Slashdot Mirror
Honeytokens: The Other Honeypot
martyros writes "I just read a fascinating article
by Lance Spitzner securityfocus.com about a concept he calls
honeytokens. The idea is similar to that of a
honeypot, which he defines as "an information system resource whose value lies in unauthorized or illicit use of that resource". Rather than having a computer that's designed to be broken into, however, you have say, a record in a database or a file has no legitimate use; ergo, if anyone uses it, it must be illegitimate. An example he gives: adding a record to the hospital database for a guy named "John F. Kennedy". It doesn't correspond to a real person, so no one has any business looking at the file. If someone does access it, you know that they're abusing their privileges somehow.
The article has several other clever examples, which I found very thought-provoking."
Or there's a flaw in your software.
Or they were poking around bored.
Or you've been hacked in which case you won't have an access record anyway if the hacker did their job right.
Yes, quite superior to a honeypot, in every way.
The key to the enjoyment of pop music is to replace any instance of "love" with "C.H.U.D."
I seed all my pages with special "token" email addresses that will only be found by a spammer using harvesting software (or a really really bored user). Normal people will never find it and never want to use it. It works amazingly well.
This sort of thing has been around for decades. I remember as far back as the early 1970s, hobbyist magazines' "Buyer's Guide" issues would have deliberately bogus entries to ensure that their competitors didn't steal the data wholesale for their own buyer's guides.
I've used the same concept before on my work computer. I plant suspiciously named files on my desktop or (usually) less obvious places so if someone tries to search my computer and comes across this file, reports its contents, and I hear about it, I know it's time to change my password ;)
KappaStone
What corporation in this post dot-bomb era wastes resources and employee time on bogus bughunts like this anyways?
These all sound like over elaborate rube goldberg devices to secure the doggy door on your house.
I don't need no instructions to know how to rock!!!!
This is an interesting use of a known technique to help detect the unauthorized use of data, and alert administrators that the barn door is open--and maybe even who opened it.
Call (206) 338-5780 COLLECT for information about a genuine BA, BS, MA, MS, MBA, or Ph.D.
What happens if someone does a search for that happens to find "John F. Kennedy" and several other patients. Does that mean the person was in the wrong place?
The problem with this (and with a lesser degree, with honeypots) is that these tokens will get accessed in legitimate ways -- for example, what if your secretarial staff is creating a mailing list, and "JFK" gets sent something? Or you have a browse function in an application that uses the database?
It's a good idea, but not a panacea.
named John F. Kennedy at your hospital?
An example he gives: adding a record to the hospital database for a guy named "John F. Kennedy". It doesn't correspond to a real person, so no one has any business looking at the file.
Of course, there are some places where "John F. Kennedy" is a perfectly valid database entry. Actually, it's a database entry for which a lot of people make it their business to look at the file.
Which, I suppose, shows exactly why the Honeytoken concept makes sense...
Stressed? Me? Of course not. Stress is what a rubber band feels before it breaks, silly.
So here is the google cache of the article.
Yahoo (and presumably other search engines follow suit) keeps some bogus entries in the DB so they can detect someone stealing their whole DB.
Some print newspapers run bogus classified ads so they can detect a competitor trying to bulk up their own classified section.
Some anti-spam companies post to newsgroups specifically to get addresses harvested; any email to those addresses is the sign of a spammer.
Handy, but hardly breaking news. Might as well run an article about a researcher discovering the usefulness of packet switched networks.
Cheers
-b
To: Chief Financial Officer
From: Security help desk
Subject: Access to financial database
Sir,
The security team has updated your access to the company's financial
records. Your new login and password to the system can be found below.
If you need any help or assistance, do not hesitate to contact us.
https://finances.ourcompany.com
login: cfo
password: H0n3yt0k3n
Security Help Desk
-----------------------
Ok... whats stopping the Chief Financial Officer from logging in on that account...
Security 1: Hacker!.. Fry Him!!!
Security 2: Oops!
Security 1: Sorry boss!
Warning: This sig contains a small bug. ==> *
Maps have had these for years; they call them 'ducks.' Bogus small roads that don't exist for instance. If they show up on a competitor's map, they're poaching.
Strangely, couldn't find a reference to this on google. I wonder if google themselves practice this kind of thing...
-- Tristero
Otherwise though, I've been aware of these sorts of misuse/abuse detection schemes for some time- specifically in the area of email harvesting for spam. Place a fake or otherwise unused address in a list or directory, and if it ever receives mail, you know the sender was harvesting.
Another good example would be the RIAA putting bogus music files on P2P networks. For example, if you query and download a file that is named "Metallica - Enter Sandman.mp3" then chances are you have other files that are of dubious lineage.
The sword here cuts both ways, unfortunately.
----
Like listening to music? Then use Fission, the MP3 player with a brain!
By the way, John F. Kennedy was a real person...
