The Mirebox Story
The door locks
behind you.
Recovered from a SOC at three in the morning, when nobody was watching.
The door locks behind you.
The first thing Voss noticed about the box was that it wasn’t trying to hide.
If you’re reading this, you took a wrong turn correctly.
It sat on the third subnet at an address nobody had assigned, listening on a port that didn’t appear in any scan he’d run, and yet there it was the moment he stopped looking. Open. Waiting. Banner blank.
He fingerprinted it. The response came back in characters that weren’t quite ASCII, in a header order that was technically valid and obviously wrong. He saved the pcap. He ran it again. The header order was different. Same wrong.
“Honeypot,” he said, out loud, to no one. He had been alone in the SOC for six hours.
He shouldn’t have touched it. That was rule one with anything that smelled like a trap, and the box smelled like a trap the way a swamp smells like a swamp. But he’d seen honeypots. He’d built honeypots. He knew what they looked like from the outside, and this was the outside of something else.
He sent a single TCP SYN.
Step inside. Mind your shoes.
The box replied with his own packet, byte for byte, except the source IP was now its own.
He sat back.
Over the next forty minutes he tried six things. Each one came back wearing his own face. By the seventh he understood, in the way you understand things at three in the morning when nobody is watching, that the box was not a honeypot. A honeypot is a place where attackers go to get caught.
This was a place where attackers went.
He logged the address, screenshotted everything, and closed the laptop. In the morning he opened it to write the report and found his SSH keys had been quietly replaced with new ones, the fingerprints of which matched no machine he had ever owned. His shell history was clean. The pcap was a single packet long. It contained the word MIREBOX in plain text, followed by a question mark, as if the box were asking, and not telling.
He did not answer.
Three weeks later, the next analyst on rotation noticed an unassigned address on the third subnet, listening on a port that didn’t appear in any scan, and started typing.
Hello. We’ve been expecting you.