Message-of-the-Day (MOTD) Banner Language Variations as an Adaptive Honeypot Deterrent of Unauthorized Access
Filipo Sharevski, Samuel Jevitz · 2021
This study investigates the effect of a Message-of-the-Day (MOTD) system banner, written in three languages: English, Russian, and Chinese, on deterring unauthorized access to publicly accessible systems. Banners have been used in both the physical and cyberspace realms as a method of signalling to trespassers that the defending entity is aware of, and directing against, malicious activity. We created a honeypot infrastructure with three ssh servers for each language variant, and measured the attempts of unauthorized access over a course of a regular week. The results suggest that the MOTD banner written in Russian attracted at least twice as many attempts of unauthorized access as the English and Chinese MOTD banners. The Russian MOTD banner received 38% of the attempts from US IP addresses with 3.710 failed password login attempts per session and 51% of the attempts from Chinese IP addresses with 2.958 failed password login attempts per session on average. This ratio, on the English MOTD banner, was US IP addresses: 52%, 3.986 failed password login attempts and Chinese IP addresses: 27%, 2.367 failed password login attempts. On the Chinese MOTD banner this ratio was US IP addresses: 48%, 2.568 failed password login attempts and Chinese IP addresses: 27%, 2.858 failed password login attempts. We discuss the implications of these results for incorporating language variations in MOTD banners as a deterrence strategy.