3

This is a follow up for How to set up a Virtual Machine for a Honeypot?.

After setting up your Virtual Machine. You need to make sure that your network is properly configured so you don't end up infecting your entire network! So this is a rather important part of the process when setting up a honeypot.

  • What are some of the things that need to be considered when setting up the network?
  • Does it need to be a DMZ?
  • If my hardware doesn't support advanced configurations, Can I still setup a honey pot?
  • Do my other computers on the network need to have special network configs?

How do I properly setup my network for a honeypot?

Improve this question

1 Answer 1

Reset to default
7

Your honey pot will be taken over by the attacker; that's the point. So anything that can be done from that machine will be power granted to the attacker. Therefore, you should configure things such that the attacker does not gain any new power that way. This means the following:

  • All other machines in your network MUST consider the honey pot as hostile (after all, it is the attacker's machine -- or will be at some point).

  • Beware of IPv6 ! Many operating systems enable some link-level IPv6 networking by default, and that could be used by the attacker. Better place your honey pot in a subnetwork of its own (your VM should be able to do that).

  • You should endeavour to block outgoing traffic from the honey pot. Otherwise, the attacker may use it as a relay to start attacking other, external systems, and that second attack will seem to be coming from your network. At best, you may be able to prove that you were just an innocent victim, but one could claim that by setting a weak machine which could be use as a relay, you just became an accomplice. You should block outgoing TCP connections, and for UDP packets, only allow DNS request to a specific server (e.g. Google's 8.8.8.8).

If your VM technology is VirtualBox, see the manual. You will probably want to use host-only networking and setup firewall rules on the new loopback interface that VirtualBox will add to the host.

One can guess that I am not a huge fan of the honey pot concept. It is somewhat fun, and a good research tool when studying attackers' behaviour, but it is also risky, both technically and legally.

Improve this answer
1
  • 1
    It seems to me that blocking all outgoing traffic would really limit the usefulness of it. Severely rate-limiting connections and speeds might be enough to prevent serious attacks and allow capturing a few attempts before the attacker moves on. Since all activity is logged, this would also prevent them from using your machine to cover their tracks. This may incidentally result in catching somebody if they're allowed to push some restricted traffic. Anybody who finds a box without outgoing activity will be outgoing from that thing in a moment.
    – Jeff Ferland ♦
    Commented Oct 14, 2012 at 4:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .