Real industrial FTP services are used for specific purposes — firmware updates, PLC program uploads, configuration files, and recipe transfers. An attacker who discovers an exposed industrial FTP service may attempt to upload tools or malware, or download what they believe are legitimate device files.
Currently otpot accepts FTP/TFTP connections but does not safely capture or analyze uploaded files.
Proposed behavior:
- Capture all uploaded files to a dedicated safe directory outside the VFS
- Hash each file (SHA256) on receipt and log with source IP, timestamp, and filename
- Classify uploads by extension —
.bin, .hex, .L5X, .RSS, .ACD (Rockwell), .s7p, .ap1 (Siemens), .exe, .sh etc.
- Log classification alongside the capture — "attempted firmware upload" vs "attempted malware delivery" tells a different story
- Optional VirusTotal lookup via API key for executable files
- Configurable upload size limit to prevent abuse
- Present realistic downloadable decoy files — a fake
firmware.bin, a fake config.ini, a fake ladder logic file — to encourage attackers to reveal download intent
Why OT classification matters:
An attacker uploading a .L5X file (Rockwell Studio 5000 export format) to an EtherNet/IP honeypot has revealed specific, targeted intent against Allen-Bradley infrastructure. That is fundamentally different threat intelligence than a generic malware upload.
Reference: Similar to Cowrie's artifact capture for SSH, adapted for the OT file transfer context.
Real industrial FTP services are used for specific purposes — firmware updates, PLC program uploads, configuration files, and recipe transfers. An attacker who discovers an exposed industrial FTP service may attempt to upload tools or malware, or download what they believe are legitimate device files.
Currently otpot accepts FTP/TFTP connections but does not safely capture or analyze uploaded files.
Proposed behavior:
.bin,.hex,.L5X,.RSS,.ACD(Rockwell),.s7p,.ap1(Siemens),.exe,.shetc.firmware.bin, a fakeconfig.ini, a fake ladder logic file — to encourage attackers to reveal download intentWhy OT classification matters:
An attacker uploading a
.L5Xfile (Rockwell Studio 5000 export format) to an EtherNet/IP honeypot has revealed specific, targeted intent against Allen-Bradley infrastructure. That is fundamentally different threat intelligence than a generic malware upload.Reference: Similar to Cowrie's artifact capture for SSH, adapted for the OT file transfer context.