a system designed to lure attackers towards it in order to learn about new attacks or to draw attention away from the real system

learn more… | top users | synonyms

1
vote
0answers
36 views

Host-based security architecture for web server network

I am begining with network security and after studying for a while about often used technologies I got to this architecture for my home server (sorry it is not in english). I considered 3 basic ...
2
votes
1answer
65 views

running botnet for analysis

I a very curious to understand botnets practically. I want to run a p2p botnet (storm or waledac) for analysis and learning. I have mainly two issues: Where can i get access to binaries of either ...
2
votes
1answer
51 views

What is the current U.S. law regarding the building of and deployment of honeypots? [closed]

I have lots of links to information on the topic that I've gathered published since the mid-2000s and this SANS document has always been my goto: ...
1
vote
1answer
71 views

How could honeypot be vulnerable?

We've been hacked for the 2nd time without knowing how/who did it. Luckily we were able to shutdown everything! We're trying to deploy Honeypot to be in control of what is going on from our local ...
3
votes
0answers
76 views

What is the alternative tool for Honeypots? [closed]

Nowadays the tools of Honeypots are not reliable as before, because an attacker with some knowledge can detect it and override its power. So if I want something with the same characteristics as the ...
6
votes
2answers
881 views

Know of any HTTP tarpits/blackholes to use for redirecting malicious traffic?

So I cleaned up some malicious PHP scripts from a client's site and I've been monitoring for follow up connections to the scripts. Of course, I've found a LOT of IPs requesting the files. Too many ...
0
votes
1answer
64 views

Kippo graph Human Activity. What is it?

So I was running a Kippo honeypot. In Kippo graph there is a diagram tilted "Human activity" (see attached photo). What does it mean? Does it mean that, for example, on 21-11-2014 90 real attackers ...
2
votes
1answer
70 views

Allowing root login, but denying any actual logins

A friend told me a few months ago about an audit where he discovered root logins were enabled via SSH. This obviously ended up on the report, but when questioned the admin told him that he had set up ...
4
votes
2answers
116 views

How do honeypots remain secure to 0days and newer exploits?

If honeypots are designed for a specific set of exploits, such as SQL injection and XSS, how do they protect themselves against other exploits? For instance, if I created a honeypot a few months ago, ...
1
vote
1answer
55 views

How to configure routing infrastructure so that the appropriate network traffic gets passed to the honeypot machine (windows xp)

I would like to configure local honeypot on windows xp which is installed on vmware, to do so I follow instruction on this link, but as I am new I don't know how can I configure routing infrastructure ...
3
votes
1answer
178 views

Honeyd Isn't Detecting Loud Scans [closed]

I've got the Honeyd honeypot in one virtual machine (kali) and nmap in another (ubuntu), the config file looks like this: create default set default default tcp action closed set default default udp ...
0
votes
1answer
143 views

Can a hacker who has entered a virtual honeypot attack a LAN?

Is it possible for a hacker who has entered a honeypot (running in a virtual machine e.g. virtualbox), to attack real computers on a LAN?
4
votes
1answer
123 views

Where to submit collected malware from my honeypot?

wondering if you could help me. i setup the Dionaea honeypot and have collected 6 or 7 malware files. Unfortunately upon checking the Dionaea logs it keeps giving the error "Couldn't resolve host" for ...
0
votes
2answers
305 views

Create honeypot for remote desktop applications

Due recent breaches that have occurred using weak remote access application passwords. I would like to setup my own honey pot on a windows machine to study their malicious intents. This is pretty easy ...
1
vote
4answers
293 views

Are computers on same network as honeypot safe?

If a computer is setup as a honeypot and is on the same LAN with other computers, could other computers be attacked? My thought is that if an attacker infects a honeypot with a worm, this worm would ...
1
vote
2answers
124 views

How can Joe Citizen report or at least hamper a phone-based PC scammer?

Within the last week, I've received 3 phone calls at 3 different locations from technicians who are calling "from Microsoft" about "Windows problems" that they've detected on my PC. Which they ...
1
vote
0answers
113 views

Anyone seen weird messages in their logs?

