Tag
Cowrie
all chapters
- Chapter 1 Someone brought their malware to my house I keep a honeypot in some corner of the network. Most of it is noise: scanners that look and leave. Until one got in, decided it was the administrator, and pushed its critter up through the service door.
- Chapter 3 The botnet that left its code out in the open Another one walks in and drops its critter. But this one left a door open on its own delivery server — and inside was the source code. A multi-architecture Mirai, caught red-handed.
- Chapter 5 The intruder who brought his own key The previous critter kicked the door in with wget. This one walked in with an SSH key in its pocket, cleared the house of rival miners, and settled in with a professional's manners. It's RedTail, and it plays in a different league.
- Chapter 11 The bot that bragged — and couldn't be bothered A 1,177-byte loader landed: nine lines of wget, one per architecture, in the style I have already opened three times on this blog. I was going to file it as a repeat offender and get on with my day. I opened it anyway, out of habit — and the first thing I saw was that it had a few characters too many.