802.11b Honeypots Open for Business

11thangel writes "SecurityFocus is running a story about a wireless honeypot project, being run by the SAIC. The setup consists of 5 Cisco access points in the Washington D.C. area, with two extra antennas (high gain omni's) plugged in. The network itself has a bunch of comps with various vulnerabilities, similar to a traditional honeypot. At the present, the network doesn't have a net connection, but the administrator is considering hooking it through a web proxy that would add a consent-to-monitor banner, so he can watch who's doing what. Time to find a WiFi card that can MAC-hop."

Comments

Honeypots

[rustycage]

O' bother.

Useful?

[ipjohnson]

How useful can this be? it was just announced on slashdot .... hackers don't read slashdot?

Warchalk

[Malc]

I guess the warchalkers should add another symbol to their icons to warn people about honeypots. Although I suppose this could be abused by the owners of the access points trying to dissuade from hooking up.

Re:Warchalk

[dattaway]

Using a honeypot for an access point by a casual user might be safer than other people's motives for setting up an open system. You don't know who is providing you with that signal and if they are sniffing for cookies and passwords. Is it just a clueless person who owns an access port? Or is it someone who is looking for interesting user habits that he hasn't learned to sniff directly from the cable?

Common sense would dictate never to use an untrusted network for personal information, but I can see it now: people in the park with a laptop will connect to an unknown system and start chatting their personal problems on irc. The Senator's son doing this? Never happen! ;)

Changing the MAC

[stere0]

# ifconfig eth1 hw ether [mac] , where eth1 is your interface and [mac] your MAC, should work

Re:*sigh*

[Delta-9]

I agree. I don't buy the statement that they are using it to figure out the "tricks of the trade." Anyone can figure out the tricks of the trade by browsing a couple websites. I found netstumbler after doing very little research into this matter.

They are laying the groundwork for controlling and making precedent for what is "unauthorized access." Don't be suprised when someone is arrested for browsing /. from a public transportation bench in the near future. Its a shame that so many sysadmins can't do their job that people like this have to do it for them.

Re:Our Nation's Capital

[Anonymous Coward]

You need to hang out in "Cyberpunkia", it's a hidden area (cloaked) in DC, reachable only by a special hidden stop on the Metro (between Tenleytown and Van Ness). When the train reaches the half way point (where it turns a bit), you need to do an emergency train stop, open the door, and enter the hidden door (open it with your laptop). I know it sounds kinda complicated, but once you do it once, it's easy to do again.

Re:*sigh*

[Oculus Habent]

Just one example of why 802.11 isn't really an ideal protocol for public networks.

802.11 isn't a service or a communications protocol, it's a network layer. This is like complaining that 100 base-T doesn't have a MOTD

Brand new MOTD for cat5e! Just enter the message you want with this 1Hz binary input rocker switch, and in just minutes (depending on message length and encoding*) you can improperly interrupt network communications with a hardware-layer message.

* Available in ISO 8859-1, ISO 8859-6, and Unicode. Check with local suppliers for availability. Comes with free hexadecimalbinary convertor chart.