1

If a computer is setup as a honeypot and is on the same LAN with other computers, could other computers be attacked?

My thought is that if an attacker infects a honeypot with a worm, this worm would spread over the LAN to other computers. Am i right?

Improve this question
2
  • 2
    That depends on your network architecture and on the worm.
    – Philipp
    Commented Jul 26, 2014 at 11:50
  • In addition to answers that take technical aspects into account, please know that there are legal and moral considerations to running a honeypot. What if your honeypot is hacked (as it's sort-of intended to be) and then used as a base to attack someone else's systems?
    – Bob Brown
    Commented Jul 26, 2014 at 22:25

4 Answers 4

Reset to default
2

I would most certainly segment any would-be honeypots from the rest of your network. Truth be told I would be very careful about implementing something like this unless you know exactly what you're doing.

If you're planning on trying something like this I would recommend (at a minimum)

  • Create a different subnet / VLAN and put the honeypot on that.
  • Ensure proper firewall rules are in place that prevent forwarding of any traffic from the honepot network (in essence, a DMZ) to your primary network.
  • Create firewall rules that prevent administration of your networking device from that subnet
  • Use strong passwords on the rest of your network devices
  • Regularly monitor the honeypot and the rest of your network devices and monitor for compromise.
Improve this answer
1

The obvious answer is: it depends. But the more sensible answer is: you don't need to put your honeypot on your production network, so why would you?

Improve this answer
0

You would definitely want to configure VLANs for your honeypots and for other machines on the network to prevent communication between the zombies and clean machines.

It would also be advisable to keep the clean machines patched to prevent the risk of them being infected by vulnerabilities, and turn on any software-based firewalls the OS may include.

Improve this answer
0

You're absolutely right! It is normally a separate system so that in case it's completely overwhelmed with viruses, trojans, and backdoors it only effects that system. Always separate it to keep your working system clean.

There are other methods (such as a DMZ aka Demilitarized Zone), but that would be much more difficult to implement.

Improve this answer
3
  • Because nobody ever gained access to a system on a network through another compromised machine on that network...
    – DKNUCKLES
    Commented Jul 26, 2014 at 13:58
  • 1
    @DKNUCKLES I think you misunderstood the answer. The "absolutely!" might have confused you. It doesn't refer to the headline of the question, but to the statement at the end of the question body, which negates the initial question.
    – Philipp
    Commented Jul 26, 2014 at 14:33
  • My apologies @Philipp - You are correct and my apologies for the harsh tone.
    – DKNUCKLES
    Commented Jul 27, 2014 at 3:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .