Tag Info

Hot answers tagged

50

Deploying a honeypot is not unlike adding a painted door or a fake safe to a bank vault. It does not deter anybody (its purpose is not to be detected as a honeypot). Possibly someone misspelled detect. It can reduce (somewhat) the time spent by attackers against the real door. Not by much. More than that, it can be optimized for data gathering ...


19

Honeypots are not a deterrent control, they are a detective control. As such, they can be very powerful in corporate, production networks. I run many honeypots and they provide a useful set of data apart from IDS/IPS. They can tell me the intent of an active attack, the sophistication of an attack, and any contact with a honeypot indicates a serious event. ...


18

There are mostly two kinds of attackers: the automatic, and the targeted. Automatic attackers are not humans; they are infected machines, part of various botnets, which try to expand their basis by finding other machines to infect. Their strategy is mostly random: they try random IP address for an open SSH server, then try common passwords for common ...


17

Yes and no. They may not have your password in plaintext, but they have enough to potentially guess it and verify that guess (i.e. offline brute forcing). WPA2 authentication is performed through a four-way handshake. Instead of just sending your password in plaintext to any access point you connect to, this handshake ensures that unless both parties ...


11

If you just want to get your honeypot machine compromised and part of a botnet, you will need to be running vulnerable services on the machine. The vulnerable services you choose will have to match the ports that you have forwarded to the honeypot machine and will also have to match the services that worms are actively trying to exploit. For a Windows XP ...


10

Especially given your lack of network experience, that sounds like a substantial risk to your home network to me :) Alternatively you could deploy it in the cloud for not much money and watch it there. See DMZ (Wikipedia) for background and other answers here for tips on designing DMZs. Unless you have a real firewall node providing network separation ...


9

Usually a large number of log entries from a honeypot are from one of two reasons: Your environment is getting scanned like a smudged barcode. You made the mistake of putting your honeypot on a non-dark network. You've configured your honeypot as a pretty typical Windows desktop, so lots of Windows service active, open sharing, etc. What you are likely ...


9

May I suggest some honeypots designed for things exactly like what you describe: WebLabyrinth ( info ) Glastopf DShield Web Honeypot Project


8

There are many ways to gain experience. You could follow metasploit's guide to How to set up a penetration testing lab, then attack the systems yourself and observe if and how the logging or security tools detected your activities. For learning purposes, it's far easier to follow the cause and effect when doing the above. Check out ...


8

If you want to do this, two things could make your life a bit safer: segregate it fully from your network (see @nealmcb's answer and link) check out the honeynet project at honeynet.org for preconfigured scripts, VM's etc.


8

Your idea of fingerprinting is very similar to wireless signals intelligence in WWII. Both sides used to have whole departments whose role was to learn the code style, or "fist" of the opposing side's wireless operators. By tracking these profiles and using radio direction finding they gained a surprising amount of information about troop and vessel ...


8

Your problem is the placement of a honeypot. Consider that attackers will scan the internet to look for port 22 open, but they wont scan the whole IP space from start to end. Servers are concentrated in certain parts of the IP space. And similarly, simple internet subscribers are located in other parts of that space. So you have to use the IPs in the right ...


7

As nealmcb suggests, given your lack of network experience that is evident, I'd also advice against trying to run a high interaction honeypot. There are other solutions you may try, but it all depends on what you want to monitor exactly. There are ready made honeypot implementations out there with log and keystroke capturing and everything, but they are ...


7

This is the same as a High Interaction Honeypot idea, but you seem to be asking about embedding honeypot elements in production systems. Even so, I believe that the best practices for honeypots would apply here. As for your second bullet point, a Data Loss Protection system would seem to be a better way to go. You can monitor, track, and most importantly, ...


7

You're reading the proposal slightly wrong. This is not intended as a safeguard to detect an intrusion to already compromised system, but as means of detecting compromised system's database. This is a whole different scenario, where the attacker wouldn't already have gained access to the system by knowing any end user password, but somehow (improperly ...


