a system designed to lure attackers towards it in order to learn about new attacks or to draw attention away from the real system

learn more… | top users | synonyms

1
vote
1answer
49 views

Is there a Service to setup a Honey Pot URL to collect user IP + other data? [on hold]

Being the paranoid user I am. I always think I have an infected computer with trojans or malware or prying eyes to my work computer. I was wondering is there a service that lets you create a honey pot ...
23
votes
4answers
4k views

Is it possible to detect a honeypot? [closed]

Do techniques exists to know if a machine is a honeypot (or suspicious indicators)? What techniques can be used for a software inside the honeypot or outside it? What techniques uses malware to ...
1
vote
0answers
52 views

Host-based security architecture for web server network

I am begining with network security and after studying for a while about often used technologies I got to this architecture for my home server (sorry it is not in english). I considered 3 basic ...
1
vote
1answer
82 views

running botnet for analysis

I a very curious to understand botnets practically. I want to run a p2p botnet (storm or waledac) for analysis and learning. I have mainly two issues: Where can i get access to binaries of either ...
2
votes
1answer
70 views

What is the current U.S. law regarding the building of and deployment of honeypots? [closed]

I have lots of links to information on the topic that I've gathered published since the mid-2000s and this SANS document has always been my goto: ...
1
vote
1answer
84 views

How could honeypot be vulnerable?

We've been hacked for the 2nd time without knowing how/who did it. Luckily we were able to shutdown everything! We're trying to deploy Honeypot to be in control of what is going on from our local ...
3
votes
0answers
82 views

What is the alternative tool for Honeypots? [closed]

Nowadays the tools of Honeypots are not reliable as before, because an attacker with some knowledge can detect it and override its power. So if I want something with the same characteristics as the ...
6
votes
2answers
904 views

Know of any HTTP tarpits/blackholes to use for redirecting malicious traffic?

So I cleaned up some malicious PHP scripts from a client's site and I've been monitoring for follow up connections to the scripts. Of course, I've found a LOT of IPs requesting the files. Too many ...
0
votes
1answer
66 views

Kippo graph Human Activity. What is it?

So I was running a Kippo honeypot. In Kippo graph there is a diagram tilted "Human activity" (see attached photo). What does it mean? Does it mean that, for example, on 21-11-2014 90 real attackers ...
2
votes
1answer
72 views

Allowing root login, but denying any actual logins

A friend told me a few months ago about an audit where he discovered root logins were enabled via SSH. This obviously ended up on the report, but when questioned the admin told him that he had set up ...
4
votes
2answers
126 views

How do honeypots remain secure to 0days and newer exploits?

If honeypots are designed for a specific set of exploits, such as SQL injection and XSS, how do they protect themselves against other exploits? For instance, if I created a honeypot a few months ago, ...
1
vote
1answer
60 views

How to configure routing infrastructure so that the appropriate network traffic gets passed to the honeypot machine (windows xp)

I would like to configure local honeypot on windows xp which is installed on vmware, to do so I follow instruction on this link, but as I am new I don't know how can I configure routing infrastructure ...
3
votes
1answer
195 views

Honeyd Isn't Detecting Loud Scans [closed]

I've got the Honeyd honeypot in one virtual machine (kali) and nmap in another (ubuntu), the config file looks like this: create default set default default tcp action closed set default default udp ...
0
votes
1answer
154 views

Can a hacker who has entered a virtual honeypot attack a LAN?

Is it possible for a hacker who has entered a honeypot (running in a virtual machine e.g. virtualbox), to attack real computers on a LAN?
4
votes
1answer
132 views

Where to submit collected malware from my honeypot?

wondering if you could help me. i setup the Dionaea honeypot and have collected 6 or 7 malware files. Unfortunately upon checking the Dionaea logs it keeps giving the error "Couldn't resolve host" for ...
0
votes
2answers
348 views

Create honeypot for remote desktop applications

Due recent breaches that have occurred using weak remote access application passwords. I would like to setup my own honey pot on a windows machine to study their malicious intents. This is pretty easy ...
1
vote
4answers
310 views

Are computers on same network as honeypot safe?

