Hey Attacker! I Can See You!
summary
Built a simulated Linux environment and protocol emulators to study human attackers rather than bots, using Linux emulator plus custom SSH fingerprinting and VNC clipboard capture. The system injects faults (the “rule of three”), plants canary tokens, logs TCP SYN entropy and public keys, and links keys to GitHub to geolocate operators. It runs globally, handles thousands of logins per second, collects about 50 GB/day, surfaces 70–120 active human groups, and feeds malware/URLs to VirusTotal and Microsoft security products.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 2:10Dark Web
- 3:10Example
- 5:00The Dilemma
- 6:00Honeypots
- 8:50Deception
- 11:00Fog of War
- 13:05The Solution
- 14:00The System
- 16:00Data Collection
- 19:50Results
- 27:20VNC server
- 29:45Questions
related talks
36mCyber Werewolves: Emulating the Enemy Before the Full Moon Rises
20mDefending Your Network with Infection Monkey
43mBecoming a Dark Knight: Adversary Emulation Demonstration for ATT&CK Evaluations
42mTracking Attackers in Open Source Supply Chain Attacks: The New Frontier
32mFaking a Factory: Creating and Operating a Realistic Honeypot
46mAn OT Cyber attack simulation on a chemical plant
47mDetecting and analyzing files-less malware
32mFriend or Replicant: How Attackers Automate and Disguise Themselves