a system designed to lure attackers towards it in order to learn about new attacks or to draw attention away from the real system

learn more… | top users | synonyms

4
votes
1answer
126 views

Why did this attack use 0.0.0.0 as IP address and why did it work?

Working through this exercise in network forensics, the attacker used a buffer overflow exploit to send commands to the victim's command prompt. The commands open an FTP session and download some ...
0
votes
1answer
59 views

How to detect a Dionaea Honeypot, is it possible or not?

There is a question like this but the answers aren't sufficient to me. I am interested in a honeypot project and I use the dionaea honeypot. This project is really cool, but there is a problem. How ...
1
vote
1answer
146 views

running botnet for analysis

I a very curious to understand botnets practically. I want to run a p2p botnet (storm or waledac) for analysis and learning. I have mainly two issues: Where can i get access to binaries of either ...
3
votes
2answers
112 views

Why are honeypots not widely deployed?

From what I understand honeypots in addition to honey tokens are meant to prevent malicious insiders. Given recent high profile cases involving malicious insiders (Snowden), why are honeypots not ...
1
vote
1answer
64 views

Is there a Service to setup a Honey Pot URL to collect user IP + other data? [closed]

Being the paranoid user I am. I always think I have an infected computer with trojans or malware or prying eyes to my work computer. I was wondering is there a service that lets you create a honey pot ...
25
votes
4answers
4k views

Is it possible to detect a honeypot? [closed]

Do techniques exists to know if a machine is a honeypot (or suspicious indicators)? What techniques can be used for a software inside the honeypot or outside it? What techniques uses malware to ...
1
vote
0answers
79 views

Host-based security architecture for web server network

I am begining with network security and after studying for a while about often used technologies I got to this architecture for my home server (sorry it is not in english). I considered 3 basic ...
2
votes
1answer
92 views

What is the current U.S. law regarding the building of and deployment of honeypots? [closed]

I have lots of links to information on the topic that I've gathered published since the mid-2000s and this SANS document has always been my goto: ...
1
vote
1answer
95 views

How could honeypot be vulnerable?

We've been hacked for the 2nd time without knowing how/who did it. Luckily we were able to shutdown everything! We're trying to deploy Honeypot to be in control of what is going on from our local ...
13
votes
3answers
18k views

Setting up a honeypot

I have a spare computer lying around at my house, so I decided to turn it into a honeypot. So far, I have installed Windows XP (no service pack) on it and have set up rules on my router to forward ...
3
votes
0answers
104 views

What is the alternative tool for Honeypots? [closed]

Nowadays the tools of Honeypots are not reliable as before, because an attacker with some knowledge can detect it and override its power. So if I want something with the same characteristics as the ...
6
votes
2answers
937 views

Know of any HTTP tarpits/blackholes to use for redirecting malicious traffic?

So I cleaned up some malicious PHP scripts from a client's site and I've been monitoring for follow up connections to the scripts. Of course, I've found a LOT of IPs requesting the files. Too many ...
0
votes
1answer
69 views

Kippo graph Human Activity. What is it?

So I was running a Kippo honeypot. In Kippo graph there is a diagram tilted "Human activity" (see attached photo). What does it mean? Does it mean that, for example, on 21-11-2014 90 real attackers ...
2
votes
3answers
5k views

How do I setup honeypot server on Windows 7?

Background I would like to setup a honeypot server on a Windows 7 PC. My system is not part of a network and I don't run a server. I have a Windows 7 desktop PC. It's Home Premium Anytime Upgrade ...
1
vote
1answer
68 views

How to configure routing infrastructure so that the appropriate network traffic gets passed to the honeypot machine (windows xp)

I would like to configure local honeypot on windows xp which is installed on vmware, to do so I follow instruction on this link, but as I am new I don't know how can I configure routing infrastructure ...
2
votes
1answer
73 views

Allowing root login, but denying any actual logins

A friend told me a few months ago about an audit where he discovered root logins were enabled via SSH. This obviously ended up on the report, but when questioned the admin told him that he had set up ...
4
votes
2answers
133 views

How do honeypots remain secure to 0days and newer exploits?

