59

You're hurting yourself. The "attacker"/crawler... probably doesn't pay for their traffic or processing power (ie. they use a botnet, hijacked servers or at least are on a connection that doesn't make them pay for traffic), but you will be billed for traffic and CPU/storage/memory, or your server's hoster has a "fair usage" clause, under which your server's ...


51

Deploying a honeypot is not unlike adding a painted door or a fake safe to a bank vault. It does not deter anybody (its purpose is not to be detected as a honeypot). Possibly someone misspelled detect. It can reduce (somewhat) the time spent by attackers against the real door. Not by much. More than that, it can be optimized for data gathering (...


30

Ideally, no. A honeypot is a word used to define the purpose of a machine, but has no bearing on the machine itself, how it's configured or any particular software running on it. That said, someone creating a honeypot typically has the goal of luring targets into expending resources or breaking OpSec. To do this, they would present a goal that appears to ...


28

You can't simply Force a client, but to trick him! As long as the device's WiFi is running, it keeps sending probe requests, searching for your previous connected networks. Using some software like airodump-ng, you can easily sniff out those probes. Then the attacker may create a similar evil twin using the BSSID and ESSID gathered from the previous ...


28

Consider that serving anything other than HTTP 404 page for /administrator/index.php may get your server in the lists of potential targets, which means even more scans in the future. Since crackers who pay for such lists don't need to scan millions of IPs themselves, they can concentrate on you with much more sophisticated attacks than checking for the ...


25

Yes and no. They may not have your password in plaintext, but they have enough to potentially guess it and verify that guess (i.e. offline brute forcing). WPA2 authentication is performed through a four-way handshake. Instead of just sending your password in plaintext to any access point you connect to, this handshake ensures that unless both parties ...


21

There are mostly two kinds of attackers: the automatic, and the targeted. Automatic attackers are not humans; they are infected machines, part of various botnets, which try to expand their basis by finding other machines to infect. Their strategy is mostly random: they try random IP address for an open SSH server, then try common passwords for common ...


20

Honeypots are not a deterrent control, they are a detective control. As such, they can be very powerful in corporate, production networks. I run many honeypots and they provide a useful set of data apart from IDS/IPS. They can tell me the intent of an active attack, the sophistication of an attack, and any contact with a honeypot indicates a serious event. ...


19

Hmmm, how to tell if you have walked into a honeypot, let's see... The machine looks like it was just set up yesterday and the only thing it has on it besides default directories is a folder called "Sensitive" filled with page scans of old copies of 2600 and lists of mispelled names and address purporting to be employees of HB Gary. The mouse driver has the ...


16

As already said, its probably not worth it, but it is a very interesting topic to think about. There was a very good talk on that topic at DEF CON 21 called "Making Problems for Script Kiddies and Scanner Monkeys" which you can find here: https://www.youtube.com/watch?v=I3pNLB3Cq24 Several ideas are presented, and some are very simple and effective like ...


12

Forget the gigabytes. Use minutes or hours of delay. Many web servers have modules that introduce artificial delays (aka tarpits). It occupies a thread/process on your server, but it comforts a few other servers on the Internet who would have been probed during the time. Of course other bots and other threads of this bot continue their work, so the annoyance ...


11

I'm afraid all those IPs are nothing but victims clicking on phished/malicious links. Your client was hacked and malicious scripts were hosted on their server in order to infect inconspicuous victims. Whether you like it or not, your client contributed to spread malware. The next step for you is to just serve a 404 Not Found on those requests and make sure ...


10

Your idea of fingerprinting is very similar to wireless signals intelligence in WWII. Both sides used to have whole departments whose role was to learn the code style, or "fist" of the opposing side's wireless operators. By tracking these profiles and using radio direction finding they gained a surprising amount of information about troop and vessel ...


10

Usually a large number of log entries from a honeypot are from one of two reasons: Your environment is getting scanned like a smudged barcode. You made the mistake of putting your honeypot on a non-dark network. You've configured your honeypot as a pretty typical Windows desktop, so lots of Windows service active, open sharing, etc. What you are likely ...


10

I would call this an evil twin attack. And it's not uncommon to see corporate laptops vulnerable to this. WPA2-Enterprise supports a number of EAPs - Extensible Authentication Protocols. (Wikipedia article) The security depends on which EAP you use, and how you configure it. Some EAPs more vulnerable to an "evil twin" attack than PSK, as an attacker doesn't ...


