1

Due recent breaches that have occurred using weak remote access application passwords. I would like to setup my own honey pot on a windows machine to study their malicious intents. This is pretty easy I will install RDP, VNC and other such like applications and put a weak password.

The second objective of the study

I want to build a list of weak passwords that attackers use, how can I get the passwords ?

I you would like to know how you would do it. I understand that are linux distros for honeypots. But I prefer using a Windows Machine because I have a VPS that I don't use and is running Windows, changing the OS is impossible.

Thanks

  • You should break the two questions up into two questions, since they are not particularly related to each other. – Jeff-Inventor ChromeOS Aug 21 '14 at 23:03
3

You don't need to set up a honeypot to accomplish either of these. I can tell you exactly what their intentions are once they've compromised a machine. Depending on who gets lucky enough to brute force your credentials first, you can bet they will do one or more of the following :

  • Send out spam / distribute malicious content from your server
  • Use it as a VPN server to connect to in order to perform other malicious tasks using your public IP address
  • Utilize it as a Command and Control server for Malware
  • Use the newly compromised host to perform various attacks on other computers on the internal network. Compromises become much easier once you've bypassed the firewall
  • Install a back door to ensure continuous access to the system.

Finding a list of weak passwords that are being used should be relatively trivial. There is a lot of risk in setting up a honeypot, and from what I gather about what you're hoping to accomplish, not a lot of gain. As the owner of the VPS you are ultimately responsible for the activities that occur on it, so if someone with malicious intents compromises your box because you set up a honeypot and didn't take the proper precautions to contain the damage, you will ultimately be responsible.

In addition, I would also think that setting up a VPS for the purposes of a honeypot would violate the TOS that you agreed to when procuring the VPS.

  • 2
    Thanks for your help but if I want to do it I want to know how is done properly. Not interested in arguments why I should not do it. – opc0de Aug 21 '14 at 18:35
1

To your second question, on building a list of weak passwords:

You don't necessarily need a honey pot.

Weak passwords and passwords in use by hacker can be detected as part of a regular course of business. One strategy that seems to work is monitoring your login system for login attempts that (1) fail, (2) appear to be coming from an attacker based on other factors, such as multiple failed login attempts associated with an unknown browser, unknown IP, and/or multiple accounts.

Even if you suspect the password guessing attempt is coming from an attacker, you should log it as a hash rather than a cleartext password, so that you don't accidentally risk the security of any real users who might be flagged as a hacker for behavioral reasons. You can then use the hashes to determine if any given password is in the list of vulnerable hashed passwords.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.