HN Explorer

111 comments

[ 2.9 ms ] story [ 182 ms ] thread
acchow
I have tried to parse this sentence 10 times and do not understand. Reading the Github README did not help at all. Can someone explain what is happening?
[deleted]
(comment deleted)
indexerror
Looks like the service returns spoiler for movies when contacted on any port. The attacker would get annoyed if all they see is movie spoilers in the logs.
roblabla
I guess it listens on all ports, and sends a random spoiler in plain text when someone connects to said port, before closing the connection.

I guess this is supposed to be a joke :)

saulrh
This is a short program that listens on a port and responds to any attempt to connect to that port by sending back movie spoilers. The idea being that anyone that tries to port-scan your machine will be punished by having all the twists in all the best movies revealed.
banku_brougham
I like this explanation. But is this good network security?
[deleted]
(comment deleted)
laser
No, just good humor :)
sillysaurus3
It will make your pentesters sad. We like movies.
fweespeech
It depends if you want to annoy human pentesters to give you the finger.

Also, no.

userbinator
Somewhat tangentially related: a long time ago, certain scanning tools would crash or otherwise not react well to getting a stream of /dev/urandom. You could consider this the more human version.
mattstreet
And then someone uses you in an DoS amplification attack instead of going after you directly.
snorkel
Nope. Good fun but not good security. Better to just refuse the connection.
ChuckMcM
I did a killclient which would send back a malformed packet to any ssh handshake and kill the connecting client. This made the pentesters mad. Sending them spoilers will just make the sad, and not so mad.
pbhjpbhj
Is that a feature or was that a hack. Did the same packet kill multiple clients? More info?
ChuckMcM
It was a hack, I was getting a nice regular supply of probes from Brazillian addresses, connect to port 22, try 5 different passwords on several different ids ad naseum. So I hacked the openssh server to start mutating the response packets. (very trivial genetic programming where the 'fitness' function value was time to respond between calls, longer = better) That went on for a while until the mutated response was somewhere around 10K bytes and then the call would just stop. A couple of weeks after that I got DDOS'd from a Brazilian botnet. Fail2ban cleaned that up but in practical terms it was easier to just use fail2ban on all of that.
Crespyl
That sounds extremely interesting, do you have a write up or source code somewhere?

I'd be interested to hear about more applications of adaptive/genetic code to network security.

ChuckMcM
I think it sounds more complicated than it is, think of it as response fuzzing. It is exactly like trying to find vulnerabilities in servers by sending them fuzzed packets except in this case you're trying to find vulnerabilities in clients by returning a fuzzed packet.
[deleted]
(comment deleted)
[deleted]
(comment deleted)
bananabill
I'll use this along with the metal band logo captcha plugin and be secure as hell.
krylon
> metal band logo captcha plugin

(Un-)holy captcha, Batman! In retrospect, the idea is so obvious. If I ever get myself a homepage or something, I will put that to good use. =D

YeGoblynQueenne
Well, that would get me. Some black and splatter death bands have nigh-on unreadable logos. Or it's just an art I never mastered :(
tomswartz07
The spoiler on Port 5432 is pretty intense. :)
dom0
(They're random - different every request)
btown
In all seriousness, if any hacker saw this in their logs, they'd probably say "well played" and redouble their efforts.
CodeWriter23
Yes we need to fork this into Project Spoilerwall Honeypot.
tyingq
A random mix of elevator pitches for various religions might be a better deterrent. Have you heard the good news?
KekDemaga
Perhaps questions like "This statement is false", "New Mission: decline this mission", base64 encoded copies of René Magritte's 'this is not a pipe', "God is all powerful, can He make a rock so big that He Himself can't lift it?", "calculate the 2nd prime number", etc to prevent automated AI attacks.
pavel_lishin
> "calculate the 2nd prime number"

I don't recognize this reference.

valbaca
Did they mean "2nd largest prime number"?
JadeNB
Or "2nd even prime number"?
Dylan16807
> "New Mission: decline this mission"

Is that a paradox? If you accept it or have it forced on you then depending on how you interpret the rules you either succeed or fail straightforwardly. If you don't accept it or have it forced on you then nothing happens. There's no loop of logic.