:)
Gah! Don't the editors check stories anymore?
By placing arsenic in your water bottle that you leave in the refrigerator, you can tell who's been pilfering your lunch.
Best Windows Freeware
If records are globally viewable, or easily accessed without particular trouble, curiousity might lead people who otherwise wouldn't look through something to peek. Granted, in the JFK/Hospital example, people really should no poke around, but in other Internet based examples, curiousity is common. Lock stuff up a bit if you want to keep the honest people out, it's much more legitimate than leaving it open yet without having business.
And before someone makes an analogy to leaving one's house's door unlocked, Like computers, I lock my front door unless I'm expecting company.
Do not look into laser with remaining eye.
...several years in fact, although in a different form.
A while back a bunch of businesses created a website called slashdot to monitor people who were surfing the net instead of doing work.
Famous Last Words: "hmm...wikipedia says it's edible"
Phone listings are not proprietary - anyone can publish a phone book. But you can't copy someone else's publication (like the telco's official phone book.)
In order to tell if a third-party phone book is legal or not, the telcos put a bunch of bogus listings in ever one. When third-party books are published, the telco can check to see if the bogus listings are in it. If they are, then they know that the book is an illegal copy of the telco's phone book. A book that doesn't pirate the telco's book (e.g. using listings purchased from the telco or by asking people to contribute contact information) will not have those listings in it.
This sounds like the same concept applied to a new purpose.
Every year I pack razor blades into mini candy bars and give them out during Halloween, as kids really shouldn't be taking candy from strangers.
I call them HoneyBlades.
This really strikes me as a wasteful use of resources (as someone already pointed out earlier). However, this whole concept (honeypot, honeytoken) shows how people are so paranoid they INVITE other people to prove them right.
It's like this: Let's say there's a ravine. This ravine is in a somewhat dangerous area of the mountains, and so people are generally told to avoid it. However, this ravine is the shortest walking distance between two towns. Some park ranger with an inflated sense of superiority and WAY to much time on his hands decided that this ravine is now OFF LIMITS because it's dangerous, so he plants some mines. If people step on the mines, well, it's their fault, because the park ranger declared the ravine off limits.
I have no tag line
I can see someone accessing a record just because it's interesting.
A bored nurse at a hospital is browsing through patient files, sees "John F. Kennedy", and for shits and giggles, opens the record to see if he had a gunshot wound to the head.
Same if you call it "Bwana Guana the Flying Butt Monkey", or hide the file, or someone notices that it hasn't been accessed since last year, etc.
PC moderators can suck my White pierced, tattooed dick. If you think pride == hate, s/dick/Aryan meat mallet/g.
(Oh yeah, and that whole thing about the moon landing being a sham is the creation of Fox. We really did make it to the moon the same year UNIX burst forth into this world.)
You can't judge a book by the way it wears its hair.
Sorry, I messed up the link. Its working now ;).
Fred Saberhagen describes using a Honeytoken to defeat an enemy in one of his Berserker stories. Apparently it's an old Dictionary & Encyclopeadia Publishers trick to prevent plagiarism. they put in a number of reasonable entries that nobody's ever going to need, and if anybody copies them, they know they've been plagiarised, and can prove it in court
'He copied our encyclopaedia, and we know this because he has entries we made up out of whole cloth.'
"You've got an invalid haircut" -Warren Zevon - Life'll Kill Ya
So how does the batch processing that runs against most databases work out the bogus records? You'd need a "bogus" flag or an exclude file. This is the kind of stuff that has systems pumping out thousands of letters to "John F. Kennedy" reminding him that his payment is overdue... Once this mechanism is embedded in the system design, then it will become widely known, and everyone including the janitor's dog will know that they will get fired if they look that the JFK record.
As an academic exercise, great. In the real world..no thanks. However the principle of slightly altering documents to catch the unwary is an old one - the person thinks the document is a copy, whereas it is really unique to them - they publish on f**kedcompany - and they get busted.
Telephone companies have been doing this for years.
They list bogus entries in phone books and then scan other lists for occurrences of these entries. Subscriber lists and customer information is copyrighted and non-freely-distributable, supposedly (these terms may be slightly wrong).
If they start showing up in other databases (like other companies' phone books), calls are made. It's an excellent way to prevent the copying of their property en masse.
The dangers of knowledge trigger emotional distress in human beings.
Nothing better to do than harrass the employees with this kind of crap. Lets hope they actually have thousands or at least hundreds of employees that they have to "keep honest". Keeping them "honest" usually involves covering up the bosses theft of company inventory, etc. if "paying off" snitchs with extra perks isn't enough. When the Boss steals, it's big-time, way more than any of you make in a year at your salaried job. Lots of tools here to keep these pieces of crap going. Hats off to the whistle blowers among us. Placing baited things around has been bastard bosses main trick for past 100 years or more. I have a boss who "placed" a $10.00 bill in the trash to see who was honest. I pointed it out to a known petty-thief of an employee, and that bill was history. Bought a big can of coffee for all to enjoy, true "Robin Hood" style. Boss placed his very own checkbook in the restroom just today, and guess what, it was found by a visiting customer! You get the idea. Our rights as workers are being pi**ed on by these sorry excuses for management.
When I fill out forms or give out personal information, I will deliberately put in some erroneous data. For instance, putting X as my middle initial or putting an apartment number on the address for my house. Now when I get junk mail I can figure who is selling or giving away my information and stop doing business with those entities.
These are just another tool, which when employed with other layers of tools, *may* help provide you some circumstantial evidence of malintent.
As noted in other comments, if you just put in some trigger to notice on the database system itself if anyone access JFK's record - well, if the database system is compromised, the trigger can be bypassed as well. It will catch only "legit" accesses without system compromise - as in someone pulling the record through a normal interface such as a hospital records application, in which case the failure was on the part of whoever implemented your security policies and allowed the record to be accessed through this interface, it was not a hack.
The more interesting usage is the fake SSNs and CCs. These could prove more useful it would seem. If 5% of the credit cards in your company's database are known-fakes, and you register these known-fakes with Visa/MC centrally, then even if your DB was infiltrated carefully, they'll be caught when they try to use the numbers by Visa or MC themselves, a seperate system unlikely to have been simultaneously compromised.
But for numbers like SSNs and CCs, this really isn't a solution, it just raises the bar a notch. If this were common practice, then the intelligent theif would rip off CC databases from 2-3 seperate major retailers and compare them to figure out which were dupes. If there was a central list of fake cards from Visa that everyone used so that they matched, you'd just have to work at another company that also used the dupe list to have your own copy of the numbers to avoid. In the case of SSNs, before you go off using them for malicious purposes, you'd probably compare them against another database from state driver records or some such thing to filter out the bad ones...
In other words, you've made their job a bit harder, but it's not a magic bullet by far, nothing ever will be.
11*43+456^2
As has been pointed out in numerous replies, this practice has existed for decades if not centuries. The earliest version I am aware of was done by Almanacs and Encyclopedia's. Unindexed and uncross-referenced articles would be inserted on the theory that nobody except a copier would find them.
So all veteran /. readers should be awaiting a story on the issuance of a patent covering the technique.
I'm pretty sure you can leave access to that thing wide open and it'll still be as safe and untouched as if it were translated to Navajo and encrypted with 3DES.
the major advances in civilization are processes which all but wreck the societies in which they occur - A.N. White
I guess you didn't see this in the beginning of the article.
"While the concept of honeytokens may not be new (think Cliff Stoll and The Cuckoo's Egg), the term is."
Maybe you should educate the morons of tomorrow so they'll stop believing the leaders of tomorrow. - Dogbert
Or they were poking around bored.
Or there's a flaw in your software.
Well, then you'll just end up with a record of an 'intrusion' from localhost. if there is something wrong with your software, you should fix it anyway.
Or they were poking around bored.
The whole point is that they shouldn't be poking around. I certanly wouldn't want hospital employees 'poking around' in medical records. If someone is 'poking around' in sensitive data, then they are a hacker. If it's someone from your organization, you should either bitch at 'em or fire 'em, depending on what kind of work you do.
Or you've been hacked in which case you won't have an access record anyway if the hacker did their job right.
Not if you burn logs straight to a multisession CD...
autopr0n is like, down and stuff.
Isn't this what the cops/lawyers call "entrapment"?
Reading Slashdot is ruining my spelling and grammar.
I first saw it mentioned at Black Hat 2002 in Vegas last year. The idea was that you would create fake session tokens for web applications and then monitor them for access by applications trying to brute force the session token values.
I mentioned it to a web developer who said that the idea has actually been implemented in some of the large e-commerce sites he's worked on.
-- thalakan
I don't see this as a false alarm at all. Nobody is allowed to access a patient's records "for shits and giggles." Doing so is a violation and this person would be caught and rightfully so. Hopefully, they would lose their job, and be forced into a life of crime to support their family.
sHi
This idea sounds good on paper, but won't work in practice.
... updating information, reporting, etc.
... enable some form of auditing on the database server. Ok, but then the flaw... how does the auditing system know which data reads are good and which are bad? Even on a bogus fake record, there will be legitimate data reads by the application software that uses the database.
Here's the flaw... how does the system know when data is being accessed illegitimately? Just because there's a dummy record in a database, doesn't mean that it won't be accessed. The example given with the patient table fails to account for times when the software itself will access the data for various purposes
Exactly how would one go about monitoring data access? In theory, it's simple
Skiers and Riders -- http://www.snowjournal.com
It's also called "salting" the records, or seeding the records as well. It's been used for ages. Last time I remember seeing it on a large scale was with those whole-country telephone databases on CD that were popular in the 1990's, before they were availabel free on the net. Some companies were rather restrictive with the licenses, and prohibited using the databases for mailing lists, cold calls, etc., and seeded the database with fake entries so they could tell when it was being abused.
jX [ Make everything as simple as possible, but no simpler. - Einstein ]
Folks who rent mailing lists add "ringers," which, if they receive a mailing after the term of the rental is up, yield prima facie evidence of violation of the rental contract.
I can't think of a single legitimate reason to 'rent' a mailing list.
autopr0n is like, down and stuff.
I worked for one of the largest shareware catalog companies (yeah, way back then, my first job :), and had to write software that would come up with the reports of what customers were interested in, when they last purchased, etc. etc. etc.
:)
Whenever our company would sell this targeted list of previous customers to other companies, they would also insert several bogus names that led back to our owners. Each name was setup to recieve a particular piece of junk mail. This list could only be used by that company X many times.
That way, as soon as that other company sold our names to a 3rd party, we could sue.
I obviously don't work there any more.
You quitting proves that the karma kap worked. The most annoying of the whores shut up. --CmdrTaco
Are you coming on to me?
It was the honey that did it, wasn't it?
I knew I was probably doing it wrong.
There are some odd things afoot now, in the Villa Straylight.
http://www.google.com/search?q=cache:dj4HQ76j-R4J: www.securityfocus.com/infocus/1703&hl=en&ie=UT F-8
One reason this idea would be especially good for hospitals is because such actions have gotten hospitals sued in the past. Simply put, no hospital employee is supposed to view a patient's information unless required. So, if Nurse Betty is looking up "John F. Kennedan's" file, and also sneaks a peek at "John F. Kennedy's", she just broke federal law, and the hospital is going to want to know about that.
As for false positives in other instances, people seem to be just trolling. For example, every single day at a former employer of mine, a cell phone provider, we'd get false positives on customer who may or may not have been using fraudulent information to sign up for service. As such, we would stop and call the verification services we used, and verify that customer. So sure, out of thirty customers a day, it would generate five warnings, four of which were false. But one of them wasn't, and that makes all the difference.
Theres never going to be some "All seeing Eye of God" security system, but every little bit helps. Especially, as noted, in both banking and hospitals, where customer's information is bound to a need-to-know basis by federal law.
Mod Points: Helping you keep your opinion to yourself.
I have a police officer friend in Sacramento who says that people through out the database have been randomly flagged by internal affairs. If you come across one of the flagged entries they may decided to ask you what reason you had for accessing the file. If you can not provide a resonable answer; backed up with proof i.e.: We found this guy drunk driving so we wanted to see if he had a previous record. This seems to be a much more efficient (and some how honest) way to do the same thing rather than try and entice people to incriminate themselves.
It's mildly amusing to track how your name gets sold to credit cards and magazines and such. You may even get a telemarketer calling for Mr. J Quincy! Woo-hoo!
A bored nurse at a hospital is browsing through patient files, sees "John F. Kennedy", and for shits and giggles, opens the record to see if he had a gunshot wound to the head.
I don't think Nurses are supposed to be able read through random people's medical files out of bordom. There are all kinds of crazy regulations required by the HIPA or whatever for handling medical information in the US as it is.
autopr0n is like, down and stuff.
ergo it would see somone has been watching the Matrix ;)
cat
As far as I can tell, "honeytoken" is just a nice sounding buzzword for an ages-old technique.
Or sign up your Dog for various things and see how much his name gets around.
I can imagine this reaching some level in intranet circles. This is not a new idea.... In fact, it's far more common in real life. You know, social engineering and all that stuff. As a quick example, the only thing memorable about "Eyes Wide Shut" was the "musican's password" goofup.
Appreciate it.
People have been doing this for ages, at least out here in the "really real world".
Mapmakers put fake cities on their maps in obscure places, so that they can tell whether another mapmaker just copied their maps (illegal) or whether they went out and compiled their own information.
Folks who put together directories (like phone books) that forbid their use by telemarketers put fake people (with real phone numbers) in there to identify telemarketers that are illegally using the directory as a basis for telemarking calls.
There's even a sort-of-backwards example from cryptography, that I believe Schneier came up with. You are all probably familiar with the basic concept that if you crack someone's crypto, you can't use the info you get from cracking their crypto unless you can plausibly explain how you got that info by another mechanism. There are big chunks of Cryptonomicon dedicated to this idea, and it's a real idea. Well, one way to tell if your crypto has been hacked is to find a really funny joke and to transmit it only by your crypto mechanism. Most folks who'd crack your crypto would have a hard time believing that the cleartext of the joke was never transmitted anywhere, so they see less reason to be anal about the normal procedures. So, you watch to see if the joke "leaks out" into the world. If so, and if you maintained other security, then your crypto has been broken.
