4

So in the world of networks, people try to gain access to the client machine and perform lateral movement. Honeypots are often used to give them an easy access point and show them an unfavorable or fake environment so they leave before doing any real harm, the intrusion gets logged, and the network is safe.
At least in theory this is how a honeypot should work, from my understanding. However, recently I've been tasked with setting one up and while I see a couple that exists, I'm curious what it is that a honeypot does to actually keep your network safe?

IF they gain access to the honeypot, isn't lateral movement still able to be achieved or does the honeypot have some sort of software to make this a living nightmare for the attacker?

Improve this question
1
  • Detection can be a big part of a honeypot. So even if an attacker can move off of a honeypot, the hope is that you better understand and monitor the honeypot's activity and can detect the illicit behavior.
    – Neil Smithline
    Sep 25, 2015 at 21:26

1 Answer 1

Reset to default
7

It depends of the honeypot you are using. If you are using a low or medium interaction honeypot that only emulates some services, than the chances are very low that the attacker can break out of the honeypot (except if he finds a bug in the honeypot itself).

If you are using full interaction honeypots, like a real Windows machine, that the chances are high that the attacker could use the honeypot as a starting point for attacking other machines (on your network or on the internet). Therefore you must put a so called honeywall between the honeypot and the rest of your network which will basically block malicious traffic that tries to leave the honeypot. The honeywall is basically a combination of IPS/firewall/WAF of your choice.

Even if using a honeywall, you cannot be 100% sure that the attacker cannot break out of the honeypot. That is because you must allow certain traffic to leave the honeypot in order for the attacker to receive feedback from his attack, but you must prevent malicious traffic that could damage other machines outside of the honeypot to leave it. Finding the right balance is quite hard, and a risk always remains.

Improve this answer
5
  • Can you clarify on low or medium interaction honeypot emulating services? Like does it just respond with what would deter a hacker? Or does that just make them look for other avenues of attack?
    – Robert Mennell
    Sep 25, 2015 at 21:22
  • 1
    See wiki honeypot article @RobertMennell.
    – Neil Smithline
    Sep 25, 2015 at 21:25
  • 2
    An example: KippoSSH is a medium interaction honeypot that emulates a SSH server. An attacker can find it, connect to it and run commands. But everything the attacker sees is emulated. If he runs the ls command, he will see a fake directory structure. If he tries to ping some host, it will look like he receives a reply, but its just emulated/faked. No packets are leaving the honeypot. Even if he pings a nonexisting host, he will receive a fake ping reply.
    – pineappleman
    Sep 25, 2015 at 21:25
  • Thanks @NeilSmithline and pineappleman this helped a lot. I searched for honeypot on wiki and didn't see that article(my wiki-fu is weak)
    – Robert Mennell
    Sep 25, 2015 at 21:36
  • Some good explanations to support the idea that honeypots have their value in detecting intrusions that your IDS/IDPS might miss, rather than trying to trap & contain as researchers do. Once the intrusion is detected you go into incident response and start tearing your systems apart. To this philosophy, the honeypot serves its purpose as soon as soon as you realize a threat is interacting with it. But there are reasonable people who take a higher-involvement view.
    – mostlyinformed
    Sep 26, 2015 at 3:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .