a system designed to lure attackers towards it in order to learn about new attacks or to draw attention away from the real system

learn more… | top users | synonyms

2
votes
1answer
36 views

Detect host lookups against a domain/subdomain name

I want to detect, with as much accuracy as possible, the IP address of any remote host performing a DNS lookup of my domain name (eg. nslookup mydomain123.com) and any subdomains as well if possible. ...
1
vote
0answers
28 views

PGP 'forced entry' decode (steganography?)

This was originally posted by me on stackoverflow but was deemed too generic. It does seem like an impossible thing to do, but: you know when you have your perimeter alarm system you usually get ...
5
votes
0answers
44 views

How to understand QEBEK (Honeypot Monitoring Tool)?

I am working from a while to find something meaningful or updated about QEBEK, but what i got is here in two links Intro and KYT Paper for Installation 2010 . These links are nothing more that a ...
0
votes
0answers
28 views

I can't get the honeyd to run in loopback interface

I've been working on honeyd for two day and am struggling with it. What I'd like to do is that I'd want to run it on my own localhost (i.e. loopback interface). But I'm keep getting the following ...
0
votes
0answers
62 views

Script to emulate dns for windows machine in honeyd

I want to simulate virtual Windows hosts using honeyd. To do so I have installed honeyd. I have configured honeyd as Windows XP SP1, and now I want to emulate DNS services on it. I used UDPot as a DNS ...
-2
votes
1answer
87 views

Honeypot used as as a proxy?

I'm running Kali Linux on my system at home to practice pentesting. If I implement a honeypot on my system could it be possible to use that as some sort of proxy server? I was thinking it wouldn't be ...
4
votes
1answer
88 views

How Honeypot and Greynet are different?

From what I have read about Greynet is, when we are talking about greynet, we are simply placing darknet inside network to monitor if someone is performing network scanning inside our network. These ...
2
votes
0answers
39 views

problem blocking TCP scans by setting up honeyd in virtual environment

I am creating a virtual environment where I have created three virtual machines, CentOS as an Apache Webserver CentOs as an Attacker machine FreeBSD with Honeyd to setup Honeypot I have ...
1
vote
1answer
175 views

Host-based security architecture for web server network

I am begining with network security and after studying for a while about often used technologies I got to this architecture for my home server (sorry it is not in english). I considered 3 basic ...
3
votes
1answer
152 views

Setting up a honeypot to detect malicious network activity

So in the world of networks, people try to gain access to the client machine and perform lateral movement. Honeypots are often used to give them an easy access point and show them an unfavorable or ...
0
votes
1answer
161 views

How to detect a Dionaea Honeypot, is it possible or not?

There is a question like this but the answers aren't sufficient to me. I am interested in a honeypot project and I use the dionaea honeypot. This project is really cool, but there is a problem. How ...
2
votes
1answer
182 views

running botnet for analysis

I a very curious to understand botnets practically. I want to run a p2p botnet (storm or waledac) for analysis and learning. I have mainly two issues: Where can i get access to binaries of either ...
2
votes
1answer
145 views

What is the current U.S. law regarding the building of and deployment of honeypots? [closed]

I have lots of links to information on the topic that I've gathered published since the mid-2000s and this SANS document has always been my goto: ...
0
votes
1answer
68 views

How can you draw attention to your web application honeypot? [duplicate]

Unsatisfied with existing software, I'm currently toying around with writing a web application honeypot. My question is: how do you draw the attention of attackers and automated attacking software to ...
4
votes
1answer
346 views

Why did this attack use 0.0.0.0 as IP address and why did it work?

Working through this exercise in network forensics, the attacker used a buffer overflow exploit to send commands to the victim's command prompt. The commands open an FTP session and download some ...
3
votes
2answers
172 views

Why are honeypots not widely deployed?

