A honeypot programmed in Micropython for the ESP8266 | Hacker News Reader

A honeypot programmed in Micropython for the ESP8266

github.com

105 pointsgkm2522 comments

A way more interesting and more complete honeypot is https://github.com/honeytrap/honeytrap. It combines a great list of services exposed to the internet and is very extendable. Currently development has a somewhat lower priority, but in the near future, it'll be ramped up.

I think the difference is that the Honeypot in the OP runs in an ESP8266; a small, single core chip that can be had for under $5.

While this is true, why not just get a raspberry pi zero or whatever?

Developing on an ESP8266 is completely different than a RasPi Zero. If you want a challenge, and want to write code that can run in 80KB of RAM and have the code and all of its dependencies fit in 4MB of flash, then that’s part of the reason why microcontrollers are popular (also because a lot of them are easy to get going with).

Great answer, thank you :)

It is cheaper

If we’re evaluating cost, surely micropython is at least $5 of lost functionality for a single chip. Only at scale would you see any savings.

I've always been amazed by the power of these little ESP chips. I'm actually really curious to see what outside the box use cases the ESP 8266 and the ESP 32 will have in the future.

Do the authors ever reveal if they detected any would-be hackers?

No.

This is an adorable project that assumes people who are familiar with nmap regularly scan whatever they can.

It’s cute, but I’d expect it to be pretty dull to watch.

https://zmap.io/ https://github.com/robertdavidgraham/masscan

it will be attacked within minutes, you should start a honeypot and see for yourselves

Eh, it depends on how it's exposed.

I used to run a Kippo[1] honeypot on port 22. I'd regularly see automated intrusion attempts, often followed up by users manually interacting with the server (and slowly coming to realize that it was fake). Nowadays I expect the exploitation process is typically much more automatic, so it'd be less interesting to watch.

[1]: https://github.com/desaster/kippo

The only place that I've ever seen this kind of honeypot regularly pick anything up is on college campuses.

never heard of the mirai botnet i take it https://en.wikipedia.org/wiki/Mirai_(malware)

I understand your misconceptions about this working. It really just depends on if it appears to be vulnerable enough to scanners, and whether people actually bother to take interest. I guess you could say that my "project" is more of and experiment in how hackers go about finding vulnerable devices. Who knows, maybe hackers don't take interest in vulnerable telnet services anymore (they probably don't), but thats okay, this was fun while it lasted. I'll leave the memes on the readme.

Hey- if you are the author, I want to say I support what you are doing. We need more projects like this. But when I read the source, looks pretty lean to me in terms of follow on functionality. Would love to help you expand on this.

I was kind of surprised and a little disappointed when I got a router with IPS monitoring and 9 months on there hasn't been a blip in the logs.

if you can still edit the title would you please change it from ALL CAPS to mostly lower case?

That's a very unprofessional readme.

I don't work on this full time, so it necessarily need to be professional. Although I think I might cut down on the emojis.

"The honeypot is set up to act as a telnet server owned by a fake bank."

Really?

its just a joke/fun thing I decided to do.

Reply on news.ycombinator.com