You'll find all sorts of examples of this basic idea, going back for centuries.
basically because of a honeytoken like entity
someone at installshield had an entry in some internal company data source using her maiden name (and had used her maiden name nowhere else). she recieved solicitations from wise and got suspicious.
now installshield is sueing the hell out of wise, see this article, and this news release
Already been done.
I automatically generated reports on that basis.
I also generated reports for probes to some of the other 'nasty' ports.
Free Software: Like love, it grows best when given away.
Certain atlas publishers have been known to add nonexistent roads and towns to their maps in order to identify copies.
Hi Slashdot People! (Score:6, Insightful)
by John F. Kennedy (666) on 2003.07.17 16:38 (#666)
I love Windows! It never crashes. Linux Sucks. Hilary Rosen is having my baby. Filesharers are evil. Lessig is a communist. Matrix Reloaded Sucked. The Twin Towers Sucked. Online gamers are asocial dweebs. No, you cannot make a beowulf cluster of these. Nothing like this whatsoever happens in Soviet Russia.
[ Reply to This ]
666 replies beneath your current threshold.
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
This sounds similar to (but distinct from) the Canary Trap that Tom Clancy described in one of his novels. I think it was "Cardinal of the Kremlin," though I may be wrong. I don't know if the idea was Clancy's originally, but that's where I saw it. Basically, each copy of a classified report has various meaningless differences, like an intentional misspelling or use of a different phrase. Each person is given a slightly different and unique version of the report. If it ends up being leaked, it's relatively straightforward to figure out where the leak originated. I guess that sounds a lot like watermarking/fingerprinting files as well, though this was for both hard and soft copies.
You have a choice: tax and spend Democrats, or borrow and spend Republicans. Choose wisely.
Friendly Fun,
... built from common interest and a few ... to much trouble. .... ... there were, I think, other gaffs. I know the F-500 company I work for has plenty of dupes. ....
Oh Boy! I like this, I can have fun at work. I can just do a little after work beer drinking with the network Gestapo and maybe some other stuff come up with some mutual interest topic. Then, I do an attack search for a few select terms, names, phrases,
Maybe, after $30 of beer, just ask "What are honeychips and honeypots?" [I know honeytoken, but I don't know what I am talking about]. I then remember the slurred examples with intent and context. Auh Heck, to much trouble, I'll do it my old fashion way
Next day I do a few innocent (stealthy) searches for information, identify probable honeytokens of interest, then surreptitiously share with the curiously paranoid (most of us humans) individuals. Then let them search for and access the honeytokens.
Great practical joke on a few managers and Bosses. I am willing to bet I can get a CIO a/o CTO to fall for the joke. I mean, I know the DoD CIOs implemented PKI for everyone in DoD, then forgot (or never knew) that a private e-Signature smartcard (non-biomet) encryption key does not have a DoD Master-key to unlock all the encrypted files wanted for a criminal investigation. Oh, whoops
I would never do it, but I would not want to work at a company that laid traps that anyone could fall in, due to normal curiosity and the right manipulation. Sounds like entrapment and poor ethics
OldHawk777
Reality is a self-induced hallucination.
Unaccountable leaders are masters, and unrepresented people are slaves. How do US and EU fare?
Nothing new here. The idea isn't necessarily to detect intrusion, but to track dissemination of data.
Say you have a soldier who you don't mind having a copy of your secret plans, but you'd still be willing to execute him if those secret plans ever appear anywhere else, say, in the possession of an enemy soldier you've captured.
So you put an intentional artifact into the plans, some subtle flaw or detail that is unique to that copy of the message.
The secret getting out is one thing. The trail needed to punish the individual responsible is another.
but I'd read about this in a small town (tribnet.com) newspaper ... ooh ... I'd say ... months ago...
sooo, yes i'm that special. and no, I'm not sure if the paper was intended for PKD.
...Tom Clancies rendition of finding out who is selling the secrets.
Assuming you have agents in your enemies area, you provide each of your local agents with a slightly different copy of the material. Each copy is worded slightly differently, or contains a different trivial but interesting fact as part of the document.
If one of the local agents is selling information to the enemy, and one of your agents in the enemies area is spotting the material comming in, the wording, or trivia that gets back to you will indicate which of your local people is passing the material on.
If you have time, you generate two slightly different reports each time, and start doing psuedo random distribution of the copies, and track who had which copies that made it to the other side.
If you do not have an agent on the other side, you can sometimes cause your enemies themselves to show their hand by how they react to "wrong" information.
-Rusty
You never know...
One place I worked at had 'root' as a honeytoken on all their production servers, there was a separate administrator account [they never would tell me what its name was...] and if anyone logged in as root it set off all sorts of alarms. I thought that was cool.
We did the same thing at our newspaper. We added a bogus name, but an address that went to one of our friends/relatives. If they ever recieved a magazine/newspaper/letter for them at that address with the bogus name, we'd know that our subscription lists was stolen. (Which is our largest asset)
Even the NAZI PIG NERDS are coming out of the wordworks with their NEO-FACIST POMPUS ASS ideas!!
DAMN THOSE COMMUNIST REPUBLICANS!
Uhm, WHY would an organization have a table filled with names that isn't indexed? I agree with in concept, but any organization that has its act together enough to consider using honeytokens and honeypots should also know better than to have crappy db schemas where something like a customer's name isn't indexed...
man is machine
Columbo's First Name and The Supreme Court - The "Philip Columbo" Story
Honeytokens sounds similar to the map publisher's trick of adding fake towns to maps. If a competitor copies the map, the original author/copyright holder can catch the copier by looking for the fake town.
Two wrongs don't make a right, but three lefts do.
There's a pair of roads near me with a cutover road between them. However, many years ago, when checking a map of the area (from a major name company) I found two cutovers listed. One correctly named and one with a bogus but plausible name. (Don't you love themed areas?) Bingo!
As far as safety or directions go, I can't see anyone having any problems. The cutover is really only there to avoid dumping people onto the main roads to go around the block; no firefighter would bother to zig-zag from one road to the other that way.
Well, I don't know about the rest of the world, but in Australia I don't think hospital staff in general know SQL! Besides, if someone can use SQL to access the hospital database you have a problem anyway. If you think about it, a hospital would have some kind of built interface to the database, wouldn't it?
I used to work in a doctors office on campus during college. We had a game called "Guess the Ailment." One person would pull up a record and the other people would take turns guessing why they had to come to the infirmary. Usually it was drinking too much, other drug use or STDs. During Flu season the game was boring, because they were all Flus. It was fun. The STDs were especially enlightening because we knew who not to hook up with that weekend.
Just kidding. Really.
Aren't all those fake files on the p2p networks honeytokens??
They are lures, if you bite then you are doing something illegal and they get your IP address just for biting the bait???
Bam! Nothing to it...
I've ALWAYS suspect this..
Not exactly revolutionary... This is just list seeding.
You shove in one-time known fake name into a mailing list (postal or e-mail) that you sell and then if any mail arrives at that address sent by someone you didn't sell the list to, then you know that they've been abusing their terms for use of the list. I do the same thing with websites... I register for websites I write with sitename_seed@mydomain.com and if any of the 'seed' addresses get mail, then I know that someone's been harvesting addresses from that site. Thankfully this has never happened (yet!).
Mapmakers will commonly seed slight defects into their maps (e.g. nonexistent roads) to detect copying.
A related practice in software engineering is "fault seeding", in which bugs are deliberately injected into code to see if they are found during V&V. (The deliberate bugs should be removed before the product ships, of course. :-)
Old ideas, but quite useful.
Our company uses this trick. There are 'honey-addresses' in our database. (a correct address belonging to an employee, with a completely wrong name) As soon as anything arrives at one of those adresses we know someone has made illegal use of an address from our database. Whatever gets send tells us who. Legal action follows ....
I heard that some police departments in the 70s had the license plate "853 OKG" for Jim Rockford's car (from "The Rockford Files" TV show) in their databases to detect cops running plates for their own amusement ...
He was talking about *querying* the database, not *modifying* it.
Or, do you umask 077 all your files, and just change ownership to who think should view 'em?
It must be a bitch trying to keep track of all those DSOs.
Do daemons dream of electric sleep()?
I'm well aware of the concept of map makers, dictionary makers, encyclopedia people and DB folks inserting spurious data so they can catch pirates.
Now, here's a weird story: Back in 1996, my wife and I had taken an overnight ferry from Hong Kong to China, and had then taken a regular bus from Ghoungzhou to a small town (Zhou-zen, as I recall) to sightsee. We were only staying one night; we had to get back the next day to Hong Kong, and then catch a plane.
Like a lot of travelers, we had our handy-dandy Lonely Planet Guide with us, and when we went to catch a return hydrofoil to Hong Kong, we had a cab drop us off along a nice waterfront street, indicated on a map in the book, near the ferry terminal, about 30 minutes before we had to actually be at the terminal. We walked for a bit, then consulted the map of the area and started walking back to the terminal.
After about 20 minutes, we started panicking -- the terminal was nowhere to be found, and we were running out of time. We walked back and forth, back and forth, and then I looked very carefully at the map, trying to place the landmarks it indicated.
The map was FLOPPED -- the street layout was reversed, but the text labeling everything was CORRECT.
I have a hard time thinking that this was a repro problem -- how the hell could you flop the entire map so the streets are reversed, but the text is correct? (Unless Lonely Planet got the map itself from a Chinese source, and screwed up before putting on the English captions.) Regardless, to this day it makes me wonder if the screw-up was deliberate; if the map was tampered with just so Lonely Planet could catch people reproducing it (incorrectly.)