From what I understand honeypots in addition to honey tokens are meant to prevent malicious insiders. Given recent high profile cases involving malicious insiders (Snowden), why are honeypots not ...
1
vote
1answer
121 views

Is there a Service to setup a Honey Pot URL to collect user IP + other data? [closed]

Being the paranoid user I am. I always think I have an infected computer with trojans or malware or prying eyes to my work computer. I was wondering is there a service that lets you create a honey pot ...
25
votes
4answers
4k views

Is it possible to detect a honeypot? [closed]

Do techniques exists to know if a machine is a honeypot (or suspicious indicators)? What techniques can be used for a software inside the honeypot or outside it? What techniques uses malware to ...
1
vote
1answer
107 views

How could honeypot be vulnerable?

We've been hacked for the 2nd time without knowing how/who did it. Luckily we were able to shutdown everything! We're trying to deploy Honeypot to be in control of what is going on from our local ...
15
votes
3answers
20k views

Setting up a honeypot

I have a spare computer lying around at my house, so I decided to turn it into a honeypot. So far, I have installed Windows XP (no service pack) on it and have set up rules on my router to forward ...
3
votes
0answers
183 views

What is the alternative tool for Honeypots? [closed]

Nowadays the tools of Honeypots are not reliable as before, because an attacker with some knowledge can detect it and override its power. So if I want something with the same characteristics as the ...
6
votes
2answers
1k views

Know of any HTTP tarpits/blackholes to use for redirecting malicious traffic?

So I cleaned up some malicious PHP scripts from a client's site and I've been monitoring for follow up connections to the scripts. Of course, I've found a LOT of IPs requesting the files. Too many ...
0
votes
1answer
91 views

Kippo graph Human Activity. What is it?

So I was running a Kippo honeypot. In Kippo graph there is a diagram tilted "Human activity" (see attached photo). What does it mean? Does it mean that, for example, on 21-11-2014 90 real attackers ...
2
votes
3answers
6k views

How do I setup honeypot server on Windows 7?

Background I would like to setup a honeypot server on a Windows 7 PC. My system is not part of a network and I don't run a server. I have a Windows 7 desktop PC. It's Home Premium Anytime Upgrade ...
1
vote
1answer
74 views

How to configure routing infrastructure so that the appropriate network traffic gets passed to the honeypot machine (windows xp)

I would like to configure local honeypot on windows xp which is installed on vmware, to do so I follow instruction on this link, but as I am new I don't know how can I configure routing infrastructure ...
2
votes
1answer
73 views

Allowing root login, but denying any actual logins

A friend told me a few months ago about an audit where he discovered root logins were enabled via SSH. This obviously ended up on the report, but when questioned the admin told him that he had set up ...
4
votes
2answers
150 views

How do honeypots remain secure to 0days and newer exploits?

If honeypots are designed for a specific set of exploits, such as SQL injection and XSS, how do they protect themselves against other exploits? For instance, if I created a honeypot a few months ago, ...
3
votes
1answer
340 views

Honeyd Isn't Detecting Loud Scans [closed]

I've got the Honeyd honeypot in one virtual machine (kali) and nmap in another (ubuntu), the config file looks like this: create default set default default tcp action closed set default default udp ...
0
votes
1answer
218 views

Can a hacker who has entered a virtual honeypot attack a LAN?

Is it possible for a hacker who has entered a honeypot (running in a virtual machine e.g. virtualbox), to attack real computers on a LAN?
5
votes
1answer
300 views

What is it called when you give hackers a way in?

Is there a name for a system that is designed to be hacked into? (Alternatively, there may be a different name for a system that is designed to look like it is hacked in to, but is actually just ...
4
votes
1answer
191 views

Where to submit collected malware from my honeypot?

wondering if you could help me. i setup the Dionaea honeypot and have collected 6 or 7 malware files. Unfortunately upon checking the Dionaea logs it keeps giving the error "Couldn't resolve host" for ...
0
votes
2answers
525 views

Create honeypot for remote desktop applications

Due recent breaches that have occurred using weak remote access application passwords. I would like to setup my own honey pot on a windows machine to study their malicious intents. This is pretty easy ...
1
vote
4answers
378 views

Are computers on same network as honeypot safe?

If a computer is setup as a honeypot and is on the same LAN with other computers, could other computers be attacked? My thought is that if an attacker infects a honeypot with a worm, this worm would ...
0
votes
2answers
662 views

honeyd is still a good alternative?