If a computer is setup as a honeypot and is on the same LAN with other computers, could other computers be attacked? My thought is that if an attacker infects a honeypot with a worm, this worm would ...
1
vote
2answers
127 views

How can Joe Citizen report or at least hamper a phone-based PC scammer?

Within the last week, I've received 3 phone calls at 3 different locations from technicians who are calling "from Microsoft" about "Windows problems" that they've detected on my PC. Which they ...
1
vote
0answers
117 views

Anyone seen weird messages in their logs?

I've been reading over the logs on my honeypot and discovered the following messages that seem to be either gibberish or a cypher message: kernel: v0 neigfradn tt kernel: [2108296.63083] devc nt nee ...
31
votes
5answers
5k views

Is a honeypot an effective deterrent to hackers successfully compromising your network?

According to Microsoft, adding a honeypot to your corporate network is an effective way to deter hackers from compromising your network. Aren't honeypots more for research purposes and not ideal for ...
0
votes
2answers
468 views

honeyd is still a good alternative?

I've been investigating to deploy a honeypot for research purpose, Honeyd seems like the most popular and adequate option to my needs, but it seems too old, the last version of this software was ...
1
vote
3answers
260 views

Simple Windows 7 honeypot: is this safe?

I want to share a "honeypot" folder on a Windows 7 machine connected to a router. The only shared folder in the local workgroup connected to this router is the honeypot folder, which allows ...
0
votes
1answer
148 views

compromising DVRs to become bitcoin mining bot [duplicate]

I read this article, about an exploit which highjacks a DVR to become a "bitcoin mining bot". The heart of the attack is to send a binary using just echo comands to the device, which acts as a ...
-1
votes
1answer
69 views

Simulation of security against IP [closed]

I am pursuing a college project, in which I am running three fake services on three ports to protect the main service (say running at port 80). The concept is that if the user is malicious, he'll try ...
1
vote
0answers
78 views

Suppressing broadcast traffic in honeyd logs?

I'm trying to set up a honeyd system. How can I suppress the broadcast traffic seen by the outside interface, preferably without needing to resort to syslog filters? User subnet 192.168.20.0/24, ...
1
vote
2answers
309 views

Security against IP Spoofing

I am pursuing a college project, in which I am running three fake services on three ports to protect the main service (say running at port 80). The concept is that if the user is malicious, he'll try ...
1
vote
1answer
117 views

Making a content injection target [closed]

I don't know much about content injection so I'm hoping to draw on the experience of the community here. I'm writing a tool that evaluates public web proxies. I want to know if the proxies are being ...
6
votes
2answers
1k views

Does WPA2 Enterprise mitigate evil twin attacks?

One of the dangers of using WPA2-PSK is the possibility that an attacker may setup another wireless network with the same SSID and even use the same access point MAC address via MAC spoofing. The ...
2
votes
2answers
213 views

Transparent way to send logs from honeypot to logging server

Does anyone know of a secure and transparent method of sending logs from a honeypot server on a DMZ to a logging server in a private network?. The logs must be encrypted and sent in such a way that a ...
2
votes
3answers
4k views

How do I setup honeypot server on Windows 7?

Background I would like to setup a honeypot server on a Windows 7 PC. My system is not part of a network and I don't run a server. I have a Windows 7 desktop PC. It's Home Premium Anytime Upgrade ...
2
votes
2answers
549 views

Suricata IPS rules for honeypot

I have a really simple high interaction honeypot and I have just installed a VM as an IPS (suricata) with a transparent bridge between my router and the honeypot. The setup looks something like this: ...
4
votes
1answer
219 views

High Interaction Honeypot design

I've been writing a high interaction honeypot which has required some interesting design decisions, for instance I want the honeypot to get attacked not the underlying infrastructure/ software. Fun ...
8
votes
4answers
736 views

Do honeywords add any real security?

This paper proposes the concept of honeywords for detecting if a password database has been compromised. As far as I understand it works like this: You save n password hashes for each user, one that ...
5
votes
1answer
879 views

Setting up home lab with Snort and Vyatta - looking for resource recommendations or advice

I'm looking to turn a new desktop (Ubuntu 12.10-64bit) I built into a virtual home lab for testing and experimenting with various security things. The first setup I would like to try running is the ...
2
votes
3answers
347 views

How to lure a Hacker?

I am suspecting someone unauthorized is trying to or already in the network trying to get information on some data that we have. How can I lure this person to a "Honeypot" and gather information while ...
13
votes
4answers
1k views

Attract Brute Force SSH Attacks

I posted a question on Server Fault, but got downvoted and had the question closed. One of the comments suggested looking over here, so here goes: For my senior project, I'm working on an ...
5
votes
3answers
1k views

Honeyd: log grows too fast

I'm having trouble with honeyd log; it grows way too fast. I started the honeyd daemon with honeyd -l /var/log/honeypot/honey.log -u 1000 -g 1000 -f honeyd.conf /var/log/honeypot/honey.log is 1+ ...
7
votes
2answers
952 views

Risks of running Honeypot [specific setup]

I'm planning to run a Honeypot with the following network setup: In order to avoid the honeypot coming in direct contact with my Internal network, I put it behind a firewall configured on a Linux ...
4
votes
3answers
643 views

Are honeypots successful in preventing attacks?

I've been looking to set up a honeypot, but it seems that honeyd's source code is out of date, and there are few other options. Which brings me to the question, does anyone employ honeypots as a ...
3
votes
1answer
572 views

How do you analyze the data collected from honeypot software?

So you've successfully setup a honeypot. GREAT! Now what?! I've got all this amazing data but; How do you analyze all the data collected from your honeypot software? What should you be looking for? ...
2
votes
1answer
2k views

How to set up a network for a honeypot?

This is a follow up for How to set up a Virtual Machine for a Honeypot?. After setting up your Virtual Machine. You need to make sure that your network is properly configured so you don't end up ...
2
votes
1answer
2k views

How to set up a Virtual Machine for a Honeypot?

On this thread, it's stated that it's probably a good idea to use a VM for your honeypot. I believe this is because; Comparative data is easier when comparing 2 exact images. Host/Network Security ...
11
votes
2answers
387 views

Profiling hackers with keystroke dynamics

I am writing a research paper on tracking hackers and how to include keystroke timings to create a profile of hackers. I want to combine the keystroke timings that I capture in ttylog with other data ...
3
votes
1answer
319 views

How to forward an specific FTP User to a Honeypot?

What I'm trying to do is to forward a specific FTP-User to a Honeypot, because the main server is for Shared Hosting and there's a lot of traffic, and I don't want to spend all the resources in ...
1
vote
1answer
1k views

Is a honeypot an IDS or an IPS or something else? Is it an offensive or a defensive technique? Is it still effective?

I'd like to know where a Honeypot falls into the scheme of security, and if it is still an effective tool?
1
vote
0answers
258 views

Honeypot for catching a spammer [closed]

I've been receiving more and more emails and now even TXT messages originating from google voice for inquiries of items that I've listed for sale on craigslist. What I would like to accomplish: I ...
2
votes
2answers
768 views

Interesting article on a vulnerability found in Tor

This article describes how French researchers compromised users using Tor. I'm not sure I fully understand or agree with it. I don't see what Bit Torrent has to do with anything? I mean they start out ...
1
vote
2answers
527 views

Can a TCP connection with a VM be “escaped from” to reach the host? [duplicate]

Possible Duplicate: How secure are virtual machines really? False sense of security? If a VM (e.g. VirtualBox) on host A opens a TCP connection to a hacker Z, are there any possible ...
1
vote
3answers
3k views

Tracing an IP from a mobile broadband ISP

My honeypot caught a hack attempt from an IP that was issued by Three Mobile Broadband (UK). My immediate thought was that most probable explanation was that the user was in the UK and had his ...
16
votes
3answers
7k views

Can someone get my WPA2 password with honeypots?

Yesterday I went to my cousin's home and I saw that I'm not connected to his wireless (for internet access). Then I have looked up the list of wireless points. I have found his name and clicked it ...