SSH Bot Reconnaissance Targets Capable Hardware for Cryptomining
A honeypot detected an SSH bot meticulously surveying system hardware before deploying a cryptominer, indicating a sophisticated, targeted approach to resource hijacking.
A SANS Internet Storm Center honeypot recently captured a novel attack pattern: an SSH bot that performs detailed hardware reconnaissance before deciding whether to deploy a cryptominer. Unlike typical bots that immediately download and execute payloads, this automated agent logged in as root, meticulously gathered system specifications, and then disconnected without leaving any malicious files. This deliberate reconnaissance phase suggests a more strategic approach by attackers, aiming to ensure their cryptomining operations are deployed only on systems with sufficient resources.
The honeypot, a Raspberry Pi 4 running the Cowrie SSH honeypot, recorded a brief session initiated by a bot from IP address 91.92.40.13. The bot successfully logged in as root using the weak password '123123' and executed two commands within approximately eight seconds. Notably, the SSH client identified itself as a Go program ('SSH-2.0-Go'), a common indicator of automated tools rather than human interaction. This brevity and self-identification strongly point towards an automated, targeted reconnaissance effort.
The bot's survey was comprehensive. It collected operating system and kernel versions, CPU architecture, core count, and CPU model. It also queried system uptime and recent login information. A key part of its investigation involved using lspci to specifically search for NVIDIA graphics cards. This detailed hardware inventory is crucial for attackers planning to deploy resource-intensive applications like cryptominers.
Following the hardware survey, the bot executed a second command to check if the system possessed more than 1 GB of RAM, reading /proc/meminfo and comparing it against a threshold. This check was performed using sudo -S, a method that attempts to pass the password back to sudo to elevate privileges without a prompt. This step likely aims to confirm the bot can achieve full root control before committing to a payload.
The combination of these checks—CPU details, specific GPU detection, minimum RAM, and root privilege confirmation—is a strong indicator of cryptomining or other resource-hijacking malware. Attackers want to maximize their return on investment by deploying miners only on systems capable of sustained, high-performance computation. This triage process ensures that less capable machines are not wasted.
This reconnaissance-first approach contrasts with other observed SSH bot activity. By analyzing the SSH client fingerprint, researchers could distinguish this mining-focused bot from a separate denial-of-service botnet campaign seen earlier in the month, even though both used weak passwords. This highlights the importance of detailed session analysis beyond just successful logins.
The implications for defenders are significant. A reconnaissance-only session, while not immediately damaging, is often the precursor to a more substantial attack. Dismissing these quiet sessions as harmless noise means missing a critical early warning sign. By understanding this pattern, security teams can prioritize and investigate such activities, potentially thwarting cryptomining operations before they begin.
Mitigation strategies remain consistent with general SSH security best practices: employing strong, unique passwords; disabling direct root SSH login in favor of key-based authentication; implementing rate-limiting with tools like fail2ban; and restricting SSH access to trusted networks or VPNs. Additionally, monitoring for bulk hardware discovery commands can serve as an effective alert for this type of targeted reconnaissance.