I've been investigating to deploy a honeypot for research purpose, Honeyd seems like the most popular and adequate option to my needs, but it seems too old, the last version of this software was ...
1
vote
2answers
145 views

How can Joe Citizen report or at least hamper a phone-based PC scammer?

Within the last week, I've received 3 phone calls at 3 different locations from technicians who are calling "from Microsoft" about "Windows problems" that they've detected on my PC. Which they ...
1
vote
3answers
290 views

Simple Windows 7 honeypot: is this safe?

I want to share a "honeypot" folder on a Windows 7 machine connected to a router. The only shared folder in the local workgroup connected to this router is the honeypot folder, which allows ...
1
vote
0answers
126 views

Anyone seen weird messages in their logs?

I've been reading over the logs on my honeypot and discovered the following messages that seem to be either gibberish or a cypher message: kernel: v0 neigfradn tt kernel: [2108296.63083] devc nt nee ...
31
votes
5answers
5k views

Is a honeypot an effective deterrent to hackers successfully compromising your network?

According to Microsoft, adding a honeypot to your corporate network is an effective way to deter hackers from compromising your network. Aren't honeypots more for research purposes and not ideal for ...
17
votes
3answers
9k views

Can someone get my WPA2 password with honeypots?

Yesterday I went to my cousin's home and I saw that I'm not connected to his wireless (for internet access). Then I have looked up the list of wireless points. I have found his name and clicked it ...
0
votes
1answer
205 views

compromising DVRs to become bitcoin mining bot [duplicate]

I read this article, about an exploit which highjacks a DVR to become a "bitcoin mining bot". The heart of the attack is to send a binary using just echo comands to the device, which acts as a ...
-1
votes
1answer
79 views

Simulation of security against IP [closed]

I am pursuing a college project, in which I am running three fake services on three ports to protect the main service (say running at port 80). The concept is that if the user is malicious, he'll try ...
1
vote
0answers
101 views

Suppressing broadcast traffic in honeyd logs?

I'm trying to set up a honeyd system. How can I suppress the broadcast traffic seen by the outside interface, preferably without needing to resort to syslog filters? User subnet 192.168.20.0/24, ...
1
vote
2answers
359 views

Security against IP Spoofing

I am pursuing a college project, in which I am running three fake services on three ports to protect the main service (say running at port 80). The concept is that if the user is malicious, he'll try ...
1
vote
1answer
143 views

Making a content injection target [closed]

I don't know much about content injection so I'm hoping to draw on the experience of the community here. I'm writing a tool that evaluates public web proxies. I want to know if the proxies are being ...
6
votes
2answers
2k views

Does WPA2 Enterprise mitigate evil twin attacks?

One of the dangers of using WPA2-PSK is the possibility that an attacker may setup another wireless network with the same SSID and even use the same access point MAC address via MAC spoofing. The ...
2
votes
2answers
248 views

Transparent way to send logs from honeypot to logging server

Does anyone know of a secure and transparent method of sending logs from a honeypot server on a DMZ to a logging server in a private network?. The logs must be encrypted and sent in such a way that a ...
10
votes
2answers
530 views

Using “canaries” to detect intrusion?

I haven't read much about such a technique, but I'm wondering if there's any sort of best practice around the use of "canaries" to detect certain types of intrusion: Create a bogus account that ...
2
votes
2answers
655 views

Suricata IPS rules for honeypot

I have a really simple high interaction honeypot and I have just installed a VM as an IPS (suricata) with a transparent bridge between my router and the honeypot. The setup looks something like this: ...
2
votes
3answers
4k views

Tracing an IP from a mobile broadband ISP

My honeypot caught a hack attempt from an IP that was issued by Three Mobile Broadband (UK). My immediate thought was that most probable explanation was that the user was in the UK and had his ...
9
votes
4answers
831 views

Do honeywords add any real security?

This paper proposes the concept of honeywords for detecting if a password database has been compromised. As far as I understand it works like this: You save n password hashes for each user, one that ...