7

I've had this happen to me before and realizing to them that their time is money, I decided to take them on a little ride (it was a Sunday and I was bored...don't judge me). Basically I pretended to be a complete computer luddite - kept them on the phone for a good hour pretending like I had no idea what I was doing. I could't find the event viewer, didn't ...


6

I don't have the exact specs to hand, however we used to run a very successful wireless honeynet based on freely available sources which we would take to sensitive environments to see whether there were active attackers in the environment, and what they would do. Core to our setup was a laptop running a honeynet based environment, with simulated traffic ...


6

Might there be some value in going the whole nine yards and instead of just having a dummy 'admin' account, using the hidden operating system functionality of truecrypt to run your own 'actaul' os thereby giving them the whole (unhidden) operating system to play with (which you have installed your tracking rootkit onto etc)? This way, you can really give ...


6

The question reminded me of an article from a not so distant past that surprised me with a similar claim. I was able to find it again, it was "5 Reasons Every Company Should Have A Honeypot" on Dark Reading from October 2013. Summarized, their five reasons are: Attackers test their tools against standard anti-malware software, so a honeypot as a system ...


5

You could setup a honeypot, and add your additional logging systems. This will produce results, although probably not the results you are looking for. In the real world, most compromises are with bots, so keystrokes don't apply.


5

What you created is a high-interaction honeypot, ie a live system waiting to be compromised and later analysed by a foresics investigator (that being you of course). I would start with a linux-based, low-interaction honeypot. It creates a virtual filesystem and fake services that can make attackers (or their automated tool) believe this is a "real" system, ...


5

This kind of scam requires a lot of manpower, so the calls come from a country where labour is very cheap -- in particular, not from the USA. So you may as well give up any hope of "catching" the scammer. What you should do depends on your own goals and feelings. Personally, I give a very high value to my own time; therefore, I would indulge in some ...


4

No, WPA2 Passwords are not sent in plaintext. If this were the case, anyone could deauth you from the network and sniff the password directly from reconnection handshake. They can, on the other-hand grab the encrypted handshake and crack it using aircrack-ng. Other than a faraday cage, you really can't prevent this. There are mitigation methods like ...


4

The best way to address the problem of sql injection is to use parametrized queries, which can be done with a library like PDO or MySQLi. You must actually patch vulnerabilities in your web application. I recommend using a free service like Sitewatch or an open source tool like wapiti. These solutions will detect a lot more than just sql injection in ...


4

Its talking about bittorrent clients not protecting itself properly. Also the article got this wrong the vulnerability is NOT in tor itself but the client using it. This quote is too vague The user's BitTorrent client then attempts to make a data connection directly to the honeypot without using Tor, thus revealing the user's IP address to the ...


4

As long as your router has its access rules to not allow any connections from your honeypot to the rest of your network then that should work out fine. Only allow connections from the management network or IP addresses to the linux VM host and honeypot, that way if either is hacked it won't be able to attack your network directly. Make sure there's no ...


4

If they are already in your network, just adding a honeypot may or may not be effective - you don't know what they already know of your network. Do they know the IP ranges for HR, finance, data storage systems etc? Do they have access to your change management system and would spot a new addition to the network? Have they already backdoored the servers ...


4

I would call this an evil twin attack. And it's not uncommon to see corporate laptops vulnerable to this. WPA2-Enterprise supports a number of EAPs - Extensible Authentication Protocols. (Wikipedia article) The security depends on which EAP you use, and how you configure it. Some EAPs more vulnerable to an "evil twin" attack than PSK, as an attacker doesn't ...


4

Honeypots are not a defensive mechanism. They are a medium that can emulate your network and can help you in identifying potential threats on your network. Setting up honeypots in corporate networks can give you an insight into any attacks that are directed towards your corporate. Based on the results captured in your honeypot, you can further strengthen ...


3

Tor acts as a SOCKS 5 proxy and SOCKS 5 proxies can only proxy TCP data. Now DNS has similar issues so tor has a built in TCP encapsulation for DNS data, however such encapsulation is protocol dependent to work well. Now, it is possible to do this with the DHT protocol (which one? there are two different ones). It's a lot of work and has not been done for ...



Only top voted, non community-wiki answers of a minimum length are eligible