Tag Info

Hot answers tagged

18

There are mostly two kinds of attackers: the automatic, and the targeted. Automatic attackers are not humans; they are infected machines, part of various botnets, which try to expand their basis by finding other machines to infect. Their strategy is mostly random: they try random IP address for an open SSH server, then try common passwords for common ...


14

Yes and no. They may not have your password in plaintext, but they have enough to potentially guess it and verify that guess (i.e. offline brute forcing). WPA2 authentication is performed through a four-way handshake. Instead of just sending your password in plaintext to any access point you connect to, this handshake ensures that unless both parties ...


11

If you just want to get your honeypot machine compromised and part of a botnet, you will need to be running vulnerable services on the machine. The vulnerable services you choose will have to match the ports that you have forwarded to the honeypot machine and will also have to match the services that worms are actively trying to exploit. For a Windows XP ...


10

Especially given your lack of network experience, that sounds like a substantial risk to your home network to me :) Alternatively you could deploy it in the cloud for not much money and watch it there. See DMZ (Wikipedia) for background and other answers here for tips on designing DMZs. Unless you have a real firewall node providing network separation ...


9

May I suggest some honeypots designed for things exactly like what you describe: WebLabyrinth ( info ) Glastopf DShield Web Honeypot Project


9

Usually a large number of log entries from a honeypot are from one of two reasons: Your environment is getting scanned like a smudged barcode. You made the mistake of putting your honeypot on a non-dark network. You've configured your honeypot as a pretty typical Windows desktop, so lots of Windows service active, open sharing, etc. What you are likely ...


8

There are many ways to gain experience. You could follow metasploit's guide to How to set up a penetration testing lab, then attack the systems yourself and observe if and how the logging or security tools detected your activities. For learning purposes, it's far easier to follow the cause and effect when doing the above. Check out ...


8

If you want to do this, two things could make your life a bit safer: segregate it fully from your network (see @nealmcb's answer and link) check out the honeynet project at honeynet.org for preconfigured scripts, VM's etc.


8

Your problem is the placement of a honeypot. Consider that attackers will scan the internet to look for port 22 open, but they wont scan the whole IP space from start to end. Servers are concentrated in certain parts of the IP space. And similarly, simple internet subscribers are located in other parts of that space. So you have to use the IPs in the right ...


7

Your idea of fingerprinting is very similar to wireless signals intelligence in WWII. Both sides used to have whole departments whose role was to learn the code style, or "fist" of the opposing side's wireless operators. By tracking these profiles and using radio direction finding they gained a surprising amount of information about troop and vessel ...


7

This is the same as a High Interaction Honeypot idea, but you seem to be asking about embedding honeypot elements in production systems. Even so, I believe that the best practices for honeypots would apply here. As for your second bullet point, a Data Loss Protection system would seem to be a better way to go. You can monitor, track, and most importantly, ...


7

As nealmcb suggests, given your lack of network experience that is evident, I'd also advice against trying to run a high interaction honeypot. There are other solutions you may try, but it all depends on what you want to monitor exactly. There are ready made honeypot implementations out there with log and keystroke capturing and everything, but they are ...


7

You're reading the proposal slightly wrong. This is not intended as a safeguard to detect an intrusion to already compromised system, but as means of detecting compromised system's database. This is a whole different scenario, where the attacker wouldn't already have gained access to the system by knowing any end user password, but somehow (improperly ...


6

Might there be some value in going the whole nine yards and instead of just having a dummy 'admin' account, using the hidden operating system functionality of truecrypt to run your own 'actaul' os thereby giving them the whole (unhidden) operating system to play with (which you have installed your tracking rootkit onto etc)? This way, you can really give ...


6

I don't have the exact specs to hand, however we used to run a very successful wireless honeynet based on freely available sources which we would take to sensitive environments to see whether there were active attackers in the environment, and what they would do. Core to our setup was a laptop running a honeynet based environment, with simulated traffic ...


5

What you created is a high-interaction honeypot, ie a live system waiting to be compromised and later analysed by a foresics investigator (that being you of course). I would start with a linux-based, low-interaction honeypot. It creates a virtual filesystem and fake services that can make attackers (or their automated tool) believe this is a "real" system, ...


4

The best way to address the problem of sql injection is to use parametrized queries, which can be done with a library like PDO or MySQLi. You must actually patch vulnerabilities in your web application. I recommend using a free service like Sitewatch or an open source tool like wapiti. These solutions will detect a lot more than just sql injection in ...


4

No, WPA2 Passwords are not sent in plaintext. If this were the case, anyone could deauth you from the network and sniff the password directly from reconnection handshake. They can, on the other-hand grab the encrypted handshake and crack it using aircrack-ng. Other than a faraday cage, you really can't prevent this. There are mitigation methods like ...


4

Its talking about bittorrent clients not protecting itself properly. Also the article got this wrong the vulnerability is NOT in tor itself but the client using it. This quote is too vague The user's BitTorrent client then attempts to make a data connection directly to the honeypot without using Tor, thus revealing the user's IP address to the ...


4

As long as your router has its access rules to not allow any connections from your honeypot to the rest of your network then that should work out fine. Only allow connections from the management network or IP addresses to the linux VM host and honeypot, that way if either is hacked it won't be able to attack your network directly. Make sure there's no ...


4

I would call this an evil twin attack. And it's not uncommon to see corporate laptops vulnerable to this. WPA2-Enterprise supports a number of EAPs - Extensible Authentication Protocols. (Wikipedia article) The security depends on which EAP you use, and how you configure it. Some EAPs more vulnerable to an "evil twin" attack than PSK, as an attacker doesn't ...


3

Your honey pot will be taken over by the attacker; that's the point. So anything that can be done from that machine will be power granted to the attacker. Therefore, you should configure things such that the attacker does not gain any new power that way. This means the following: All other machines in your network MUST consider the honey pot as hostile ...


3

Typically a honeynet is used as a defensive tool and is used to (sort of) trap attackers. It is designed to fool them into thinking they are on a real system (though most good attackers can quickly detect it's a honeypot). By fooling the attacker, the "honeypot owner" is hoping to learn more about the attacker's motives and techniques. The honeypot is ...


3

Tor acts as a SOCKS 5 proxy and SOCKS 5 proxies can only proxy TCP data. Now DNS has similar issues so tor has a built in TCP encapsulation for DNS data, however such encapsulation is protocol dependent to work well. Now, it is possible to do this with the DHT protocol (which one? there are two different ones). It's a lot of work and has not been done for ...


3

Design a machine image that is capable of running a virtual server inside of it. Your domain image is there to provide security and monitoring. Primarily, it is needed to keep anything sufficiently ugly from flowing OUT of your honeypot. Also, packet captures! Stick the honeypot inside it, and you can turn them on and off at your heart's content. Legal ...


3

There is a lot of discussions about this, for example honeywords: https://www.schneier.com/blog/archives/2013/05/honeywords.html Though I think that this approach brings a lot of additional administrative effort with it. User management, etc. You might want to check out active defense techniques, like Nova http://www.projectnova.org/ Mykonos ...


3

By the definition of a honey pot, no, they are not a prevention tool. Honeypots are a tool for behavioral analysis (by seeing what kind of data they are after), slowing an attacker down (by giving them large amounts of noise to manipulate), or fingerprinting an attacker (you have a copy of all the files in the honeypot, and you can compare their downloads ...


3

I think you've got the right answer posting on hacking forums, the ones for those more interested in the process than gain. $15 isn't going to interest a for gain hacker, and you've (hopefully) no information worth stealing. Tell them you've built an SSHD that is extra hard to crack, kudos to anyone who can crack it. It may get interest. Alternatively you ...


3

I think a wide variety of hosts will be the key for you. I just checked the few hosts I run that have port 22 open to the world and they all saw in the range of thousands of attempts per day. I haven't seen more than 15,000 in one day. That seems fairly normal. I checked three hosts at three different hosting providers: AWS EC2, OVH and iomart. All in ...


3

If they are already in your network, just adding a honeypot may or may not be effective - you don't know what they already know of your network. Do they know the IP ranges for HR, finance, data storage systems etc? Do they have access to your change management system and would spot a new addition to the network? Have they already backdoored the servers ...



Only top voted, non community-wiki answers of a minimum length are eligible