Near real time honeypot map, or: Where are the bad guys?

[SteveRiley]

http://www.sicherheitstacho.eu/?lang=en



While it may be fashionable to whip the populace into a frenzied fear of China, they're near the bottom of the list of top 15 sources. More worringly, the US is near the top. But notice the real threat: Russia. Still more than twice as troublesome as China plus Taiwan (it's reasonable to assume that many Taiwanese-sourced attacks are the result of Chinese infiltration).

[blackpaw]

Interesting.

Our work email server is constantly being probed, mostly from Russia. I wonder if the hacking is mainly attempts to enable botnet spam?

[oshunluvr]

I find it interesting that SMB is by far the largest target.

Windows, anyone?

[HalationEffect]

Sigh... I really am becoming more and more cynical, because my answer to "where are the bad guys?" is: "everywhere".

IMO humanity's worst enemy is humanity. If everyone spent more effort working toward the common good than trying to improve their own lot at the expense of someone else, the entire world would be a better place for everyone. So many people seem to think of themselves as members of small tribes (sometimes as small as just themself). I'd like to see a world where we're all members of a tribe of ~7 billion.

[SteveRiley]

Our work email server is constantly being probed, mostly from Russia. I wonder if the hacking is mainly attempts to enable botnet spam?

My guess would be it's victim machines in a botnet searching for SMTP relays. Not a day goes by that I don't get some attempts against my own email server. They've all failed (so far), because I've got Postfix screwed down pretty tightly.

[SteveRiley]

Another one, this time from the Honeynet Project.

http://map.honeycloud.net/

[Simon]

I am the ONLY "bad guy" on the internet... those are my minions!! Bawahahahaha!

But on the serious side I would not want to be a cyber criminal in Russian Federation. They take all crime very serious there, as in they lock you up and throw away your cell.

Here in Canada we just hit them with a dead salmon and call them a hoser.

[SteveRiley]

But on the serious side I would not want to be a cyber criminal in Russian Federation. They take all crime very serious there, as in they lock you up and throw away your cell.

You're joking, right?

[HalationEffect]

You're joking, right?

He must be... I mean, locking someone up and throwing away the key is one thing, but throwing away the cell? That's hardcore!

[whatthefunk]

Throwing away all those cells must be creating a massive land fill problem in Russia.

[bsniadajewski]

Throwing away all those cells must be creating a massive land fill problem in Russia.

Well they do have massive amounts of land for it in Siberia.

[SteveRiley]

Haha you guyz! I'll be more specific:

They take all crime very serious there

You're joking, right?

[Simon]

No, I failed at being sarcastic. That is the one crime that the Russian government cares very little about. I think the US takes it more serious than we seem to do here in Canada. I keep telling my friends they should make the switch to Linux, if they don't like having to restore the Windows every month or two. I did get a fellow student at college to switch but for some reason she is using the Debian flavor. But it was all that crap ads that look like Windows warnings she was clicking. So now she should be fine. She even likes the way we get the software we want without having to search a dozen web pages.

As a side note while researching this topic a bit; the NSA called Linux the most secure OS of our time and even created their own distro S-E Linux or Security-Enhanced Linux. While I was looking at the NSA pages I had to laugh at the kids recruitment page. LoL

[SteveRiley]

I suppose I sort of knew you were injecting some sarcasm. Hard to tell at times with only the written word. Use more smileys, haha.

SELinux is not a distro, it's a form of mandatory access control (MAC). AppArmor, offered in the *buntus, is an alternate kind of MAC. Essentially, these tools provide administrators a mechanism for enforcing program execution policies on a machine. SELinux is a thorny beast to configure, relying as it does on absolute paths and file hashes. AppArmor trades complexity for simplicity, but with some loss of fine-grained control. But because these are primarily designed for policy enforcement across collections of machines, they're not well suited for J. Random Individual to employ as a protection mechanism in a home or small office setting.

[Simon]

Thanks for clearing that up Steve. All I can add is if you want more security stick with any Linux distro...

Smileys... My avatar is smiling all the time. But yours is brooding or something. Give him a cookie.