IncRnd
You seem like the sort of person who says, "I always lie."
Dylan16807
I like it. Because that's also not a paradox, it's just a lie.

It can be deceptively difficult to get the wording correct on a paradox.

IncRnd
In the sense that a paradox is self-contradicting, what I wrote is definitely a paradox. Trust me. I always tell the truth, so to speak.
Dylan16807
"It's noon in Texas, and it's midnight in Texas." is also self-contradicting. That's not enough for a paradox.
bananicorn
Maybe: "This statement is a lie"?
IncRnd
Exactly. As long as "maybe" isn't part of the statement!
aangjie
Yeah.. Everybody always lies.. The only way to get or transfer the truth is to hook up(or read) brains (ideally neuron by neuron, and change the receiver's brains to reflect the same. :-P
JadeNB
> > "New Mission: decline this mission"

> Is that a paradox? If you accept it or have it forced on you then depending on how you interpret the rules you either succeed or fail straightforwardly. If you don't accept it or have it forced on you then nothing happens. There's no loop of logic.

Good point! "New mission: fail at this mission" addresses the first point but not, I think, the second. It reminds me of Carlin's "If you buy 'The worst of Jefferson Airplane', and you like it, should you ask for your money back?", or the even-more-elemental "If you try to fail, and succeed, what happened?"

Retra
What happened is that the world is flat state, and you are free to displace models in violation of any perceived hierarchy because any such hierarchy is entirely artificial.

It's the same reason recursive function calls don't kill your computer in a puff of contradiction.

taneq
Drawing something silly on the map does not affect the territory.
PhasmaFelis
If you accept the mission, you must decline the mission. If you decline the mission, you have successfully completed the mission. Either way, your final status is contradictory.
Dylan16807
If you decline it upfront, then you don't successfully complete it. You blocked it from ever becoming an active mission.

If you can't decline upfront, then we ask if you can 'decline' later despite already being in the mission. If yes you succeed. If no you fail.

It only seems paradoxical when you don't quite think the rules through.

sp332
"This is not a pipe" isn't a paradox. It's a painting of a pipe. https://en.m.wikipedia.org/wiki/The_Treachery_of_Images#Desc...

The famous pipe. How people reproached me for it! And yet, could you stuff my pipe? No, it's just a representation, is it not? So if I had written on my picture 'This is a pipe', I'd have been lying!

[deleted]
(comment deleted)
c3d
> God is all powerful, can He make a rock so big that He Himself can't lift it?

Yes, the human heart for example

zootam
{"walletPrivateKey": "5HueCGU8rMjxEXxiPuD5BDku4MkFqeZyd4dZ1jvhTVqvbTLvyTJIts-not-Too-Late-To-Be-Saved"}
justinjlynn
{"walletPrivateKey": "31337nEv3RG0nNaG1iveYoUu7pNne4rGonN4l37Udwn"}
krylon
That idea is just brilliant! Just brilliant!
aquasarus
In an effort to explain what this does, I'd just like to point out how the grammar of the title is meant to be interpreted: [Avoid being scanned] [by spoiling movies] [on all your ports].
valbaca
Here I think the passive voice actually helps and an extra word.

Spoil movie [plots] on all your ports to avoid being scanned. {{by zombies}}

JadeNB
The title as currently (re)written, "Respond to port scanning requests with movie spoilers", also seems quite clear.
Animats
This is like yelling at recorded telemarketing pitches.
Brian_K_White
Plot hole.

A human responding to a machine would indeed be silly.

But this is a machine responding to a machine.

