 368 unique IPs. That's ~35 knocks per bot. During this time, thanks to Hacker News, there were 23,5
24.
by djkurlander 7mo ago
Ah, that makes sense. I’ve been wondering why DigitalOcean has so much of the bot traffic.
25.
by djkurlander 7mo ago
Hadn’t considered it, but that’s a nice idea. All of the necessary info, with time stamps, is already recorded in a SQL database, so it wouldn’t be difficult to replay events.
26.
by djkurlander 7mo ago
Thanks for pointing that out. T-Pot is cool and a more general honeypot framework. Potentially I could have built knock-knock.net on top of T-Pot.
27.
by djkurlander 7mo ago
Fail2ban would cut down on the noise quite a bit. I’ve installed it on other servers and have recommended it to others. But then we wouldn’t have all of this beautiful bot traffic to visualize.
28.
by djkurlander 7mo ago
Though strong passwords or preferably ssh keys are important, there will always be servers with weak passwords. And DO doesn’t have to side with individual abuse reporters. If they cared, they could spend a fraction of an hour setting up th
29.
by djkurlander 7mo ago
No, knock-knock.net is not hosted on DigitalOcean, and all 4 of my other knock-knock servers, using different providers, and distributed geographically currently have DigitalOcean as the worst offending provider.
30.
by djkurlander 7mo ago
My understanding is that they are a more general purpose data collection, and visualization framework. Potentially you could build something like this with that software, but they do not have knock-knock.net’s functionality built in.

More ›