Mirrors are a wonderful invention.
Without mirrors, where would those of us who are self-absorbed sit, gazing fondly? Without mirrors, no one would be able to tie a necktie, neatly part their hair, or pop a zit.
Mirrors help us safely answer the age-old question that has been the bane of husbands since the dawn of time: “Do these jeans make my butt look big?” (Answer: “Well dear, I certainly don’t think so, but perhaps you should look in the mirror and see for yourself…”)
|Apparently, during the early 90's all of the mirrors in the world were temporarily broken.|
I’ve been having a lot of fun playing around with a mirror of my own. This mirror doesn’t reflect light, however… it reflects TCP connections. I’ve already described the fun of watching it reflecting telnet sessions (see Mirror, mirror on the net… just how stoopid can they get?) so I decided to broaden the “mirroring scope” a bit to encompass some other protocols.
Earlier today, I started reflecting login attempts against Asterisk. (From the Asterisk.org website: Asterisk is an open source framework for building communications applications. Asterisk turns an ordinary computer into a communications server. Asterisk powers IP PBX systems, VoIP gateways, conference servers and other custom solutions. It is used by small businesses, large businesses, call centers, carriers and government agencies, worldwide. Asterisk is free and open source.)
Here’s how a typical mirrored attack goes. (Note: the IP addressses and source ports have been changed both to protect the semi-innocent and to make it easier to follow along. In this instance, 192.168.1.1 is my honeypot - running the TCP mirror - and 10.0.0.1 is the attacker.)
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37
Done and done…
I’m keeping my eye on this attack, just waiting for the point in time where he hits the right username/secret combo to compromise himself…
Meanwhile, as I sit here waiting, I think I’ll put my time to good use by gazing fondly upon this devestatingly handsome fellow I see before me in the …mirror.