A while back, on a Linux system, I found a strange binary being executed at seemingly random times with some strange arguments, briefly appearing in ps. There was nothing to be found at the usual suspect like init.d, .bashrc and crontab. I found where the binary was located, renamed it, and put a script it its place. The script displayed and passed through all the received arguments and recorded the time and the duration of the binary execution, as well as some /proc information. I was able to figure out what called it, when, and what were the arguments. What is the name of this honeypotting, MITM technique?

  • 1
    Are you able to share the binary – julian Apr 12 '17 at 20:32
  • Logging the occurrences of the bit happening in a way you cannot understand is called using brains :D – Vitaly Osipov Apr 13 '17 at 5:32
  • In TDD, people tend to call components like this a Spy. I think in this context you're pretty right when you name it honeypotting or MITM. – Nordwald Apr 13 '17 at 8:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.