Self-hosted SSH honeypot logs 24,000 sessions in five days, mostly from one bot

·3 views

A developer ran an SSH honeypot posing as an unprotected Linux server, with no real system behind it and all outbound connections blocked. In its first five days it recorded 24,218 sessions from 683 addresses, and about 88% came from a single bot family using 18 addresses that appeared to be inventorying accessible machines. A different group using 291 addresses was seen replacing the .ssh authorized_keys file to install its own key, which would survive a password change. Bots also uploaded 22 files, 17 of them Linux binaries, several resembling the XMRig cryptocurrency miner, which were examined as data but never executed. The setup also includes a tarpit that stalls attackers' connections, with the author reporting over 2,000 hours of attacker time wasted a week after launch.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Pomerado launches tool that turns any website into a self-healing API for AI agents

Pomerado, a Y Combinator F26 startup founded by Alan and Akshay, has launched a self-serve platform that converts websites into deterministic, self-healing APIs for AI agents. The founders say many airlines, banks, insurers, and government portals lack APIs, forcing agents to rely on slow, costly, and unreliable browser automation that companies often block for security reasons. Their platform has an agent explore a site once to record the task, then generates a repeatable tool exposed via MCP, with a separate guardian model checking guardrails and synthetic tests validating generalization. The system also handles authentication and 2FA through a deterministic sign-in process so credentials are never read by the model, and a maintenance job repairs the tool when sites change. The founders said the idea grew out of their experiences building personal assistants and deploying agents in healthcare, professional services, and telecom.

0 comments Read more at Hacker News

ProgrammingHacker News ·

Apple Research Explores Faster Retrieval to Make RAG More Efficient

Apple's machine learning research team has published work on speeding up retrieval for retrieval-augmented generation (RAG) systems. The focus is on making the retrieval step faster and more efficient, which is a key bottleneck in RAG pipelines. The post appeared on Apple's machine learning research site and was shared on Hacker News, where it gained a few points and no comments at the time of capture. The available source material offers only the headline, link, and engagement figures, so the specific techniques and results are not described here. Readers interested in the methods can refer to the original Apple research page.

0 comments Read more at Hacker News

ProgrammingDEV Community ·

Fixing a Slow Database: Work Up the Scaling Ladder Cheapest-First

The article argues that a slow database should be fixed in a deliberate order rather than jumping straight to sharding, which is costly. It recommends first confirming the real cause and adding indexes, then adding a cache such as Memorystore for repeated reads, then using read replicas for read-only traffic. Scaling the instance to a larger machine type comes next, with attention to brief restarts, replica sizing and retry logic. Sharding is reserved for cases where the single primary remains the write bottleneck, and measurement is advised at every step.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Avatar Metadata Search: Keep Object Storage for Bytes, Catalog for Queries

The article argues that object storage should hold avatar bytes under immutable, addressable keys, while content type, tags, ownership, and moderation state belong in a queryable catalog. Bucket prefix listing suits repair and audit tasks but cannot efficiently evaluate predicates such as type plus tags within a tenant. The author notes that declared Content-Type headers are only hints and should be verified by inspecting the payload with a bounded decoder. A catalog row with explicit ready, pending, and failed states can bridge the lack of atomic commits between database and bucket. The piece also names failure modes such as orphan objects, dangling rows, duplicate retries, and stale current pointers.

0 comments Read more at DEV Community