How to lure a Hacker?

Question

I am suspecting someone unauthorized is trying to or already in the network trying to get information on some data that we have. How can I lure this person to a "Honeypot" and gather information while they are connected to the network, and record the intrusions to better prosecute them for their doing.

Answer 1

If they are already in your network, just adding a honeypot may or may not be effective - you don't know what they already know of your network.

• Do they know the IP ranges for HR, finance, data storage systems etc?
• Do they have access to your change management system and would spot a new addition to the network?
• Have they already backdoored the servers with the data they want?
• Have they already got the information they need?

At this stage if the data is important, you may find it more useful to change access and remove them from your network, rather than try and track them.

Alternatively, if you know where this important data is, you don't need a honeypot - what you need is to closely monitor all activity and see whether any unusual connections are being made.

What has inspired your suspicions? If it was seeing something odd on your network logs, that would be a good place to start.

Generally, honeypots are useful before an intrusion, as they stop or slow an intruder before they get to your data, giving you a chance to identify or block them.

Answer 2

"Luering" is an activity that might require legal advice.

Setting traps is simple, but you may want to start or improve logging procedures in order to aid law enforcement build a good audit trail.

Answer 3

I have often thought about doing this to the vast amounts of failed attempts to login to my SSH server; I've never done it but you could do something like so:

• After 'x' amount of failed login attempts from 'IP' start forwarding attackers packets to new server (virtual server ;)) and automatically give them access (e.g. a honeypot).

I don't do this because it serves no point; they think they got in when in reality I just let them in, and on top of that once they find out its a honey-pot you've only just smacked the hornets nest.