Huginn 0.37.0: VirusTotal, MalwareBazaar and GreyNoise lookups, Engagement page, review fixes

Only the Huginn machine needs updating. The honeypot side is unchanged since 0.30.

New

• Outside lookups. VirusTotal verdicts for captured files (only the SHA-256 is sent, never the file), MalwareBazaar family names and tags, and GreyNoise for attacker addresses: is it a known mass scanner, and a benign one? Benign scanners count as research unless they logged in or ran something. All three keys can be pasted on the Settings page (Lookups), where they are tested and never shown again. Each service has its own daily allowance and pauses itself when it is used up.
• Engagement page. How far attackers get once they are in, day by day: left at once, proxy only, ran commands, went for a payload, sessions typed by hand, median stay, new or returning. Compare before and after a release.
• Terminal size of each session (most bots report 240×24).
• Help page and tooltips on every tag. Shortcut g h.

Fixed (deep security and bug review)

• A pasted chmod line with thousands of digits could make the attacker page slow (regex backtracking). The regex is bounded and the ATT&CK scan reads at most 64 KB of commands per page.
• The decoy cap never drops a web attack, a bait hit or a login with a new kind of password, and knows rows by their content, so two hits in the same second both count and a resent line is never counted twice.
• Lookups never follow redirects and only use HTTPS, so a key only ever goes to its own service.
• A changed GreyNoise answer takes the research mark off again; web exploits and bait use always keep an attacker on the blocklist.
• A collection source that stopped stays alerted for 30 days instead of two.
• MalwareBazaar copes with odd answers and pauses on a refused key.
• Engagement counts late commands of long sessions and uses a true median; the timeline always shows the newest activity; Files is faster.

Upgrade

sudo ./update-huginn.sh from the new source (backup and automatic rollback), apt install ./huginn_all.deb, or docker compose pull && docker compose up -d. Without a GreyNoise key Huginn now asks at most 20 addresses a day (HUGINN_GREYNOISE_DAILY overrides).