61
votes
Accepted
Giving malicious crawlers and scripts a hard time
You're hurting yourself.
The "attacker"/crawler... probably doesn't pay for their traffic or processing power (ie. they use a botnet, hijacked servers or at least are on a connection that doesn't ...
- 6,284
39
votes
Accepted
How can I get more spam for my honeypot?
Spammers will "scrape" the internet for email addresses and use programs to collect millions of addresses. Or just download them.
If you want your email address to be picked up by spammers, ...
- 132k
28
votes
Giving malicious crawlers and scripts a hard time
Consider that serving anything other than HTTP 404 page for /administrator/index.php may get your server in the lists of potential targets, which means even more scans in the future. Since crackers ...
- 10.2k
20
votes
How can I get more spam for my honeypot?
Besides the other good answers, I suggest setting up a catch-all email address. You'll find that a lot of spam goes to info@, webmaster@, postmaster@, abuse@ and so on. This typically requires that ...
- 3,434
16
votes
Giving malicious crawlers and scripts a hard time
As already said, its probably not worth it, but it is a very interesting topic to think about. There was a very good talk on that topic at DEF CON 21 called "Making Problems for Script Kiddies and ...
- 2,299
12
votes
Giving malicious crawlers and scripts a hard time
Forget the gigabytes. Use minutes or hours of delay. Many web servers have modules that introduce artificial delays (aka tarpits). It occupies a thread/process on your server, but it comforts a few ...
- 1,202
12
votes
How can I get more spam for my honeypot?
I have been using unique email addresses for each site and service for the past 15 years. So a simple grep lets me calculate how much spam is coming to each address.
While anecdotal and only ...
- 1,457
6
votes
Giving malicious crawlers and scripts a hard time
This is a topic near and dear to my heart, I've battled bots etc for ages. My conclusion is that your best strategy always, though not very gratifying, is to simply absorb the traffic, that is, detect ...
- 161
6
votes
How can I get more spam for my honeypot?
There are as many ways of harvesting emails for malicious use as there are villains on the internet.
IMPORTANT: most of these methods are outright illegal in most jurisdictions; and some will put you ...
- 34.7k
5
votes
Accepted
Cowrie as a decoy on production server: is it a good idea?
Custom-coded honeypots should not be run on production servers. Honeypots are meant to gather data, but are not meant to be unbreakable. The Dev for Cowrie says in his FAQ:
However, Cowrie has not ...
- 132k
5
votes
Fingerprint ssh attack tool
First, the pattern of behavior you're seeing is likely because the malware has detected that it's running in a sandboxed environment. CPU count for your honeypot should be greater than two, if it's ...
- 387
5
votes
How can I get more spam for my honeypot?
I worked on the past on anti spam solutions and the process that we used to do where access with ToR to the deep web and subscribe to nasty places and subscribe to forums all over the place.
- 2,294
4
votes
Accepted
Why aren't telnet bots finishing the three-way handshake?
They are performing port scans, not trying to establish a connection.
This specific scanning technique is called a SYN scan. The idea is that you don't have to complete the entire TCP handshake to ...
- 45.1k
4
votes
How relevant is the honeypot technique today?
One good way, to find what today's industry is using, it's to track reports as Magic Quadrant.
Magic Quadrant (MQ) refers to a series published by IT consulting firm Gartner of market research ...
- 572
4
votes
Do blue teams plant CTF like canaries across infrastructure?
What you have described is a medium- or high-interaction honeypot, honeyusers, and honeyrecords. The technique has been around for many years.
Honeypots within the perimeter of your network can be ...
- 132k
3
votes
How relevant is the honeypot technique today?
The area of deception technology (this involves honeypots and honeytokens among others) is actively researched. The SPACECRAB project by the Atlassian security team is one example.
Have a look at ...
- 131
3
votes
How to store malware executables?
Logging attackers will be highly dependent on how you set up the honeypot system you describe. What methods you expect (or don't expect) attackers to use to acquire access and what they do within the ...
- 1,664
3
votes
Accepted
What are the dangers of exposing weakly protected user accounts bound with a fake shell over ssh?
The shell is probably the least of your concern. The SSH server is a large piece of software with many features provided to anyone who can log in. Maybe one of the most naive hazards would be that ...
- 3,299
3
votes
Accepted
Decoding Honeypot Payload
\x16\x03\x03...
This is the begin of a TLS record and it looks like a start of a TLS handshake (i.e. HTTPS or similar). There is no plain text apart from maybe the target hostname if the client uses ...
- 208k
3
votes
Concerning The OWASP Security Guidelines As They Apply To Site Registration / Could honeypotting work?
From a security standpoint try to understand what advantages a honeypot adds.
When you design your security you should try simulate real world scenarios with an intelligent attacker and how your ...
- 154
3
votes
How can I get more spam for my honeypot?
Another way for hackers to get your email is if they compromised an website you are registered on and they downloaded the database and just separated the emails & usernames columns, so this is how ...
- 162
2
votes
Is it a good approach to deploy a honeypot behind the firewall
The architecture that you're suggesting would allow you to capture potentially malicious traffic directed at services running on the ports that you forward from the public IP address.
If that's your ...
- 62.6k
2
votes
Accepted
False, honeypot like wifi
Something that may interest you are "googledorks"; these are searches people execute to find various things on the web. Googling for "googledorks web camera" will give you many signatures that people ...
- 34.7k
2
votes
How to store malware executables?
I would advice virtual environment or a reboot and restore software like deep freeze. You can record execution using sysinternals or recording facility of your virtualization provider. Be advised that ...
- 359
2
votes
Accepted
Do the 'bad guys' create honeypots?
'Good guys' have to limit their actions to things that are 'good,' in order to remain 'good guys.'
'Bad guys' have no such restriction. They can get away with creating honeypots, telling the truth ...
- 154
2
votes
The Shadow Server Foundation constantly trying to get access to mDNSResponder
Assumption
Those websites are (for the most of them) well known honeypots.
They are designed to do lots of things, including luring bots into their networks.
I dont think the shadow server foundation ...
- 1,713
2
votes
Can a honeypot really deflect damage back to the attacker?
Borrowing from the other answers & comments coz I agree with them:
Deflect = Not-the-same-as reflect back to the attacker.
The common practice that comes to mind in this context is this:
Your ...
- 2,656
2
votes
Is there any interest in purchasing honeypot traffic data?
Short answer: No. For 3 reasons.
First, there is little value in an amateur's personally collected data. One cannot know the errors, flaws, inconsistencies, etc. So, one would be buying very "dirty" ...
- 132k
2
votes
Additional risks to home network in exposing (raspberry pi) honeypot to the internet
A wider exposure surface
That is correct. In case you did not open any ports to the internet so far and you open one now the direct consequence is a wider surface.
In my point of view the indirect ...
- 2,084
Only top scored, non community-wiki answers of a minimum length are eligible