SSH Honeypots Fail to Detect Post-Login Attacks, Study Finds

Key Takeaways

• A new study reveals that SSH honeypots are largely ineffective at detecting automated, non-interactive post-login attacks.
• Researchers found that 99.23% of authenticated SSH sessions were non-interactive, executing a single command and disconnecting rapidly.
• This challenges the fundamental assumption that attackers engage with SSH systems via interactive shell sessions.
• Current honeypot designs, including LLM-powered versions, often fail to accurately respond to automated reconnaissance and verification probes.

Honeypots Overlook Most Post-Login SSH Attacks, Study Finds

Widely deployed SSH honeypots, a cornerstone of cyber defense deception strategies, are failing to capture the vast majority of real-world post-login attacker activities. This critical flaw stems from a fundamental misunderstanding of contemporary attacker methodologies, according to groundbreaking new research.

A study titled “Ghost Without Shell: Measuring Non-Interactive SSH Attacks on Honeypots” conducted by researchers from the Czech Technical University exposes that most threat actors do not engage with SSH systems through conventional interactive shell sessions. Instead, their approach is predominantly automated and non-interactive, executing commands instantaneously before disconnecting. This rapid, stealthy method renders many existing honeypots effectively blind to crucial attack behaviors.

The Disconnect: Automated Attacks vs. Interactive Honeypots

To arrive at their conclusions, the researchers deployed eleven high-interaction SSH honeypots across various cloud infrastructures for a period of 15 days. During this time, they logged an astonishing 177,622 authenticated sessions. The results were stark: an overwhelming 99.23% of these sessions were non-interactive. In contrast, only 0.10% involved interactive shell access, and file transfer attempts accounted for a mere 0.67%.

These findings were further corroborated by an independent analysis of a substantial dataset from the CZ.NIC Cowrie honeypot network, which confirmed the identical pattern on a larger scale. This validation underscores the widespread nature of the observed attacker behavior.

The core assumption underpinning much of SSH honeypot design is that attackers will log in and manually execute a series of commands within an interactive shell environment. Many contemporary honeypots, including those leveraging large language models (LLMs), are specifically engineered to simulate such realistic shell interactions, with their success often measured by metrics like attacker connection duration or the number of commands issued. However, the study unequivocally demonstrates that these metrics are increasingly irrelevant.

In the majority of observed cases, attackers authenticate, execute a single command using SSH’s ‘exec’ mode, and disconnect—all within less than a second. These commands are typically automated scripts designed for rapid reconnaissance or system verification rather than prolonged engagement. Common reconnaissance commands included system profiling queries such as uname, whoami, uptime, and nproc, which enable attackers to quickly assess the target environment.

The researchers identified over 9,000 distinct command strings, though a relatively small subset accounted for a significant portion of the activity, suggesting coordinated automated campaigns. More critically, the study highlighted the prevalence of verification probe commands specifically designed to differentiate between a legitimate system and a honeypot.

For instance, attackers employed tactics like base64 decoding or simple arithmetic operations, such as echo $((7*6)), to check if the system provided accurate responses. These tests proved particularly effective against LLM-based honeypots, which, while capable of generating plausible output, might still produce incorrect results for precise computational queries. The researchers documented over 2,000 such verification attempts. Some probes also sought known honeypot artifacts, like specific processes or writable system files, though these were less common.

Rethinking Honeypot Design and Evaluation

The implications of this research for cybersecurity are profound. Honeypots that exclusively focus on interactive shell sessions are likely capturing only a minuscule fraction of actual attacker behavior, leading to distorted insights and ineffective detection strategies. Furthermore, evaluating honeypot performance based on engagement duration or interaction depth no longer accurately reflects the modern threat landscape.

According to the Czech Technical University, SSH honeypots must evolve to adequately support non-interactive command execution and deliver accurate responses to these commands. The true measure of a honeypot’s success should shift from simulating human-like interaction to accurately mimicking a real host’s behavior under automated probing.

This study also points to a broader trend in attacker methodology: a pronounced shift towards automation and large-scale scanning. Rather than manually exploring compromised systems, threat actors are increasingly relying on scripts that perform rapid checks across thousands of targets simultaneously. This evolution necessitates a corresponding adaptation in deception strategies. Without embracing techniques that address non-interactive attacks, many honeypots risk becoming obsolete, offering only a narrow and outdated perspective of the evolving threat landscape.

What You Should Do

• Re-evaluate Honeypot Effectiveness: Assess your current SSH honeypot deployments to determine if they are capable of detecting and accurately responding to non-interactive command execution.
• Prioritize Accurate Responses: Ensure your honeypots provide correct and consistent responses to common system commands and verification probes, rather than just plausible ones.
• Monitor Non-Interactive Sessions: Implement logging and analysis specifically tailored to capture and interpret rapid, single-command SSH sessions.
• Update Threat Models: Adjust your threat intelligence and attacker profiles to account for the prevalence of automated, non-interactive SSH attacks.
• Consider Advanced Deception: Explore next-generation deception technologies that are designed to emulate real systems more robustly against automated reconnaissance.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.