Cybersecurity@sh.itjust.worksbyumutcamliyurt@lemmy.world
22 hours

A honeypot that binds to a large range of dummy TCP and UDP ports to frustrate network fingerprinting.

English

Source code and details: https://github.com/umutcamliyurt/PortTripper

How it works

On startup PortTripper:

  1. Scans the configured port range and builds a whitelist of ports already in use by real services (first run only).
  2. Binds TCP and UDP listeners on every port in the range that is not in the whitelist.
  3. On TCP: accepts connections, holds them open for a configurable duration, then drops them, wasting the scanner’s threads and file descriptors.
  4. On UDP: reads and discards datagrams without replying, so ports appear open|filtered to scanners rather than closed.

All real service ports are untouched because they are already bound before PortTripper starts, and the auto-generated whitelist tells PortTripper to skip them.

18
    • Jerry on PieFed@feddit.onlineEnglish
      21 hours

      Things like this that play games scare me. This itself opens a wider attack vector on your server. I’m thinking of possibilities:

      1. In Linux, each TCP connection is a file descriptor. PortTripper holds connections to waste scanner threads, which means it’s holding file descriptors. This could be a good DDOS attack vector. Hit every port with connection requests, requiring a slew of file descriptor creations, and boom, you cause the server to hit the server ulimit cap. New connections cannot be made. The server is half dead.

      2. Memory and CPU consumption. Maintaining thousands of open TCP states takes RAM and CPU. A massive flood can consume all memory. And for what? To annoy a hacker?

      Interestingly enough, just these 2 things can make PortTripper a hacker’s tool.

      1. If a service crashes or reboots, is down for maintenance, or is slow to come up, PortTripper might grab the port before the application comes back up. And then it can’t come back up.

      2. Who’s to say there won’t be vulnerabilities in PortTripper that can cause a buffer overflow, memory leak, or parsing vulnerability in PortTripper’s code or a library it uses? Playing this game opens another attack vector into your server.

      3. If PortTripper can bind to ports 1 through 1023, then it’s running as root or has elevated capabilities. If an attacker exploits a bug in PortTripper or a library it uses, they can get high-level control of the server.

      4. While PortTripper “discards datagrams without replying” in a reflected DDOS attack, millions of discarded packets come in, which means millions of CPU interrupts at the kernel level. This can choke the NIC.

      I think PortTripper is too risky to run just to become a nuisance to someone, IMHO.

      • mic_check_one_two@lemmy.dbzer0.comEnglish
        13 hours

        Also, unless I’m fundamentally misunderstanding the purpose of this… Wouldn’t this be completely irrelevant if you’re running a reverse proxy anyways? You only need to worry about port mapping if you’re running open ports. But ports 80 and 443 are reserved for http and https traffic, so they’re functionally useless for a potential attacker looking to map your running services.

        Basically, this only “protects” you if you have open ports? Just don’t open ports to begin with. Use a reverse proxy.

        The only way I can see this being useful is to protect against LAN traffic, not WAN. But if they’re able to get on your LAN, you’re probably already in the “unplug everything” stage of damage control. Other honeypots would be better equipped to alert you of the port sniffing on your LAN, instead of simply stalling an attacker by eating your own server’s resources.

        • atzanteol@sh.itjust.worksEnglish
          12 hours

          Just don’t open ports to begin with. Use a reverse proxy.

          You need to open ports to a reverse proxy?

          • mic_check_one_two@lemmy.dbzer0.comEnglish
            10 hours

            My point was that this only really helps if they’re already on your LAN. Ports 80 and 443 (the ports your reverse proxy would use) are functionally useless for an attacker to map. And if they’re already on your LAN, there are honeypots that will do better than simply eating server resources to delay (not stop, just delay) an attacker.

            • atzanteol@sh.itjust.worksEnglish
              3 hours

              I’m not sure you understand what a “honeypot” is. The entire point is to set it up somewhere public so that people try to scan and connect to it. It doesn’t protect anything. It’s designed to try to slow-down attackers who probe random systems.

              • mic_check_one_two@lemmy.dbzer0.comEnglish
                42 minutes

                I’m not sure you understand what a honeypot is. You only listed one kind, and it is arguably the most useless kind. I don’t care about what happens outside of my WAN, because that is what a firewall is for. I only care about what happens inside the firewall. A good honeypot will act as an early warning system for a breach. It is an attractive target for people who are looking to spread to other devices on the network.

                If an attacker gets into your network, the honeypot is designed to act as an attractive target and alert you when it gets hit. I don’t care if people try to scan my WAN ports. Bots do that all the time. It’s basically a given. But with a reverse proxy, you’re only opening ports 80 and 443. Those are basically useless for an attacker, because it only tells them that you’re running something on http and https. And that could be anything.

                If I’m running a honeypot, it’s going to be to alert me if something gets breached. It’s going to run on my LAN, not my WAN. If something on my LAN suddenly starts scanning all of my server’s ports, it’s because that thing is a rogue device/attacker. I’m not interested in stalling them. I want to be automatically alerted and to completely shut them out. That’s what a good honeypot will do. A bad honeypot just wastes time and resources, instead of alerting me to the potential breach.

      • bamboo@lemmy.blahaj.zoneEnglish
        20 hours

        It’ll probably just be a nuisance for small operations and for larger botnets be a drop in the bucket or not even noticable.

        • SayCyberOnceMore@feddit.ukEnglish
          18 hours

          Yeah, I don’t think this would be great on an external boundary with all the internet scanners out there, but maybe in a DMZ it might help as a feed to a boundary blocklist.

          I do see torrent peers trying to scan my network sometimes, so this might be an interesting insight…

        • Jerry on PieFed@feddit.onlineEnglish
          7 hours

          If successfully attacked and the hacker has elevated rights on your Pi, they are now in your local network and can potentially cause all sorts of grief in the router and on other connected devices. Or it can become part of a DDoS device farm.

        • bamboo@lemmy.blahaj.zoneEnglish
          18 hours

          I think what the commenter is saying is if you have something running on a server on an external IP address for like a website that needs to be public, the additional risk of opening up more ports to slow down Internet scanners is not beneficial to you and not worth the risk.

          If you’re deploying an raspberry pi and opening it up to the Internet, and don’t care if it crashes due to overload, thats a bit of effort and cost you incure to keep it running to be a nuisance.for Internet scanners. If you don’t have anything which needs to be publicly accessible to the Internet, the best thing you can do is not open any ports and expend no effort, so that the firewall/ NAT gateway operates in stealth mode which is does inflict some processing and time on the Internet scanner to run waiting for responses to timeout.

      • SayCyberOnceMore@feddit.ukEnglish
        18 hours

        I can understand caution before adding something new in case it causes problems, but I think most of your concerns are addressed on the github page.

        I’d prefer this to be written in a compiled language as that would be less likely to fail due to external issues, but I think this would work for someone trying to slow down anyone once they’ve found an open port… and that’s probably the root issue.

          • SayCyberOnceMore@feddit.ukEnglish
            10 hours

            It is.

            I think my wording wasn’t the best… I was implying that I preferred a compiled application over something interpreted to address the points.

            • atzanteol@sh.itjust.worksEnglish
              3 hours

              There’s nothing wrong with interpreted languages. And go is in fact compiled so…

              • SayCyberOnceMore@feddit.ukEnglish
                2 hours

                I agree with both of your statements.

                For security applications, I prefer a compiled application as it’s more difficult to alter in situ.