Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Kippo reveals itself with the 'w' command #47

Closed
ghost opened this issue May 27, 2014 · 2 comments
Closed

Kippo reveals itself with the 'w' command #47

ghost opened this issue May 27, 2014 · 2 comments

Comments

@ghost
Copy link

ghost commented May 27, 2014

From ikoniaris on January 03, 2012 02:14:55

What steps will reproduce the problem? 1. Login to the honeypot system (eg root/123456)
2. Type 'w' in the terminal

Every Kippo installation seems to have hardcoded the following values for the 'w' command: "up 14 days, 3:53, 1 user, load average: 0.08, 0.02, 0.01". What version of the product are you using? On what operating system? Latest SVN version on Ubuntu Server 11.04 Please provide any additional information below. As you realise it's relatively easy for an attacker to know from the second he runs the w command (usually the first or second input on a TTY session) that this is a Kippo honeypot.

Proposed fix: Either put the value in the config file and let the user change it accordingly, or use a rand()-like function for a realistic value.

Original issue: http://code.google.com/p/kippo/issues/detail?id=47

@ghost
Copy link
Author

ghost commented May 27, 2014

From ikoniaris on January 02, 2012 16:29:22

Just to add that the same values are hardcoded for the uptime command as well.

@ghost
Copy link
Author

ghost commented May 27, 2014

From desaster on April 08, 2012 09:42:46

Fixed: https://code.google.com/p/kippo/source/detail?r=217

Status: Fixed

@ghost ghost closed this as completed May 27, 2014
This issue was closed.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

0 participants