Shodan honeypot tag

[eschultze]

Hello everyone! Just noticed that my tpot server has a "honeypot" tag at Shodan.

Just wondering here how are they doing it and how could we make this fingerprinting harder for them. I believe it's because we have so many ports and services running simultaneously, but could also be a favicon fingerprint or another kind of detection. Any ideas?

[ruben03mx]

This continues to happen, has anyone tried decreasing the number of honeypots (services) available? should a randomize ports option available?

[t3chn0m4g3]

This is not in relation to ports, and you can always modify your T-Pot edition the way you seem fit for you personal usage scenario (/opt/tpot/etc/tpot.yml is a docker-compose file you can adjust for ports, etc.).
It's actually the honeypots themselves, for a while it was Conpot they fingerprinted and we adjusted the configs in a cat / mouse game which, for open source is counter productive and you should adjust this on your end (see the Wiki for volumes and how to use your own config).

[ruben03mx]

ok so it does has to do with the honeypots (services) available and they are getting fingerprinted.
Why is counter productive for open source?
Ok I will adjust in on my end.
Do you know which ones are getting fingerprinted now?

[t3chn0m4g3]

Why is counter productive for open source?

If I adjust the config and commit, Shodan will be able to see the changes and act accordingly.

Do you know which ones are getting fingerprinted now?

No. It's a cat and mouse game you can never win, that's why I am not aware of any honeypot developer putting serious effort in this.

Also I seriously doubt that campaigners really care, otherwise we would not get any hits and really the opposite is the case.

[t3chn0m4g3]

This should help. Should work fine in 20.06, will be shipping with 22.x.