Hacker News Reader

Comment by mkoryak | Hacker News Reader

Sometimes I think it might be fun to setup an express server that correctly responds to one of these attacks just so I can waste someones time.

But doing that would also waste my time.

View on HN

https://en.wikipedia.org/wiki/Tarpit_(networking)

Ah, tarpit refers to a system that purposely slows down answers, while honeypot is a system that _looks like_ it's delivering the goods but it is just a trap.

I'm sure they mostly refer to the same thing, though.

https://en.wikipedia.org/wiki/Honeypot_(computing)

It's mostly wasted time but I feel it's slightly more beneficial than playing video games (which I also do) so I do it for fun sometimes. [1] [2]

[1] https://infosec.exchange/@gnyman/109318464878274206

[2] https://nyman.re/super-simple-ssh-tarpit/

It’s all automated; not you’re not really wasting an actual persons time.

It does waste their time if your honeypot is constantly responding with legitimate looking but fake credentials. Presumably the hacker is going to try to use them?

It’s the same idea used by anti-spam activists back in the day with software that would flood spam website forms with fake but realistic looking info, so the real data would be buried in the noise.

That part is also automated

From what I understand the automated part is sometimes a first pass. Just to see if you are there and have something. They will then wait some period of time and come back later with the real attack. Sort of like the war dialer from the movie wargames. Basically try everything get a list of interesting targets. Then go at them. Now some are fully automated and just try whatever exploits they are trying right then and there.

Exactly. Poison the attacker's list of credentials with bogus values. This decreases their efficiency, slowing them down.

Honeypots are good fun

Reply on news.ycombinator.com