Sensors
Twelve doors. All of them fake.
Each service answers with real banners and versions, so bots go further than a port scan. It records what they do and runs none of it.
The twelve
Four families, one colour each.
The family sets the colour in the dashboard. The sensor name and icon tell them apart, so colour never carries meaning alone. The installer turns on six by default; --sensors all turns on all twelve.
- Remote shells
- Web and APIs
- Databases
- Windows and VoIP
Built for hostile traffic
Rules every sensor follows.
These are enforced by tests, not just written down.
- No execution. Fake commands return canned or generated output. Attacker input never reaches a real shell.
- No fetching. A download command only records the URL.
- No outbound traffic. A sensor accepts connections and never makes one.
- Bounded everything. Connection caps per sensor and per source, timeouts on every read, a size cap on every captured field.
- Its own door to the queue. Each sensor can only write to its own stream.
- Realistic identity. Plausible banners and host names. Nothing a client can see names the project.
- Hardened containers. Non-root, read-only, every capability dropped, with memory and process limits.
Payloads
Malware goes to quarantine. Never to a shell.
When a bot tries to download something, the sensor only writes down the URL. A separate collector can then fetch it, through the VPN, with size and time limits.
- Stored under its SHA-256, read-only, never executed.
- Static analysis only: file type, strings, YARA rules, script deobfuscation.
- The command servers it contacts are extracted and can be reported too.
- Off by default. You turn it on.
- sha256
- 4c1f9e0a…d27b5e83
- type
- ELF 32-bit, ARM
- from
- http://198.51.100.23/arm7
- fetched
- through the VPN tunnel
- yara
- mirai_generic (severe)
- c2
- 203.0.113.200:23
- state
- quarantined · mode 0400
Next
Put them on the internet.
Your router forwards the standard port of each service to the machine. The installer prints the exact table. Never forward the dashboard port or your own admin SSH port.