---
title: honeypot@Turris
url: 'https://www.ondrejsramek.cz/en/blog/honeypotturris'
markdown: 'https://www.ondrejsramek.cz/en/blog/honeypotturris.md'
lang: en
date: '2015-07-09'
description: "It's been a month since I activated the honeypots (ssh, telnet) on my Turris router. It didn't take even a day. In under a month I collected and sent the following data. Most popular username root — no one will be surprised. Percentage-wise that's 95% of all submitted login names. Most popular pass…"
taxonomy:
  category:
    - 'informační technologie'
    - práce
  tag:
    - bezpečnost
    - turris
    - útok
    - honeypot
    - ssh
    - telnet
  '':
    - ''
  archives_year:
    - '2015'
---

# It's been a month since I activated the honeypots (ssh, telnet) on my Turris router.

It didn't take **even a day**. In under a month I collected and sent the following data.

*Most popular username*

**root** — no one will be surprised. Percentage-wise that's 95% of all submitted login names.

*Most popular password*

**cisco** — almost 20%, which is quite a surprise. I was expecting one of: root (9%), admin (7%) or 123456 (3%)

*Most popular username+password combo*

**root**:**cisco**

*What the attacker usually wanted*

After logging in, a few things were typically checked: what kind of system it is and how much free RAM it has.

*Curiosities*

A **DDoS** script — my router could have been part of a large attack group without my knowledge.

An **IRC** server — someone apparently wanted to use my router as an IRC server to control a botnet. The attacker trying root:cisco was most likely a **machine** (probably an infected PC or router). I conclude this from the fact that it would always log in, check the architecture and available RAM, then leave. The connection lasted seconds — a human wouldn't do that. Attackers in recent days behave similarly: they log in, type ***echo -n test***, and leave.

More interesting findings can be found in the post [Who's poking around in the Turris ssh honeypot](http://blog.nic.cz/2015/07/13/kdo-nam-stoura-do-turrisiho-ssh-honeypotu)

 [ Previous Post](https://www.ondrejsramek.cz/en/blog/nikon-skola) [Next Post ](https://www.ondrejsramek.cz/en/blog/prenos-google-authenticator-na-jiny-telefon) 

#### Other Related Posts:

 [  bezpečnost  ](https://www.ondrejsramek.cz/en/blog/tag:bezpe%C4%8Dnost#blog_list) [  turris  ](https://www.ondrejsramek.cz/en/blog/tag:turris#blog_list) [  CZ.NIC  ](https://www.ondrejsramek.cz/en/blog/tag:CZ.NIC#blog_list) [  nastavení  ](https://www.ondrejsramek.cz/en/blog/tag:nastaven%C3%AD#blog_list) [  VPN  ](https://www.ondrejsramek.cz/en/blog/tag:VPN#blog_list) 

###  VPN@Turris 

[VPN@Turris](https://www.ondrejsramek.cz/en/blog/vpnturris)

# A recent Turris update added an OpenVPN entry to the menu.

Through it you can create a certificate authority (CA), configure a...

 25th May 2017 - ondra 

 [  bezpečnost  ](https://www.ondrejsramek.cz/en/blog/tag:bezpe%C4%8Dnost#blog_list) [  turris  ](https://www.ondrejsramek.cz/en/blog/tag:turris#blog_list) [  Omnia  ](https://www.ondrejsramek.cz/en/blog/tag:Omnia#blog_list) [  CZ.NIC  ](https://www.ondrejsramek.cz/en/blog/tag:CZ.NIC#blog_list) [  router  ](https://www.ondrejsramek.cz/en/blog/tag:router#blog_list) 

###  Turris Omnia 

[Turris Omnia](https://www.ondrejsramek.cz/en/blog/turris-omnia)

# I own a Turris — the first generation. And this is its successor.

I can no longer imagine using an off-the-shelf WiFi router....

 28th Oct 2016 - ondra 

- [Intro](https://www.ondrejsramek.cz/en)
- [Projects](https://www.ondrejsramek.cz/en/projects)
- [Portfolio](https://www.ondrejsramek.cz/en/portfolio)
- [Pricing](https://www.ondrejsramek.cz/en/pricing)
- [Blog](https://www.ondrejsramek.cz/en/blog)
- English 

    - [Čeština](https://www.ondrejsramek.cz/cs/blog/honeypotturris)

---

## Navigation

- Parent: [Blog](https://www.ondrejsramek.cz/en/blog.md)
- Previous: [Transferring Google Authenticator to a New Phone](https://www.ondrejsramek.cz/en/blog/prenos-google-authenticator-na-jiny-telefon.md)
- Next: [Nikon School](https://www.ondrejsramek.cz/en/blog/nikon-skola.md)