cat /bin/echo
Two sessions ran cat /bin/echo immediately after login to read the ELF machine-type field and identify the server's CPU architecture. No uname or compiler needed — the architecture byte sits at offset 18 in a file that exists on every Linux system.
No uname, no compiler. They read /bin/echo to fingerprint the CPU.
Architecture detection usually means running uname or checking /proc/cpuinfo. These two sessions used neither.
After login, command one: echo one, redirected to dev null — a shell test. Command two: cat the echo binary. That dumps it to standard output. The attacker reads the ELF header from the stream: at offset eighteen, the machine field identifies the architecture. Sixty-two means x86 sixty-four. One eighty three means ARM sixty-four. No tool invoked, no child process. Just a file read.
The echo binary never changes and is expected on every Linux system. A read of it does not appear in most detection rule sets.
That is why architecture detection by file read is harder to catch than uname.
#linux#security#ssh#honeypot#sysadmin
❯ That is why architecture detection by file read is harder to catch than uname.