I heard about rand mcnally(sp?) doing this with their maps, they would insert a fake town name and when someone else ripped off their content to make new maps they would reproduce the fake town and get busted...
nice idea though...
While it is a good idea, it not a new idea at all. They ahve been doing it on maps for years. Maps nearly always have a non-existant feature so if copied the owner can say "we know it is our map". And his idea of using different content to try to identify who is leaking something? I did it years ago and was inspired by a book or newspaper story or somthing...
President ISES
(International Society for Elimination of Sigs)
If you go making up honeytoken credit card numbers and social security numbers, you'd better be sure they *are* bogus, not real numbers that belong to someone you don't know. Otherwise, your honeytoken might be someone's real data....
Oops wouldn't cover it in that case. <wry grin>
Catherine
Along the same lines as many of the other posts, I've seen instances of this in places I've worked all the times. In fact, my school already does this with SSN numbers in the database because there were incidents of the SSN database being stolen, and as many services in the town are offered to students, they were interested in seeing if the "honeytokens" (or we could just call them fake records like we've been doing for years) were actually being used.
What I don't get is the why the poster thought this article was so amazingly thought provoking? Ok, so it's a fairly interesting idea, but frankly it's just an old idea with a new name, and even if it was an original idea, it still wouldn't be that revolutionary.
Galactic center studies are though provoking. Graviational waves are thought provoking. Genome research is thought provoking. This is most definitely is not.
~~~
Damn!
I don't normally rant about shit like this but this just irked me this time....
Why are you letting beginners write SQL to access your live database without any testing on your test system?
This kind of comment is so fucking presumptuous. I wish that some people would account for the possibility that their assumption is not accurate - i.e. This doesn't mean that beginners are writing SQL to access a live database without any testing (although granted, it *could* mean that)!!!
What if it is a legitimate developer accessing the database in ways that legitimate developers do, running a legitimate query on a legitimate table that happens to not have an index on a column that should?
Maybe the DBA forgot to index that column???
Forgive my nit-pickishness but I'm a little pissy today.
You need people like me so you can point your fucking fingers, and say "that's the bad guy."
I've used this for over 5 years. I operate a adult site and always battle illegal access. trading of passwords is a constant problem for me, and i quickly found the best way to combat it was to set up a few dumby accounts that expire weekly, i Give these accounts out to password sites and traders and log the ip's that connect using thtem and any refering urls. Doing this has let me keep on top of their networks and disable account that have been 'hacked' or 'cracked' . These weekly account are restricted to my members gallery and not any of my true 'members features' so I consider them demo accounts.
Is it just me, or are posters over-using "ergo"? Ever since Matrix Reloaded came out, every other post has "ergo." (yes, I'm exaggerating). Every time I hear that word, I imagine the architect saying "ERgooo." It's kind of annoying :p
I sig for world peace
get credit for this. She was the one who said something to the effect of "if the hacker wants data, then give it to them." They did, and the hacker was connected long enough for them to track him down. Greed is the downfall of most criminals, preceded only by stupidity.
Thankfully we've never encountered any cases of these records appearing in the outside world, but if (when?) one does, the record itself may help us to identify when the breach/leak occurred, so that we've got a starting point for futher investigation.
I suspect that this practice may be fairly common even though it isn't discussed much -- in order for it to be effective, you really shouldn't discuss the program at department or company-wide meetings.
While something like this won't make your data any more secure, part of any good security program is practices and tools to help you determine whether, when, and how your data *does* get compromised, and canaries can be one tool to help with the first two items on that list.
* * *
It is a dada story -- it has no moral.
Lance mentioned this at CSW, and while I like the guy - this idea is anything but new. In fact, it's incredibly old, it just hasn't had a snazy name tagged on it before.
Most commonly systems of this sort were used in monetary forms, so - you mark bills to see where they end up; or have seeded credit card numbers that get flagged if they're ever used.
Go back to the Roman era and look at the history of the serrated edges on the sides of coins as something also similar as a method to determine whether the currency had been tampered with [prior to that it was common to scrape the edges of coins to collect small amounts of the precious metals].
At any rate, these sorts of techniques have been in practice for much longer, just without a snazy name. Like I said, Lance is a good guy - but he's starting to get a little carried away
I know of somebody working at a fast food delivery outlet with a customer db keyed to phone numbers (you do know the company) who would enter every local number anyone gave him to see if he got a hit. AFAIK he only used this to freak out girlfriends (by turning up to collect them from home for a second date when they hadn't yet given him their address), but it was a clear breach of the UK's Data Protection Act, and could have landed him in deep trouble.
Clearly, the moderator who modded down the parent is NOT gay or doesn't support the GMAA cause... Very interesting...
twenty years ago we were marketing our mailing list of DECPro subscribers to our advertisers (suprise!)
every list sale had unique seed names/addresses inserted and we tracked whatever arrived at those addresses. every sales agreement had a paragraph in which the renter agreed that there were seed addresses inserted.
