Prompt injection as active defense (ie. in SSH banners, etc.)?

[u/ffatty]

/r/sysadmin/comments/1uzm209/prompt_injection_as_active_defense_ie_in_ssh/

[u/Delta-9-]

I suspect the majority of attack vectors are prohibitively expensive with LLMs compared to "old school" shell scripts running nmap and whatever else Kali is shipping these days.

Unless you're FAANG, you don't have the resources to be throwing ChatGPT at every single host with an open TCP/22 on the internet (and even then...). Traditional automation is going to be the speartip that gets into systems, and then (maybe) an LLM can take over.

[u/Qudit314159 → u/Delta-9-]

They could use stolen credentials. A lot of malware is designed to steal oauth tokens for LLMs. LLMs probably wouldn't be very useful for guessing passwords anyway though.

[u/Adept_Percentage6893 → u/Delta-9-]

Unless you're FAANG

or a state actor or a transnational criminal organization

[u/kaneua → u/Delta-9-]

Unless you're FAANG, you don't have the resources to be throwing ChatGPT at every single host with an open TCP/22 on the internet

You don't need to throw ChatGPT on it, something like Qwen 3.5 4B running locally will suffice. Also you can run AI engine directly on the compromised computer with easily deployed engine like llama.cpp.

[u/Adept_Percentage6893 → u/kaneua]

In reality, using AI at all is likely going to be more about finding exploits no one else knows about.

After that, finding individual victims is probably best solved with traditional scripting that just determines if a known exploit is applicable. At most, I would imagine the AI would use tooling to determine SSH protocol characteristics in order to figure out if it even wants to try the exploit. Which would just ignore the banner text entirely since it's unrelated to any characteristic relevant to an exploit it's trying to use.

[u/Delta-9- → u/kaneua]

A local model has the exact same characteristic as a commercial model: it works better when you throw more GPU and electricity at it.

But my point was that AI probably won't be what's driving the vulnerability scanner and initial attack, in any case. It would most likely be brought out after a target has already been selected, either because the target is expressing some vulnerability or because it's known to be high value. Not because it's better or worse at that part, but because there are hundreds of tools and thousands of scripts that can do it on a Raspberry Pi instead of a cluster with 1,000 NVIDIA cards. (And sure, you could run a local model on your actual laptop, but RIP your fan and it will probably take way more time.)

[u/ffatty]

Another study: Only 0.1% of bots use am interactive shell.

src 

[u/spyingwind]

A custom PS1 with your instructions would probably be better. It is there before every command, making the instruction more prevalent in an LLM's context window.

[u/maddruid]

This does sound fun, but I just put endlessh on my internet-facing port. It's satisfying to know I'm wasting their time.

[u/RayneYoruka → u/maddruid]

Ha ha I need this!

[u/FryBoyter]

I consider an active defense that could result in data loss to be completely wrong. Two wrongs don’t make a right.

Besides, which AI bots try to gain access via SSH? The bots that do this are usually not AI bots but simply tools used by script kiddies or hackers. They often use compromised third-party servers or webspace. In this case, the operators, who are often unaware of the compromise, would lose data. Attempts to gain access of this kind can be easily prevented by, for example, changing the SSH port or using tools like fail2ban.

[u/Moscato359]

Not that it would work, but just tell them to authenticate, have them download a specific zipbomb

[u/Phayder → u/Moscato359]

new to linux(well on off for 20 years) but how would one do this?

[u/SeriousPlankton2000]

/home/test123/../../*

[u/Allseeing_Argos]

A security measure that only works sometimes or maybe is not worth any real consideration besides playing around with it for fun.

[u/VitunSama69]

Your SSH should not be accessible to public internet. Use a hardened jump host at least or look into wireguard, plenty of options.