0

I've been investigating to deploy a honeypot for research purpose, Honeyd seems like the most popular and adequate option to my needs, but it seems too old, the last version of this software was launched almost seven years ago (2007) and makes me think if it's still a good honeypot solution.

I would like to know if there are other solutions as Honeyd was in his time, or it's still the best option?, what are the new tendencies in Honeypot? and what are the most common ways to deploy a research Honeypot?.

I need to deploy a honeypot inside a network that is attacked, most common attacks are port scans, NETBIOS SMB-DS Session Setup, SNMP request, ICMP, etc. But there are more than 400 types of attack.

I would also like to integrate this honeypot with a currently deployed snort, for optimum data collection, what could be the best choice? or can i integrate different honeypot solutions?

Thanks ahead...

3
  • There are many different kinds of honeypots. What kind of honeypot are you looking for?
    – schroeder
    Jun 11, 2014 at 14:04
  • i'll rephrase the question... thanks for the feedback
    – Alonimus
    Jun 11, 2014 at 14:06
  • The attacks you mention are scans, which a honeypot is not going to help with: an IDS system will. Perhaps we need to know what data you hope to derive from a honeypot?
    – schroeder
    Jun 11, 2014 at 16:15

2 Answers 2

1

I have used an ssh honeypot on a VM in my internal networks. It's a specialized honeypot that gives me information on 2 areas:

  1. Anyone attempting to log in on port 22 is a bad actor and I can correlate the connection info with my traffic logs. I can also see what credentials are attempted to see what accounts might be compromised.
  2. Once the user logs in (it always lets them in), it records all keystrokes the user types, which is very useful in gathering data on the intent of the attacker as well as the level of sophistication of the attack.

For my needs, a high interactivity ssh honeypot works very well because the data it provides is useful. You need to choose a honeypot based on the data you hope to get and how you plan to use the data.

What I don't see from my chosen solution is attacks against other services like http, email, etc. It all comes down to what you want to protect.

0

There are a lot of options in this regard. If honeyd is the wa you are swinging let me say I'm a big fan of the NOVA project - it uses honeyd as a base and provides an easy to use web UI as well as data correlation facilities.

See novaproject.org for the official home page.

The Nova Project is open source. See the github page for the source and instructions for installing.

If you want something precompiled ADHD is an option.

3

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .