Tag
Proxy
all chapters
- Chapter 18 Nothing to file An already-infected IP connected to the honeypot's telnet and pasted a recipe all at once: eleven binaries, one per architecture, each with a made-up name that will never come round again. Two weighed exactly the same and looked like variants - they turned out to be the i586 and i686 builds of the same program. And behind them wasn't a stray bug: fifty-odd distinct binaries in two weeks. The whole delivery is built so that no blocklist, by name or by signature, catches anything.
- Chapter 19 A Mirai that couldn't attack? I pulled down the three binaries from the previous chapter expecting the usual DDoS arsenal. It wasn't there: not one attack function. What it does instead (and above all, the channel its orders arrive on) is the strangest thing that has come through the honeypot. A bug designed, top to bottom, not to be seen.
- Chapter 20 Twelve alibis and a mailbox The previous chapter left a question the binary doesn't answer: of the thirteen STUN servers Cling beacons to, one has to be the operator's mailbox (because the bot announces its ports only to those thirteen, to nobody else) and yet all thirteen look like innocent VoIP providers. I didn't catch it issuing an order; I found it by elimination and exclusivity, using public records to see who talks to each one. Twelve have an alibi. The thirteenth doesn't.
- Chapter 29 It told me its name three times Another IoT ELF with the look of a run-of-the-mill Mirai landed in the decoy. I christened it “zbot” after its cron files, and it turned out that wasn’t even its name: by three separate routes (the paths it left on disk, the banners it speaks SSH and HTTP with, and the first bytes of every message to its C2) the thing kept telling me its real name. Behind it was something more interesting than a server-flooding bot: a machine for renting out its victim’s home line as a proxy. And an operator who, with the whole thing built, kept breaking his own download URLs. XLab had already named it “Shemzbot” in a tweet; this is the teardown that tweet didn’t carry.