Hello and welcome to the Thursday, April 9th, 2026 edition of the Sands Internet Storm Center's Stormcast. My name is Johannes Ulrich, recording today from Jacksonville, Florida. And just as a reminder that there will be no Friday podcast due to my travel schedule.

And this episode is brought you by the sands.edu credit certificate program in industrial control

system security. Well, in diaries today, I wrote a little bit about how attackers are attempting to fingerprint

honeypots, in particular the honeypots we are using, like the little Python script, we use

to emulate web applications, and Cowry, of course, that is being used to emulate Telnet and SSH.

Well, those kind of honeypots are often considered medium interaction honeypots,

meaning that they try to emulate particular warnable or non-warnable devices,

but are of course far from perfect, and that makes it relatively straightforward to fingerprint them

and making sure that a particular device is a honeypot.

Now, one trick that this particular attacker, researchers, wherever it was, did employ,

was to use a name passport combinations that would definitely not show up in a normal system. So, for example, well, the username was admin

and the password then definitely not valid. Krets or usernames like Honeypotten, Honey Potter.

The idea behind this is that, for example, Cowrie that we're using to emulate Telnet and SSH,

well, it will sort of

randomly accept username and password combinations. So it will not just accept very specific

ones, but ever so often, will let, uh, basic, an attacker in no matter what username and

password they're using to see what commands they may be executing. And that's what they're

looking for if they're looking for. If they're

able to actually log in with a username like Honey Potter, well, they assume then that they are

connected to a Honeypot, which is a fairly fair assumption. Are we working on making a little bit

harder to fingerprint honeypots?

Yes, we always sort of log into this and may actually be adding some features to sort of, you know,

...