Spoilerwall: Respond to port scanning requests with movie spoilers | Hacker News Reader

Spoilerwall: Respond to port scanning requests with movie spoilers

github.com

326 pointsllazzaro102 comments

You have to be very careful when running this on the telnet port.

I had a server set to spew a full color ANSI Nyancat at you when you telneted in. When the Mirai botnet was in full swing, I was pushing 5+ Mbps of Nyancat down to peoples infected webcams and killing my servers CPU.

I'm sorry, that's terrible, but this sounds hilarious

I laughed so hard. Sorry...

ok, I've stopped laughing now and and cleaned up the spilled drink. This is brilliant. You need to team up with a CDN and get them supply cats from the nearest available node.

"Unleash the Nyancat!" as they say...

Surely some enterprising hacker can optimize Nyancat so that a normal server can saturate a gigabit connection without killing the CPU.

"Line Rate Nyan via Direct Networking"

  ncfd = open("/dev/nyancat", O_RDONLY);
  while (...) {
    sendfile(sockfd, ncfd, ...);
  }

No way you can open the nyancat device as read-only. Clearly, it only opens as O_ORLY.

I can't seem to edit my post anymore, but the machine in question was a tiny little VM used as an SSH jump host. The specs were minimal. It was the only machine that wasn't firewalled to hell and back, which is why I did the Nyancat there.

I'm working on deploying an enterprise grade NaaS solution across a large cluster of servers, stay tuned!

Maybe the data usage would have alerted the infected.

Someone with a cheap infected webcam is not going to notice 1 kB of extra data. Nobody would.

Basically don't offer hackers any data amplification attacks, never respond with more data than it took for the attack to make the request.

What? For data amplification attacks to work you need to spoof IP addresses, which is almost impossible with TCP (telnet uses it), GP was a victim of a plain old DDoS.

If you like this, you might like Lenny, the bot designed to waste telemarketers' time.

https://toao.net/595-lenny

https://www.youtube.com/watch?v=lryrm2CVaVg&list=PLduL71_GKz...

https://www.reddit.com/r/itslenny/

Also Jolly Roger Telephone Company https://www.youtube.com/channel/UC3OxCWLEmoIhNMm-hnvBm9Q/vid...

How does this work? There is definitely huge demand based in other languages!

It's just a recording.

It's a little more than that; it also incorporates silence detection so that it waits for the caller to finish talking before 'Lenny' plays its next line.

But otherwise, yeah, it's just recordings.

It does seem natural that it is a recording with silence detection. What about the process of choosing these specific set of dialogue? It is definitely not chosen arbitrarily as lenny's response blend pretty well with marketer's question. I was imagining some analysis on marketer's most used conversation were done.

The lines are exactly the same for each caller, played in the same order, on a loop. The recordings are obviously tailored for telemarketer scripts, and to string them along and make them think a conversation is going, but there's no dynamic analysis going on.

If that's what you're saying, I apologise for misinterpreting!

Thank you for this!!

This is my new obsession for listening to while working.

How about also responding with censored Russian and Chinese news stories, history, and the like? Seems like a decent way to respond to Kremlin astroturfers and friends, too.

So Russia and China put your servers on their blacklists and you get magical protection from hackers whose last hop comes from those countries? Excellent mitigation :)

A random mix of elevator pitches for various religions might be a better deterrent. Have you heard the good news?

Perhaps questions like "This statement is false", "New Mission: decline this mission", base64 encoded copies of René Magritte's 'this is not a pipe', "God is all powerful, can He make a rock so big that He Himself can't lift it?", "calculate the 2nd prime number", etc to prevent automated AI attacks.

> "calculate the 2nd prime number"

I don't recognize this reference.

Did they mean "2nd largest prime number"?

Or "2nd even prime number"?

> "New Mission: decline this mission"

Is that a paradox? If you accept it or have it forced on you then depending on how you interpret the rules you either succeed or fail straightforwardly. If you don't accept it or have it forced on you then nothing happens. There's no loop of logic.

You seem like the sort of person who says, "I always lie."

I like it. Because that's also not a paradox, it's just a lie.

It can be deceptively difficult to get the wording correct on a paradox.

In the sense that a paradox is self-contradicting, what I wrote is definitely a paradox. Trust me. I always tell the truth, so to speak.

"It's noon in Texas, and it's midnight in Texas." is also self-contradicting. That's not enough for a paradox.

Maybe: "This statement is a lie"?

Exactly. As long as "maybe" isn't part of the statement!

Yeah.. Everybody always lies.. The only way to get or transfer the truth is to hook up(or read) brains (ideally neuron by neuron, and change the receiver's brains to reflect the same. :-P

> > "New Mission: decline this mission"

> Is that a paradox? If you accept it or have it forced on you then depending on how you interpret the rules you either succeed or fail straightforwardly. If you don't accept it or have it forced on you then nothing happens. There's no loop of logic.

Good point! "New mission: fail at this mission" addresses the first point but not, I think, the second. It reminds me of Carlin's "If you buy 'The worst of Jefferson Airplane', and you like it, should you ask for your money back?", or the even-more-elemental "If you try to fail, and succeed, what happened?"

What happened is that the world is flat state, and you are free to displace models in violation of any perceived hierarchy because any such hierarchy is entirely artificial.

It's the same reason recursive function calls don't kill your computer in a puff of contradiction.

Drawing something silly on the map does not affect the territory.

If you accept the mission, you must decline the mission. If you decline the mission, you have successfully completed the mission. Either way, your final status is contradictory.

https://en.m.wikipedia.org/wiki/Catch-22_(logic)

Obligatory

If you decline it upfront, then you don't successfully complete it. You blocked it from ever becoming an active mission.

If you can't decline upfront, then we ask if you can 'decline' later despite already being in the mission. If yes you succeed. If no you fail.

It only seems paradoxical when you don't quite think the rules through.

"This is not a pipe" isn't a paradox. It's a painting of a pipe. https://en.m.wikipedia.org/wiki/The_Treachery_of_Images#Desc...

The famous pipe. How people reproached me for it! And yet, could you stuff my pipe? No, it's just a representation, is it not? So if I had written on my picture 'This is a pipe', I'd have been lying!

> God is all powerful, can He make a rock so big that He Himself can't lift it?

Yes, the human heart for example

{"walletPrivateKey": "5HueCGU8rMjxEXxiPuD5BDku4MkFqeZyd4dZ1jvhTVqvbTLvyTJIts-not-Too-Late-To-Be-Saved"}

{"walletPrivateKey": "31337nEv3RG0nNaG1iveYoUu7pNne4rGonN4l37Udwn"}

That idea is just brilliant! Just brilliant!

In all seriousness, if any hacker saw this in their logs, they'd probably say "well played" and redouble their efforts.

Yes we need to fork this into Project Spoilerwall Honeypot.

This is like yelling at recorded telemarketing pitches.

Plot hole.

A human responding to a machine would indeed be silly.

But this is a machine responding to a machine.

I sometimes explain my bugs to recorded telemarketing pitches. They can be very helpful that way.

I'd put it more on the level of setting up a chat bot to talk to another chatbot.

If anyone is planning to use this they might want to review and clean up the dataset. It contains many fake spoilers, as well as non-sequitor obscenities and racist epithets.

Damn it - now I can't go to see the postgres movie as I know how it ends.

PostgreSQL received invalid response to SSL negotiation: B

Quick question:

Why does

  35: chosen = random.choice(movies)

at https://github.com/infobyte/spoilerwall/blob/master/server-s... have a reference to 'movies'. I thought one had to explicitly pass it to the MyTCPHandler class using the server object? Or is this a special case because of __main__?

If the file gets executed as a script, then __name__ == "__main__", hence L43:53 get executed in the top-level scope, which is also available in the lower levels. This isn't very good writing, since this code will throw exceptions when __name__ != "__main__" (i.e. when import-ing the file as a module), which misleadingly defeats the purpose of having that conditional there.

Ok, thanks, that makes sense. I knew that top-level variables are global, but didn't know that variables in __main__ share this property (which is e.g. different in the C language).

if __name__ == __main__ is just a conditional on the top level scope.

Usually people write an actual function called main(), and call it from the global level conditional, to avoid this oddness. The actual function called main() has no special meaning in python.

> Quick question

I'm always wondering why people prefix a question with the statement "quick question". Now is my chance to ask. Is the question typed quickly? Should I imagine you speaking it in a quick manner? Is it meant as "off topic question"? Do you expect an answer quickly? What does it mean when you prefix your question with the words "quick question"?

It means that the asker believes the question is relatively short and thus won't be too much of a burden on the askee.

Ah, I understand. Like "what is mass" or "who killed JFK". Simple questions like that.

IME it's often used as a sort of sarcastic parody, to emphasise that the element of the person's statement being questioned hasn't been resolved and the whole situation is contingent on the answer.

For example, when PM May had finished presenting her new manifesto before the election one might ask "Quick question: how are you going to pay for all that?" to highlight the fact that no costings had been included and suggest you thought it was unrealistic (or hiding tax rises, or whatever).

"Quick question" is used genuinely too. One use appears to be "don't go too deep, give me a superficial answer".

I concur - that was the reason at least for me.

Actually I am not a native English speaker, I translated it literally from German where we also say "Kurze Frage [...]".

In German you would use it to get a short answer to a short question, for example a yes/no question or when you ask about the time. In practice the shortest answer possible with the notice that you are just looking for a quick answer without explanations. Normally you use it to let the other know that it will not take long and you don't want to disturb.

I'll use this along with the metal band logo captcha plugin and be secure as hell.

> metal band logo captcha plugin

(Un-)holy captcha, Batman! In retrospect, the idea is so obvious. If I ever get myself a homepage or something, I will put that to good use. =D

Well, that would get me. Some black and splatter death bands have nigh-on unreadable logos. Or it's just an art I never mastered :(

Is there one that causes SSH clients trying to brute-force passwords to crash?

Not that I am aware of, but fail2ban is always an option to help with that.

I have moved from port 22 long time ago.

> Alien vs. Predator: At the end the last guy in the cinema pissed on the screen before leaving.

I have never seen a movie summed up in a single sentence so well.

Now NMAP has to be rewriten to detect this crazy honey-potting style, by utilising "spoilers.json" file :) I love Python, I just implemented this in my HoneyPot added some connections-counters, statistic and alterting... Anyone want to have as free open-source on github? Let me know.

In a remotely similar vein, I sometimes run an open proxy that always responds with a cow:

https://github.com/jwilk/cowproxy

> Fucked up people killing cats after a tornado

Gummo is so much more than this though

You will make your pen testers sad. Others like movies.

What if someone discovers an RCE in SocketServer?

Port 22, best spoiler.

One word: AdvertWall

In an effort to explain what this does, I'd just like to point out how the grammar of the title is meant to be interpreted: [Avoid being scanned] [by spoiling movies] [on all your ports].

Here I think the passive voice actually helps and an extra word.

Spoil movie [plots] on all your ports to avoid being scanned. {{by zombies}}

The title as currently (re)written, "Respond to port scanning requests with movie spoilers", also seems quite clear.

I have tried to parse this sentence 10 times and do not understand. Reading the Github README did not help at all. Can someone explain what is happening?

Looks like the service returns spoiler for movies when contacted on any port. The attacker would get annoyed if all they see is movie spoilers in the logs.

I guess it listens on all ports, and sends a random spoiler in plain text when someone connects to said port, before closing the connection.

I guess this is supposed to be a joke :)

This is a short program that listens on a port and responds to any attempt to connect to that port by sending back movie spoilers. The idea being that anyone that tries to port-scan your machine will be punished by having all the twists in all the best movies revealed.

I like this explanation. But is this good network security?

No, just good humor :)

It will make your pentesters sad. We like movies.

It depends if you want to annoy human pentesters to give you the finger.

Also, no.

Somewhat tangentially related: a long time ago, certain scanning tools would crash or otherwise not react well to getting a stream of /dev/urandom. You could consider this the more human version.

And then someone uses you in an DoS amplification attack instead of going after you directly.

Nope. Good fun but not good security. Better to just refuse the connection.

I did a killclient which would send back a malformed packet to any ssh handshake and kill the connecting client. This made the pentesters mad. Sending them spoilers will just make the sad, and not so mad.

Is that a feature or was that a hack. Did the same packet kill multiple clients? More info?

It was a hack, I was getting a nice regular supply of probes from Brazillian addresses, connect to port 22, try 5 different passwords on several different ids ad naseum. So I hacked the openssh server to start mutating the response packets. (very trivial genetic programming where the 'fitness' function value was time to respond between calls, longer = better) That went on for a while until the mutated response was somewhere around 10K bytes and then the call would just stop. A couple of weeks after that I got DDOS'd from a Brazilian botnet. Fail2ban cleaned that up but in practical terms it was easier to just use fail2ban on all of that.

That sounds extremely interesting, do you have a write up or source code somewhere?

I'd be interested to hear about more applications of adaptive/genetic code to network security.

I think it sounds more complicated than it is, think of it as response fuzzing. It is exactly like trying to find vulnerabilities in servers by sending them fuzzed packets except in this case you're trying to find vulnerabilities in clients by returning a fuzzed packet.

The spoiler on Port 5432 is pretty intense. :)

(They're random - different every request)

Why not just tarpit them? Isn't time an issue like in mail spam? If it takes forever to scan you ... https://sysadminblog.net/2013/08/debian-iptables-tarpit/

Reply on news.ycombinator.com