Researchers watched 100 hours of hackers hacking honeypot computers

This is hilarious, and a fun exercise to try out if you want to learn how attacks are pulled off. It's worth having a few 'honey credentials' sitting in plaintext on the honeypot HDD and watch as the threat actors try to use them. Also worth enabling SSH and watch for login attempts like in this: https://brute.fail/

Actual article: https://www.gosecure.net/blog/2023/08/09/how-unparalleled-rd...

The RDP interception tool used by the researchers: https://github.com/gosecure/pyrdp

I wonder if an "enterprise" version of this might exist so that companies can audit what their administrators do on high-impact systems.

Man, what a way to malign bards.

Bard is a great class!

... certainly not the type to sit around and download porn all day, I'm sure...

In 2016-2017 I opened telnet (23) and a special authless sshd on 22 that both went directly into Crowther & Woods' Adventure "You are standing at the end of a road before a small brick building. Around you is a forest. A small stream..." etc. and logged all keystrokes. To keep everything quaint and throttled I limited simultaneous connections to 1 and paced output to the 30 cps of a Bell 103 modem. After glancing through logs every day and performing a more comprehensive analysis after a year, of ~100k connections NOT ONE HUMAN was spotted playing the game. It's bots and worms all the way down.

Doesn't publicizing this reduce its utility?

Honeypots are fun. I documented how I ran one here: https://the-empire.systems/how-to-run-honeypot

The TL;DR is that I deployed heralding[0].

If I recall correctly, I think within two days of the server being online, there were over 50,000 attempts to login.

[0] https://github.com/johnnykv/Heralding