YeGoblynQueenne
I sometimes explain my bugs to recorded telemarketing pitches. They can be very helpful that way.
satsuma
I'd put it more on the level of setting up a chat bot to talk to another chatbot.
haberman
If you like this, you might like Lenny, the bot designed to waste telemarketers' time.

https://toao.net/595-lenny

https://www.youtube.com/watch?v=lryrm2CVaVg&list=PLduL71_GKz...

https://www.reddit.com/r/itslenny/

[deleted]
(comment deleted)
a_c
How does this work? There is definitely huge demand based in other languages!
EGreg
It's just a recording.
Sophira
It's a little more than that; it also incorporates silence detection so that it waits for the caller to finish talking before 'Lenny' plays its next line.

But otherwise, yeah, it's just recordings.

a_c
It does seem natural that it is a recording with silence detection. What about the process of choosing these specific set of dialogue? It is definitely not chosen arbitrarily as lenny's response blend pretty well with marketer's question. I was imagining some analysis on marketer's most used conversation were done.
Sophira
The lines are exactly the same for each caller, played in the same order, on a loop. The recordings are obviously tailored for telemarketer scripts, and to string them along and make them think a conversation is going, but there's no dynamic analysis going on.

If that's what you're saying, I apologise for misinterpreting!

nitemice
Thank you for this!!

This is my new obsession for listening to while working.

[dead] Pinkpanthers
Hello there, tired of throwing away money to fake hackers?Worry no more as we can help you with that.We are part of a team consisting of highly efficient developers and hackers.We carry out services like,upgrade school grades, Get passwords for all social networks like Facebook,Instagram,Twitter,Whats app,Line,Skype Hack, We also delete unwanted online pictures and videos on any website,clear criminal records,hack bank accounts for transfers and credit card top ups,application hacking.We do custom software and web development in php, java, asp.net etc.We have 100% records from our client as well as highest repeat hire rate,and a refund policy we work with,our work speak for ourselves, we provide a perfect software solution to all clients.We believe in mutual growing with client and hence we work as a technology partner and consultant for our clients. Contact us .............pinkpantherhackers@gmail.com text +13238351741 ICQ ..........711574456 Thanks as we anticipate working with you now and in the future to come
droithomme
If anyone is planning to use this they might want to review and clean up the dataset. It contains many fake spoilers, as well as non-sequitor obscenities and racist epithets.
pje
> Fucked up people killing cats after a tornado

Gummo is so much more than this though

zeptomu
Quick question:

Why does

  35: chosen = random.choice(movies)
at https://github.com/infobyte/spoilerwall/blob/master/server-s... have a reference to 'movies'. I thought one had to explicitly pass it to the MyTCPHandler class using the server object? Or is this a special case because of __main__?
y7
If the file gets executed as a script, then __name__ == "__main__", hence L43:53 get executed in the top-level scope, which is also available in the lower levels. This isn't very good writing, since this code will throw exceptions when __name__ != "__main__" (i.e. when import-ing the file as a module), which misleadingly defeats the purpose of having that conditional there.
zeptomu
Ok, thanks, that makes sense. I knew that top-level variables are global, but didn't know that variables in __main__ share this property (which is e.g. different in the C language).
AlecSchueler
if __name__ == __main__ is just a conditional on the top level scope.
apenwarr
Usually people write an actual function called main(), and call it from the global level conditional, to avoid this oddness. The actual function called main() has no special meaning in python.
janwillemb
> Quick question

I'm always wondering why people prefix a question with the statement "quick question". Now is my chance to ask. Is the question typed quickly? Should I imagine you speaking it in a quick manner? Is it meant as "off topic question"? Do you expect an answer quickly? What does it mean when you prefix your question with the words "quick question"?

jghn
It means that the asker believes the question is relatively short and thus won't be too much of a burden on the askee.
l0b0
Ah, I understand. Like "what is mass" or "who killed JFK". Simple questions like that.
pbhjpbhj
IME it's often used as a sort of sarcastic parody, to emphasise that the element of the person's statement being questioned hasn't been resolved and the whole situation is contingent on the answer.