9

Your problem is the placement of a honeypot. Consider that attackers will scan the internet to look for port 22 open, but they wont scan the whole IP space from start to end. Servers are concentrated in certain parts of the IP space. And similarly, simple internet subscribers are located in other parts of that space. So you have to use the IPs in the right ...


8

You're reading the proposal slightly wrong. This is not intended as a safeguard to detect an intrusion to already compromised system, but as means of detecting compromised system's database. This is a whole different scenario, where the attacker wouldn't already have gained access to the system by knowing any end user password, but somehow (improperly ...


8

The question reminded me of an article from a not so distant past that surprised me with a similar claim. I was able to find it again, it was "5 Reasons Every Company Should Have A Honeypot" on Dark Reading from October 2013. Summarized, their five reasons are: Attackers test their tools against standard anti-malware software, so a honeypot as a system ...


8

One comment by Luc raises an interesting concern. The problem for any site that would accept honeypot logs is to tell whether you're a trusted source or just full of it. They don't want you to accidently/maliciously include legitimate traffic in an attempt to ruin those user's reputations or simply "dilute" the pool by flooding it with meaningless traffic ...


8

There are a few methods that could have been used: Devices of all sorts that use WiFi connection usually have a setting that lets the device connect automatically when the same SSID is out there. This is usually set by default and users do not usually turn it off. Hak5 generated a list of many many public WiFi SSID's (Ex: "MacDonald's free wifi") that the ...


7

I've had this happen to me before and realizing to them that their time is money, I decided to take them on a little ride (it was a Sunday and I was bored...don't judge me). Basically I pretended to be a complete computer luddite - kept them on the phone for a good hour pretending like I had no idea what I was doing. I could't find the event viewer, didn't ...


7

It depends of the honeypot you are using. If you are using a low or medium interaction honeypot that only emulates some services, than the chances are very low that the attacker can break out of the honeypot (except if he finds a bug in the honeypot itself). If you are using full interaction honeypots, like a real Windows machine, that the chances are high ...


6

You could setup a honeypot, and add your additional logging systems. This will produce results, although probably not the results you are looking for. In the real world, most compromises are with bots, so keystrokes don't apply.


6

Your honey pot will be taken over by the attacker; that's the point. So anything that can be done from that machine will be power granted to the attacker. Therefore, you should configure things such that the attacker does not gain any new power that way. This means the following: All other machines in your network MUST consider the honey pot as hostile (...


6

It is easy to construct a password hash that does not match any password. One of many ways to achieve this would be to store a hash value along with a different salt from the one it was computed from. A password hash constructed that way would never match an actual password unless you constructed a collision in the underlying hash. Regardless of the method ...


6

A Honeypot will not control connections, so if that is what you want then you are not looking at the right technology. Honeypots emulate real systems, so unless you actively prevent it, it will be able to attack other systems, exactly as if it was a real system. This site has other questions in setting up honeypots, so just have a read of them.


6

This is a topic near and dear to my heart, I've battled bots etc for ages. My conclusion is that your best strategy always, though not very gratifying, is to simply absorb the traffic, that is, detect that it is a bot, and then neutralize any further action on its part, without giving any programmatically obvious indication that you have done so (obvious ...


5

If they are already in your network, just adding a honeypot may or may not be effective - you don't know what they already know of your network. Do they know the IP ranges for HR, finance, data storage systems etc? Do they have access to your change management system and would spot a new addition to the network? Have they already backdoored the servers ...


5

By the definition of a honey pot, no, they are not a prevention tool. Honeypots are a tool for behavioral analysis (by seeing what kind of data they are after), slowing an attacker down (by giving them large amounts of noise to manipulate), or fingerprinting an attacker (you have a copy of all the files in the honeypot, and you can compare their downloads ...


5

This kind of scam requires a lot of manpower, so the calls come from a country where labour is very cheap -- in particular, not from the USA. So you may as well give up any hope of "catching" the scammer. What you should do depends on your own goals and feelings. Personally, I give a very high value to my own time; therefore, I would indulge in some scammer-...


Only top voted, non community-wiki answers of a minimum length are eligible