I am suspecting someone unauthorized is trying to or already in the network trying to get information on some data that we have. How can I lure this person to a "Honeypot" and gather information while they are connected to the network, and record the intrusions to better prosecute them for their doing.

  • You should probably ask google and wikipedia before you ask SEC:SE. The answer is simple; the complexity is all in the implementation. – Mark C. Wallace Jan 25 '13 at 12:06
  • The hacker will already have done their damage before you manage to prosecute them (if you ever do). Luring them in now isn't of any real benefit to you. – Inverted Llama Jan 25 '13 at 12:25
  • 1
    Before trying to fight, be sure that you will be the stronger! ;-) – F. Hauri Jan 25 '13 at 13:52
  • 2
    possible duplicate of How to attract traffic to a honeypot – AJ Henderson Jan 25 '13 at 14:01
  • 1
    Have you tried adding Club Mate to the vending machine? See who is able to drink it. – Lucas Kauffman Jan 25 '13 at 14:23

If they are already in your network, just adding a honeypot may or may not be effective - you don't know what they already know of your network.

  • Do they know the IP ranges for HR, finance, data storage systems etc?
  • Do they have access to your change management system and would spot a new addition to the network?
  • Have they already backdoored the servers with the data they want?
  • Have they already got the information they need?

At this stage if the data is important, you may find it more useful to change access and remove them from your network, rather than try and track them.

Alternatively, if you know where this important data is, you don't need a honeypot - what you need is to closely monitor all activity and see whether any unusual connections are being made.

What has inspired your suspicions? If it was seeing something odd on your network logs, that would be a good place to start.

Generally, honeypots are useful before an intrusion, as they stop or slow an intruder before they get to your data, giving you a chance to identify or block them.

| improve this answer | |

"Luering" is an activity that might require legal advice.

Setting traps is simple, but you may want to start or improve logging procedures in order to aid law enforcement build a good audit trail.

| improve this answer | |

I have often thought about doing this to the vast amounts of failed attempts to login to my SSH server; I've never done it but you could do something like so:

  • After 'x' amount of failed login attempts from 'IP' start forwarding attackers packets to new server (virtual server ;)) and automatically give them access (e.g. a honeypot).

I don't do this because it serves no point; they think they got in when in reality I just let them in, and on top of that once they find out its a honey-pot you've only just smacked the hornets nest.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.