I've been reading over the logs on my honeypot and discovered the following messages that seem to be either gibberish or a cypher message: kernel: v0 neigfradn tt kernel: [2108296.63083] devc nt nee ...
31
votes
5answers
4k views

Is a honeypot an effective deterrent to hackers successfully compromising your network?

According to Microsoft, adding a honeypot to your corporate network is an effective way to deter hackers from compromising your network. Aren't honeypots more for research purposes and not ideal for ...
0
votes
2answers
418 views

honeyd is still a good alternative?

I've been investigating to deploy a honeypot for research purpose, Honeyd seems like the most popular and adequate option to my needs, but it seems too old, the last version of this software was ...
1
vote
3answers
231 views

Simple Windows 7 honeypot: is this safe?

I want to share a "honeypot" folder on a Windows 7 machine connected to a router. The only shared folder in the local workgroup connected to this router is the honeypot folder, which allows ...
0
votes
1answer
145 views

compromising DVRs to become bitcoin mining bot [duplicate]

I read this article, about an exploit which highjacks a DVR to become a "bitcoin mining bot". The heart of the attack is to send a binary using just echo comands to the device, which acts as a ...
-1
votes
1answer
64 views

Simulation of security against IP [closed]

I am pursuing a college project, in which I am running three fake services on three ports to protect the main service (say running at port 80). The concept is that if the user is malicious, he'll try ...
1
vote
0answers
78 views

Suppressing broadcast traffic in honeyd logs?

I'm trying to set up a honeyd system. How can I suppress the broadcast traffic seen by the outside interface, preferably without needing to resort to syslog filters? User subnet 192.168.20.0/24, ...
1
vote
2answers
305 views

Security against IP Spoofing

I am pursuing a college project, in which I am running three fake services on three ports to protect the main service (say running at port 80). The concept is that if the user is malicious, he'll try ...
1
vote
1answer
109 views

Making a content injection target [closed]

I don't know much about content injection so I'm hoping to draw on the experience of the community here. I'm writing a tool that evaluates public web proxies. I want to know if the proxies are being ...
6
votes
2answers
1k views

Does WPA2 Enterprise mitigate evil twin attacks?

One of the dangers of using WPA2-PSK is the possibility that an attacker may setup another wireless network with the same SSID and even use the same access point MAC address via MAC spoofing. The ...
2
votes
2answers
204 views

Transparent way to send logs from honeypot to logging server

Does anyone know of a secure and transparent method of sending logs from a honeypot server on a DMZ to a logging server in a private network?. The logs must be encrypted and sent in such a way that a ...
2
votes
3answers
3k views

How do I setup honeypot server on Windows 7?

Background I would like to setup a honeypot server on a Windows 7 PC. My system is not part of a network and I don't run a server. I have a Windows 7 desktop PC. It's Home Premium Anytime Upgrade ...
2
votes
2answers
529 views

Suricata IPS rules for honeypot

I have a really simple high interaction honeypot and I have just installed a VM as an IPS (suricata) with a transparent bridge between my router and the honeypot. The setup looks something like this: ...
4
votes
1answer
214 views

High Interaction Honeypot design

I've been writing a high interaction honeypot which has required some interesting design decisions, for instance I want the honeypot to get attacked not the underlying infrastructure/ software. Fun ...
8
votes
4answers
727 views

Do honeywords add any real security?

This paper proposes the concept of honeywords for detecting if a password database has been compromised. As far as I understand it works like this: You save n password hashes for each user, one that ...
5
votes
1answer
843 views

Setting up home lab with Snort and Vyatta - looking for resource recommendations or advice

I'm looking to turn a new desktop (Ubuntu 12.10-64bit) I built into a virtual home lab for testing and experimenting with various security things. The first setup I would like to try running is the ...
2
votes
3answers
346 views

How to lure a Hacker?

