3

Is it safe to run a honeypot on a virtual machine on my personal computer and home network? I was thinking of setting up a dmz on my home network to ensure my personal devices remain safe but was told it'd be fine to just run it on a vm. Is it possible to do so while maintaining the security of my personal computer and other devices on my network without a dmz?

4
  • 2
    I would never advise anyone ever run a honeypot on their home network.
    – DKNUCKLES
    Oct 31, 2017 at 18:25
  • Would running a virtual honeypot in a virtual machine on a DMZ be more secure or is it still not advisable regardless of what security measures are used? Would it be possible to explain why? Thanks
    – R.Ricardo
    Oct 31, 2017 at 18:32
  • 1
    I wouldn't run it regardless of how you try to secure it, and I've been securing networks for a decade. There are various ways to break out of virtualization sandboxes and DMZ's, and if you're like most, you perform all of your most sensitive transactions and work on your work computer. The benefit of running something like this on your home network to save some money for the purposes of education does not outweigh the risks for things to go wrong in my opinion. When you're securing something you need to be right 100% of the time, your adversary just needs to be right once.
    – DKNUCKLES
    Oct 31, 2017 at 18:41
  • I wouldn’t start with a honeypot if the goal is improving home security. There are many other things you can do to lock down your home network that won’t pose as much risk as running a honeypot. Oct 31, 2017 at 19:18

1 Answer 1

5

From my point of view, Honeypots are not made for being used in a personal home network.

In the most cases, they are used for:

  • Driving bad bots into a Sinkhole.
  • Studying malicious behavior.
  • Researching new attack patterns, and if you are lucky some 0days.

Is it safe to run a honeypot on a virtual machine on my personal computer and home network?

Well, I would say it depends on your info security knowledge. Keep in mind that you are putting a hole in your home network yourself.

What about this scenario:

Your not lucky and a human attacker is targeting your brand new honeypot. This attacker is quite skilled, actually, he does hacking for a living. Let's call him Dimitry.

Within few minutes Dimitry will know he is inside a non-well crafted honeypot. (Yes, your first honeypot won't be a masterpiece). Dimitry has some free time and wants to teach you a lesson.

So he decides to target your router. How unlucky we are... Our router firmware is not up to date it's weak to a buffer overflow attack on the HTTP basic auth login field.

Well, that escalated quickly, Dimitry is now your router admin... He did that in less than 5 minutes, your devices might be part of Dimitry's botnet within 20.

The thing is, nowadays, good attackers don't attack for fun All your bases are belong to us era is no more. They attack for profit, and enrolling new devices into a botnet can be considered as profit.

So the question is: Without your honeypot, How Dimitry knows you even exist ?

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .