A while back, on a Linux system, I found a strange binary being executed at seemingly random times with some strange arguments, briefly appearing in ps. There was nothing to be found at the usual suspect like init.d, .bashrc and crontab. I found where the binary was located, renamed it, and put a script it its place. The script displayed and passed through all the received arguments and recorded the time and the duration of the binary execution, as well as some /proc information. I was able to figure out what called it, when, and what were the arguments. What is the name of this honeypotting, MITM technique?

  • 1
    Are you able to share the binary – julian Apr 12 '17 at 20:32
  • Logging the occurrences of the bit happening in a way you cannot understand is called using brains :D – Vitaly Osipov Apr 13 '17 at 5:32
  • In TDD, people tend to call components like this a Spy. I think in this context you're pretty right when you name it honeypotting or MITM. – Nordwald Apr 13 '17 at 8:27

This site is temporarily in read only mode and not accepting new answers.

Browse other questions tagged .