Hack the Hacker - How to Setup an SSH Honeypot

Running a honeypot is always a nice and easy side project. Sofiane Hamlaoui published two articles on this topic. The setup of Cowrie as an SSH honeypot is part of the initial article. The other article provides some details on the results Sofiane observed after running the honeypot for some time. The latter article contains some cool examples of malware. Interestingly, that article was also published prior to the other one for the setup of Cowrie. The top password in his logs, 345gs5662d34, also leads the SSH credentials seen by the SweetCam IP camera honeypot of researchers from DTU and Aalborg University, who traced it to a likely default credential of a Polycom CX600 IP telephone. For the Sakura.sh script he attributes to Gafgyt, SecurityScorecard’s analysis of a recent Gafgyt sample shows what such a bot does once it is in: borrowed Mirai code and a menu of DoS commands, including floods aimed at Valve Source Engine game servers.