0

When I started reading about honeypots, I could understand what is honeypot, how it works theoretically, i.e it is a trap-network that may or may not mimics a real network, but because of my limited thinking, what I could not get is, how exactly are they setup technically for any given network.

For example I have an ICS network that involves MTUs (Master Terminal Unit) and several RTUs (Remote Terminal Units) which read remote field parameters (sensors) and sends to an MTU over public network.

  • How honey pots are setup technically for any typical internet service, in terms of mimicking the service, IP address used by the service?
  • How can I set up a honeypot for an ICS network such as one mentioned in the above example?
  • How will attackers find my honeypot network (thinking as a vulnerable network)? Should I advertise my network in any way?
  • What makes them attack my trap network rather than the actual legitimate network?
Improve this question
3
  • You might be over thinking how simple a honeypot can be, A legitimate service or network can be used as a honeypot. – schroeder♦ Sep 23 '20 at 6:40
  • Are honey pots needs to bought as we buy antivirus software?, or they have to be built from scratch for a specific network type such as ICS network that works on specific protocol – reddi hari Sep 23 '20 at 11:58
  • They can be both. And it depends on what you want the honeypot to do. There are many different types. An SSH service exposed to the Internet with no viable account to log in with and a lot of logging to capture login attempts can be considered to be a "honeypot" as well as "honeynets" that simulate entire enterprise networks. – schroeder♦ Sep 23 '20 at 12:19
0

There are two main types of honeypots:

  • strong interaction: made to observe and learn about the hacker methods
  • weak interaction: made to detect an intruder

You seem to need only the second one: be able to make an attacker target your honeypot first so you can block it before he starts to attack your real assets.

In this case, your honeypot does not really need to mimic a real service. You could monitor the network interface and block any IP that connects to it, considering that your other machine a real client does not have any reason to connect.

You can make it an interesting target by publishing a DNS record for it in the alternative name of a certificate on your website, for example.

Here is an example of how simple the code can be: https://github.com/astar-security/Honeyris

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.