1

If a computer is setup as a honeypot and is on the same LAN with other computers, could other computers be attacked?

My thought is that if an attacker infects a honeypot with a worm, this worm would spread over the LAN to other computers. Am i right?

  • 2
    That depends on your network architecture and on the worm. – Philipp Jul 26 '14 at 11:50
  • In addition to answers that take technical aspects into account, please know that there are legal and moral considerations to running a honeypot. What if your honeypot is hacked (as it's sort-of intended to be) and then used as a base to attack someone else's systems? – Bob Brown Jul 26 '14 at 22:25
2

I would most certainly segment any would-be honeypots from the rest of your network. Truth be told I would be very careful about implementing something like this unless you know exactly what you're doing.

If you're planning on trying something like this I would recommend (at a minimum)

  • Create a different subnet / VLAN and put the honeypot on that.
  • Ensure proper firewall rules are in place that prevent forwarding of any traffic from the honepot network (in essence, a DMZ) to your primary network.
  • Create firewall rules that prevent administration of your networking device from that subnet
  • Use strong passwords on the rest of your network devices
  • Regularly monitor the honeypot and the rest of your network devices and monitor for compromise.
1

The obvious answer is: it depends. But the more sensible answer is: you don't need to put your honeypot on your production network, so why would you?

0

You would definitely want to configure VLANs for your honeypots and for other machines on the network to prevent communication between the zombies and clean machines.

It would also be advisable to keep the clean machines patched to prevent the risk of them being infected by vulnerabilities, and turn on any software-based firewalls the OS may include.

0

You're absolutely right! It is normally a separate system so that in case it's completely overwhelmed with viruses, trojans, and backdoors it only effects that system. Always separate it to keep your working system clean.

There are other methods (such as a DMZ aka Demilitarized Zone), but that would be much more difficult to implement.

  • Because nobody ever gained access to a system on a network through another compromised machine on that network... – DKNUCKLES Jul 26 '14 at 13:58
  • 1
    @DKNUCKLES I think you misunderstood the answer. The "absolutely!" might have confused you. It doesn't refer to the headline of the question, but to the statement at the end of the question body, which negates the initial question. – Philipp Jul 26 '14 at 14:33
  • My apologies @Philipp - You are correct and my apologies for the harsh tone. – DKNUCKLES Jul 27 '14 at 3:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.