If honeypots are designed for a specific set of exploits, such as SQL injection and XSS, how do they protect themselves against other exploits? For instance, if I created a honeypot a few months ago, ...
3
votes
1answer
218 views

Honeyd Isn't Detecting Loud Scans [closed]

I've got the Honeyd honeypot in one virtual machine (kali) and nmap in another (ubuntu), the config file looks like this: create default set default default tcp action closed set default default udp ...
0
votes
1answer
178 views

Can a hacker who has entered a virtual honeypot attack a LAN?

Is it possible for a hacker who has entered a honeypot (running in a virtual machine e.g. virtualbox), to attack real computers on a LAN?
5
votes
1answer
296 views

What is it called when you give hackers a way in?

Is there a name for a system that is designed to be hacked into? (Alternatively, there may be a different name for a system that is designed to look like it is hacked in to, but is actually just ...
4
votes
1answer
145 views

Where to submit collected malware from my honeypot?

wondering if you could help me. i setup the Dionaea honeypot and have collected 6 or 7 malware files. Unfortunately upon checking the Dionaea logs it keeps giving the error "Couldn't resolve host" for ...
0
votes
2answers
402 views

Create honeypot for remote desktop applications

Due recent breaches that have occurred using weak remote access application passwords. I would like to setup my own honey pot on a windows machine to study their malicious intents. This is pretty easy ...
1
vote
4answers
336 views

Are computers on same network as honeypot safe?

If a computer is setup as a honeypot and is on the same LAN with other computers, could other computers be attacked? My thought is that if an attacker infects a honeypot with a worm, this worm would ...
0
votes
2answers
527 views

honeyd is still a good alternative?

I've been investigating to deploy a honeypot for research purpose, Honeyd seems like the most popular and adequate option to my needs, but it seems too old, the last version of this software was ...
1
vote
2answers
135 views

How can Joe Citizen report or at least hamper a phone-based PC scammer?

Within the last week, I've received 3 phone calls at 3 different locations from technicians who are calling "from Microsoft" about "Windows problems" that they've detected on my PC. Which they ...
1
vote
3answers
266 views

Simple Windows 7 honeypot: is this safe?

I want to share a "honeypot" folder on a Windows 7 machine connected to a router. The only shared folder in the local workgroup connected to this router is the honeypot folder, which allows ...
1
vote
0answers
119 views

Anyone seen weird messages in their logs?

I've been reading over the logs on my honeypot and discovered the following messages that seem to be either gibberish or a cypher message: kernel: v0 neigfradn tt kernel: [2108296.63083] devc nt nee ...
31
votes
5answers
5k views

Is a honeypot an effective deterrent to hackers successfully compromising your network?

According to Microsoft, adding a honeypot to your corporate network is an effective way to deter hackers from compromising your network. Aren't honeypots more for research purposes and not ideal for ...
16
votes
3answers
8k views

Can someone get my WPA2 password with honeypots?

Yesterday I went to my cousin's home and I saw that I'm not connected to his wireless (for internet access). Then I have looked up the list of wireless points. I have found his name and clicked it ...
0
votes
1answer
152 views

compromising DVRs to become bitcoin mining bot [duplicate]

I read this article, about an exploit which highjacks a DVR to become a "bitcoin mining bot". The heart of the attack is to send a binary using just echo comands to the device, which acts as a ...
-1
votes
1answer
73 views

Simulation of security against IP [closed]

I am pursuing a college project, in which I am running three fake services on three ports to protect the main service (say running at port 80). The concept is that if the user is malicious, he'll try ...
1
vote
0answers
83 views

Suppressing broadcast traffic in honeyd logs?

I'm trying to set up a honeyd system. How can I suppress the broadcast traffic seen by the outside interface, preferably without needing to resort to syslog filters? User subnet 192.168.20.0/24, ...
1
vote
2answers
327 views

Security against IP Spoofing

I am pursuing a college project, in which I am running three fake services on three ports to protect the main service (say running at port 80). The concept is that if the user is malicious, he'll try ...
1
vote
1answer
126 views

Making a content injection target [closed]

I don't know much about content injection so I'm hoping to draw on the experience of the community here. I'm writing a tool that evaluates public web proxies. I want to know if the proxies are being ...
6
votes
2answers
1k views

Does WPA2 Enterprise mitigate evil twin attacks?

One of the dangers of using WPA2-PSK is the possibility that an attacker may setup another wireless network with the same SSID and even use the same access point MAC address via MAC spoofing. The ...
2
votes
2answers
217 views

Transparent way to send logs from honeypot to logging server

Does anyone know of a secure and transparent method of sending logs from a honeypot server on a DMZ to a logging server in a private network?. The logs must be encrypted and sent in such a way that a ...
10
votes
2answers
478 views

Using “canaries” to detect intrusion?

I haven't read much about such a technique, but I'm wondering if there's any sort of best practice around the use of "canaries" to detect certain types of intrusion: Create a bogus account that ...
2
votes
2answers
579 views

Suricata IPS rules for honeypot

I have a really simple high interaction honeypot and I have just installed a VM as an IPS (suricata) with a transparent bridge between my router and the honeypot. The setup looks something like this: ...
1
vote
3answers
4k views

Tracing an IP from a mobile broadband ISP

My honeypot caught a hack attempt from an IP that was issued by Three Mobile Broadband (UK). My immediate thought was that most probable explanation was that the user was in the UK and had his ...
8
votes
4answers
755 views

Do honeywords add any real security?

This paper proposes the concept of honeywords for detecting if a password database has been compromised. As far as I understand it works like this: You save n password hashes for each user, one that ...
4
votes
1answer
229 views

High Interaction Honeypot design

I've been writing a high interaction honeypot which has required some interesting design decisions, for instance I want the honeypot to get attacked not the underlying infrastructure/ software. Fun ...
5
votes
1answer
913 views

Setting up home lab with Snort and Vyatta - looking for resource recommendations or advice

I'm looking to turn a new desktop (Ubuntu 12.10-64bit) I built into a virtual home lab for testing and experimenting with various security things. The first setup I would like to try running is the ...
2
votes
3answers
351 views

How to lure a Hacker?

I am suspecting someone unauthorized is trying to or already in the network trying to get information on some data that we have. How can I lure this person to a "Honeypot" and gather information while ...
13
votes
4answers
1k views

Attract Brute Force SSH Attacks

I posted a question on Server Fault, but got downvoted and had the question closed. One of the comments suggested looking over here, so here goes: For my senior project, I'm working on an ...
4
votes
3answers
667 views

Are honeypots successful in preventing attacks?

I've been looking to set up a honeypot, but it seems that honeyd's source code is out of date, and there are few other options. Which brings me to the question, does anyone employ honeypots as a ...
5
votes
3answers
1k views

Honeyd: log grows too fast

I'm having trouble with honeyd log; it grows way too fast. I started the honeyd daemon with honeyd -l /var/log/honeypot/honey.log -u 1000 -g 1000 -f honeyd.conf /var/log/honeypot/honey.log is 1+ ...
7
votes
2answers
986 views

Risks of running Honeypot [specific setup]

I'm planning to run a Honeypot with the following network setup: In order to avoid the honeypot coming in direct contact with my Internal network, I put it behind a firewall configured on a Linux ...
3
votes
1answer
603 views

How do you analyze the data collected from honeypot software?

So you've successfully setup a honeypot. GREAT! Now what?! I've got all this amazing data but; How do you analyze all the data collected from your honeypot software? What should you be looking for? ...
2
votes
1answer
2k views

How to set up a Virtual Machine for a Honeypot?

On this thread, it's stated that it's probably a good idea to use a VM for your honeypot. I believe this is because; Comparative data is easier when comparing 2 exact images. Host/Network Security ...
2
votes
1answer
2k views

How to set up a network for a honeypot?

This is a follow up for How to set up a Virtual Machine for a Honeypot?. After setting up your Virtual Machine. You need to make sure that your network is properly configured so you don't end up ...