New Delhi:- Imagine being able to sit behind a hacker and watch him control the computer and play with it. That's pretty much what two security researchers did with a huge network of computers set up as a honeypot for hackers.

The researchers deployed a number of Windows servers that were intentionally exposed to the Internet, configured with Remote Desktop Protocol or RDP, which meant that hackers could remotely control the compromised servers. enter as if they were a regular user, type and click.

Using these honeypots, researchers were able to record 190 million events and 100 hours of video footage of hackers taking control of servers and performing a range of actions on them, including spying, installing software, etc. malware that destroys crypto, uses Android emulators to conduct click fraud, brute-forces passwords for other computers, conceals identity of hackers using honeypot as a starting point for another attack and even watching porn. Researchers say that a hacker who successfully logs into their honeypot can generate "dozens of events" on their own. “It's basically like a surveillance camera for the RDP system because we see everything,” said Andréanne Bergeron, who holds a Ph. in criminology from the University of Montreal, says.

Also Read:- Netflix to roll out its games on TV soon with controller app on mobile

Bergeron, who also works for cybersecurity firm GoSecure, worked with colleague Olivier Bilodeau on this study. The two presented their findings Wednesday at the Black Hat cybersecurity conference in Las Vegas.

The two researchers classified pirates based on Dungeons and Dragons character types.

According to the two, "Rangers" carefully explored the hacked computers, conducted reconnaissance, sometimes changed passwords, and mostly left them as they were. "Our hypothesis is that they are evaluating the system they compromised so that another attacker profile can come back later," the researchers wrote in a blog post published Wednesday. to accompany their intervention.

According to the researchers, "Barbarians" use compromised honeypot computers to try to attack other computers using a list of known hacked usernames and passwords, sometimes use tools like Masscan, a legitimate tool that allows users to scan the entire Internet.

The "wizards" use honeypots as a platform to connect with other computers in order to hide the traces and true origin of their attacks. According to what Bergeron and Bilodeau wrote in their blog post, defense groups can gather threat intelligence for these hackers and "dig deeper into compromised infrastructure." import".

Also Read:- Uddhav Thackeray's Birthday: Looking at the Leadership of a Visionary Politician

According to Bergeron and Bilodeau, the "thieves" have the clear goal of making money from accessing these honeypots. They can do this by installing cryptocurrency miners, programs to perform click fraud, or directing fake traffic to sites they control and sell access to. into the honeypot itself for other hackers. Finally, "Bards" are hackers with little or no skill. These hackers used honeypots to use Google to search for malware and even watch porn. These hackers sometimes use mobile phones instead of desktops or laptops to log into honeypots. Bergeron and Bilodeau said they believe this type of hacker sometimes uses compromised computers to download pornography, which may be banned or censored in their countries.

In one case, a hacker "downloaded pornography and sent it to himself via Telegram. So that's basically breaking the nationwide ban on pornography," Bilodeau said. "What I think [the hacker] is doing with this thing is uploading it to an internet cafe, using Telegram, then he can put it on USB sticks and he can sell it."

Bergeron and Bilodeau conclude that the ability to observe hackers interacting with this type of honeypot can be very useful not only for researchers like them but also for law enforcement or defensive cybersecurity team — also known as the green team.

Also Read:- 'Urgent Call for PM Modi to Address the Crisis in Manipur', says Sanjay Raut

“Law enforcement agencies can legally intercept RDP environments used by ransomware groups and gather intelligence during recorded sessions for use,” the researchers wrote in the blog post. used in investigations”. "On the other hand, green teams can use [compromise metrics] and deploy their own traps to further protect their organization, as it will provide them with complete documentation on creating out opportunistic attackers."

Additionally, if hackers start to suspect that the servers they're infiltrating might be honeypots, they'll have to change their strategy and decide if the risk is worth it," leading to a slowdown that eventually will ultimately benefit everyone," according to the researchers.  

According to the conference held between the Black Hat cybersecurity conference that was held in Las Vegas that had mentioned that the porn was downloaded on the honeypots and was sending to his Telegram and was selling that.

Also Read:- Call of Duty to Undergo a Series Trojan in active Lobbies Online

The way the hacker uses to upskill the pornography can also led to the misconception between the communities and also can be very bad for the public and mainly for the children's that can affect them in a very bad manner and also can be distraction for them.