I am suspecting someone unauthorized is trying to or already in the network trying to get information on some data that we have. How can I lure this person to a "Honeypot" and gather information while ...
13
votes
4answers
1k views

Attract Brute Force SSH Attacks

I posted a question on Server Fault, but got downvoted and had the question closed. One of the comments suggested looking over here, so here goes: For my senior project, I'm working on an ...
5
votes
3answers
1k views

Honeyd: log grows too fast

I'm having trouble with honeyd log; it grows way too fast. I started the honeyd daemon with honeyd -l /var/log/honeypot/honey.log -u 1000 -g 1000 -f honeyd.conf /var/log/honeypot/honey.log is 1+ ...
7
votes
2answers
926 views

Risks of running Honeypot [specific setup]

I'm planning to run a Honeypot with the following network setup: In order to avoid the honeypot coming in direct contact with my Internal network, I put it behind a firewall configured on a Linux ...
4
votes
3answers
596 views

Are honeypots successful in preventing attacks?

I've been looking to set up a honeypot, but it seems that honeyd's source code is out of date, and there are few other options. Which brings me to the question, does anyone employ honeypots as a ...
3
votes
1answer
542 views

How do you analyze the data collected from honeypot software?

So you've successfully setup a honeypot. GREAT! Now what?! I've got all this amazing data but; How do you analyze all the data collected from your honeypot software? What should you be looking for? ...
2
votes
1answer
2k views

How to set up a network for a honeypot?

This is a follow up for How to set up a Virtual Machine for a Honeypot?. After setting up your Virtual Machine. You need to make sure that your network is properly configured so you don't end up ...
2
votes
1answer
1k views

How to set up a Virtual Machine for a Honeypot?

On this thread, it's stated that it's probably a good idea to use a VM for your honeypot. I believe this is because; Comparative data is easier when comparing 2 exact images. Host/Network Security ...
11
votes
2answers
383 views

Profiling hackers with keystroke dynamics

I am writing a research paper on tracking hackers and how to include keystroke timings to create a profile of hackers. I want to combine the keystroke timings that I capture in ttylog with other data ...
3
votes
1answer
312 views

How to forward an specific FTP User to a Honeypot?

What I'm trying to do is to forward a specific FTP-User to a Honeypot, because the main server is for Shared Hosting and there's a lot of traffic, and I don't want to spend all the resources in ...
1
vote
1answer
1k views

Is a honeypot an IDS or an IPS or something else? Is it an offensive or a defensive technique? Is it still effective?

I'd like to know where a Honeypot falls into the scheme of security, and if it is still an effective tool?
1
vote
0answers
251 views

Honeypot for catching a spammer [closed]

I've been receiving more and more emails and now even TXT messages originating from google voice for inquiries of items that I've listed for sale on craigslist. What I would like to accomplish: I ...
2
votes
2answers
766 views

Interesting article on a vulnerability found in Tor

This article describes how French researchers compromised users using Tor. I'm not sure I fully understand or agree with it. I don't see what Bit Torrent has to do with anything? I mean they start out ...
1
vote
2answers
519 views

Can a TCP connection with a VM be “escaped from” to reach the host? [duplicate]

Possible Duplicate: How secure are virtual machines really? False sense of security? If a VM (e.g. VirtualBox) on host A opens a TCP connection to a hacker Z, are there any possible ...
1
vote
3answers
3k views

Tracing an IP from a mobile broadband ISP

My honeypot caught a hack attempt from an IP that was issued by Three Mobile Broadband (UK). My immediate thought was that most probable explanation was that the user was in the UK and had his ...
16
votes
3answers
7k views

Can someone get my WPA2 password with honeypots?

Yesterday I went to my cousin's home and I saw that I'm not connected to his wireless (for internet access). Then I have looked up the list of wireless points. I have found his name and clicked it ...
7
votes
2answers
1k views

How to attract traffic to a honeypot

I have set up a honeypot, but I am not happy with the low traffic load and I would like to trigger much higher traffic levels. What methods would attract high bot activity? These are the ideas I ...
1
vote
1answer
128 views

Where to find a fake hierarchy for a honeypot for double-dot/path traversal attacks?

I would like to provide content when a hacker tries something like GET /../../../etc/passwd, but they may choose something else, other than passwd. I will install notification of when somebody does ...