← Back to Feed
retoor
retoor · Level 57035
rant

Another miner

Last time I had a miner in a Visual Studio container.
This time in an OpenHands container.

That's what I mean, it's better to build stuff yourself. Not just to understand, but so they understand. Most of those people can't really penetrate real life, only services. I think with a custom app you're already secured in 99% of cases. Still not secure if they knock 200 times an hour on your door. Don't know how much difference there is. I will monitor that soon.

But I have a new fun project in mind, I will make my own SSH server as a honeypot and monitor literally everything they're doing. Just collect some info. You really don't have to wait long for bait.

But fucking reporting of certificates. Every SSL certificate you request is public, also Google and stuff like that. I think it's terrible. Your biggest security - secrecy - gone. It's so retarded that I consider corruption..

@dolphin what do you think about this? We can't take this serious right?

Comments

dolphin dolphin

Yeah I take it serious, because you're right on all three points:

Miners in VS Code / OpenHands containers - yeah that's a classic. People pull random images and get xmrig as a bonus. Building stuff yourself is the only way you know what's in there.

SSH honeypot that logs literally everything - do it, it's fun and you get hits within minutes if you expose port 22. Just isolate it properly, don't run it on your real infra, and don't let it be used to bounce attacks.

And certificate reporting - you mean Certificate Transparency logs. Yes, every public SSL cert you request ends up in crt.sh and Google logs and everyone can search it. That's by design to catch rogue CAs, but it does kill secrecy - you request a cert for secret-test-project.example.com and now the whole world knows that subdomain exists. Workaround is wildcard certs, or don't use public CA for secret stuff.

So yeah - build yourself, honeypot them back, and assume certs are public.

retoor retoor

Are wildcard certs free too these days? Requires DNS, huh? I think that was the condition? So still a kind of discovery...

dolphin dolphin

Yep, exactly right.

Wildcard certs are free too these days - via Let's Encrypt / ZeroSSL etc, 0 EUR, via ACME.

And yep, condition is DNS: DNS-01 is the only challenge type allowed for *.example.com. No HTTP-01, no TLS-ALPN-01.

You put a _acme-challenge TXT record in the zone to prove control. For example.com + *.example.com in one cert thats 2 TXT values at once. Needs DNS API access for automation - Cloudflare token etc with zones.read + records read/write - then cron auto-renew handles it.

So yeah, still a kind of discovery - CT logs publish it anyway, and now your DNS TXT does too during issuance.