For example, when PM May had finished presenting her new manifesto before the election one might ask "Quick question: how are you going to pay for all that?" to highlight the fact that no costings had been included and suggest you thought it was unrealistic (or hiding tax rises, or whatever).

"Quick question" is used genuinely too. One use appears to be "don't go too deep, give me a superficial answer".

zeptomu
I concur - that was the reason at least for me.

Actually I am not a native English speaker, I translated it literally from German where we also say "Kurze Frage [...]".

sharpshadow
In German you would use it to get a short answer to a short question, for example a yes/no question or when you ask about the time. In practice the shortest answer possible with the notice that you are just looking for a quick answer without explanations. Normally you use it to let the other know that it will not take long and you don't want to disturb.
dsl
You have to be very careful when running this on the telnet port.

I had a server set to spew a full color ANSI Nyancat at you when you telneted in. When the Mirai botnet was in full swing, I was pushing 5+ Mbps of Nyancat down to peoples infected webcams and killing my servers CPU.

Overtonwindow
I'm sorry, that's terrible, but this sounds hilarious
batrat
I laughed so hard. Sorry...
ChuckMcM
ok, I've stopped laughing now and and cleaned up the spilled drink. This is brilliant. You need to team up with a CDN and get them supply cats from the nearest available node.

"Unleash the Nyancat!" as they say...

adrianN
Surely some enterprising hacker can optimize Nyancat so that a normal server can saturate a gigabit connection without killing the CPU.
swiley
"Line Rate Nyan via Direct Networking"
jwilk 

  ncfd = open("/dev/nyancat", O_RDONLY);
  while (...) {
    sendfile(sockfd, ncfd, ...);
  }
nobodyorother
No way you can open the nyancat device as read-only. Clearly, it only opens as O_ORLY.
dsl
I can't seem to edit my post anymore, but the machine in question was a tiny little VM used as an SSH jump host. The specs were minimal. It was the only machine that wasn't firewalled to hell and back, which is why I did the Nyancat there.

I'm working on deploying an enterprise grade NaaS solution across a large cluster of servers, stay tuned!

[dead] Pxtl
>> NaaS

Snrrrrrrk

dcousens
Maybe the data usage would have alerted the infected.
IshKebab
Someone with a cheap infected webcam is not going to notice 1 kB of extra data. Nobody would.
mattstreet
Basically don't offer hackers any data amplification attacks, never respond with more data than it took for the attack to make the request.
Franciscouzo
What? For data amplification attacks to work you need to spoof IP addresses, which is almost impossible with TCP (telnet uses it), GP was a victim of a plain old DDoS.
Ankaios
How about also responding with censored Russian and Chinese news stories, history, and the like? Seems like a decent way to respond to Kremlin astroturfers and friends, too.
willvarfar
So Russia and China put your servers on their blacklists and you get magical protection from hackers whose last hop comes from those countries? Excellent mitigation :)
jerianasmith
You will make your pen testers sad. Others like movies.
TimMurnaghan
Damn it - now I can't go to see the postgres movie as I know how it ends.

PostgreSQL received invalid response to SSL negotiation: B

xz0r
What if someone discovers an RCE in SocketServer?
krylon
> Alien vs. Predator: At the end the last guy in the cinema pissed on the screen before leaving.

I have never seen a movie summed up in a single sentence so well.

raverbashing
Is there one that causes SSH clients trying to brute-force passwords to crash?
apocalyptic0n3
Not that I am aware of, but fail2ban is always an option to help with that.
xfer
I have moved from port 22 long time ago.
thomasdd
Now NMAP has to be rewriten to detect this crazy honey-potting style, by utilising "spoilers.json" file :) I love Python, I just implemented this in my HoneyPot added some connections-counters, statistic and alterting... Anyone want to have as free open-source on github? Let me know.