upvote

points

by tusksm7 hours ago |
comments
upvoteby rkagerer6 hours ago|
next
[-]
Some kind of source IP masking would be prudent. As you pointed out, some of those machines are compromised, and you aren't making their owners' lives any easier.

Bad actors might use the data you're publishing to fingerprint specific exploits to which the machines are vulnerable, multiplying the problem.

If producing an IP blacklist is one of your aims, divorcing it from any specific traffic would be more responsible.

You may also want to consider the risk traffic from compromised machines could leak PII (eg. say a script tried to use you as a relay to exfiltrate data) - and the ethical and legal consequences. A filter for SIN, credit cards, etc. would be a basic table-stakes mitigation step.

reply
upvoteby ryandrake6 hours ago|
parent|
[-]
> Some kind of source IP masking would be prudent. As you pointed out, some of those machines are compromised, and you aren't making their owners' lives any easier.

Hard for me to find much sympathy for negligent users who unintentionally allowed their home computers or phones to join a malicious botnet, or their ISPs who aren't stopping the activity. Even if it is my own grandma's PC.

I agree about the content though, there probably are a lot of actually innocent victims' personal information in the traffic itself.

reply
upvoteby taftster5 hours ago|
parent|
next
[-]
Easy for you to say, assuming your PC is clean. I don't think negligent is the right word though. Ignorant maybe? Or some form of naivety? The negligence might be on software or hardware vendors, but grandma isn't to blame for the problem.
reply
upvoteby singleshot_2 hours ago|
parent|
[-]
Software providers generally lack a duty to their clients to create and sell secure software. Further, generally, when you get hacked, there is only an interrupted causal chain between the software and your loss. Interrupting that chain is the intervening superseding cause of a criminal third-party. Finally, no states allow punitive damages, absent gross negligence in a software context.
reply
upvoteby dpoloncsak5 hours ago|
parent|
prev|
next
[-]
I disagree personally. If these IPs are being used to attempt to gain unauthorized access, it's better to make the public aware, imo.
reply
upvoteby rolph4 hours ago|
parent|
prev|
[-]
when you read or are told not to click on that link in the e-mail, or open the attachment, you should fire up your monitor while you are clicking on the links.

it might be interesting to have an eye on this while you are talking to the phone scammer.

reply
upvoteby p1anecrazy6 hours ago|
prev|
next
[-]
Hi, this is very interesting, thanks. While trying to educate myself about honeypots I came across this (https://securehoney.net/).

The aggregations of popular logins and IP locations seem interesting.

reply
upvoteby LorenDB6 hours ago|
parent|
[-]
From that site:

    Files uploaded 25,522 (46 unique)
    Malware uploaded 7,735 (43 unique)
I wonder what 3 files were so common that they were uploaded 17,787 times instead of malware.
reply
upvoteby CookieCrisp6 hours ago|
parent|
[-]
Probably the ssh key
reply
upvoteby krunck6 hours ago|
prev|
next
[-]
This is great. Thanks.

Try fingerprinting the behaviour in the sessions. Over time you should be able to distinguish between various automated tools and live people.

reply
upvoteby hideout_berlin6 hours ago|
prev|
[-]
you could make the logs public too :)
reply