Obviously a troll.
This reminds me of the cddb being stolen by Gracenote. Last time I checked, they were still claiming to own the database of audio discs (they may have changed their tune by now), despite the fact that it was built mostly from submissions by people like me. Gracenote basically took our diligent work, and started restricting access to it in order to make money. How do we know that they didn't build their own database? Because it contains entries for unpublished CDs that don't exist outside the homes of a few specific people; effectively honeytokens.
(Fortunately, an alternative now exists.)
In the old days we just called this "disinformation". :-)
I've always thought this would be a good way to stop email viruses on a local server, if you're foolishly using a virus propagator like Outlook. You create a special mail alias that doesn't belong to anyone. Everyone puts it in their Outlook address books. Any message sent to that address is a virus, and the server automatically blocks any subsequent messages that look like it.
Simple enough. In fact I once asked a sysadmin about it and he said they were doing just that, which wouldn't surprise me. On the other hand I was still receiving bonehead viruses, so maybe it wasn't working as well as it might have.
How many of us have used fake email addresses to identify spammers?
Do you have ESP?
then this feature becomes functionally useless.
Note in the definition that we do not state a honeypot has to be a computer, merely that its a resource that you want the bad guys to interact with. That is exactly what a honeytoken is, a honeypot that is not a computer. Instead it is some type of digital entity. A honeytoken can be a credit card number, Excel spreadsheet, PowerPoint presentation, a database entry, or even a bogus login and password.
Then why the new buzzword?
news at 5.
Yay me!
GodD&*Mnit!!
We don't want to hear about any more GOOD IDEAS!!!
We only want to hear about PANACEAS!!!
Don't post any more articles unless it describes something that that is an END ALL - BE ALL for ALL situations.
Otherwise, we're just not interested!!
Avoid Missing Ball for High Score
And look what a bunch of theives we have here they must have simply coppied other people's phone books! They ought to be hung like horses for the crime of unauthorized copying. So immoral.
Friends don't help friends install M$ junk.
I guess I'm not talking about the US then.
I don't quite remember which novel it was (maybe "Hunt for Red October"?) but in one of his novels, Clancy tells that Jack Ryan rose to prominence within the CIA because he proposed / developed a method of traversing confidential internal documents and replacing insignificant words with similar words (that retained the meaning of the sentence). The different versions of the document were then handed out to people that were entitled to a copy. If there was an internal leak, you knew who compromised security by comparing the leaked document with the documents distributed to individuals. This idea is going back 15 years.
I think the concept of honeytokens has much merit, and the author does emphasise that they are inexpensive to implement (for all those who think they offer little benefit).
Among Novell people. Netware's logging and auditing has always been excellent, and we would take advantage of this by leaving directories lying around named "admin" or similar, that were located outside normal userspace. This means that only people with more rights than normal users could access the file. It was an excellent way to weed out excess privileges on the network, especially when walking into a previously ill managed mess.
So, whenever a careless engineer trips something, he merely writes in the log "deliberately tripped such and such safety to demonstrate it to so-and-so", and no one is the wiser...
It is called a lure, you fish with it! Computer people should get out more!
Now move alone folks nothing new here.
This reminds me of the current trend to re-write every law on the books to deal with computers systems. We don't need it, just use your heads folks.
I remember a long time ago, at a company I worked for, we were having an issue with someone poking into someone else's mailbox.
I mean, what we did was no big deal at all really, all we did was have a script run out of cron that would report a change to the mailboxes atime to an outside address.
The idea was that the person whose mailbox was being violated would KNOW when they accessed it, and a notification that happened at a time they didnt expect would alert them to someone poking around.
Anyhoo... just popped into mind reading this.
Have you painted a shed today?
If you're worried about the Germans infiltrating your data stream, might I suggest an appropriate joke?
Q:Wenn ist das Nunstruck git und Slotermeyer?
A:Ja!...Beiherhund das Oder die Flipperwaldt gersput.
I Browse at +4 Flamebait
Open Source Sysadmin
Back in the 1980s, for example, science fiction bookstores would have to deal with people who found a previously undiscovered JRR Tolkien novel by browsing through Books in Print. The book didn't exist, however; it was merely an artifact added to provide evidence of someone stealing the BIP publisher's data.
If memory serves, Tom Clancy touched on a similar idea in one of his novels, having slightly different phrasings to key parts of intelligence documents which would allow investigators to better determine the route of leaked information.
Folks in magazine publishing used to use a similar ruse to track how subscriber info was being sold by competitors. You'd subscribe to one magazine as "Elvis J. Presley", for example, and another as "Elvis Q. Presley." By checking the middle initial of incoming junk mail, you could tell who had been selling your name and to whom they'd sold it.
Like I said, the idea's been around a while. The honeypot aspect is merely a new context and tracking mechanism.
Tyler
... And such a name is really quite common (ref. Irish Phonebook;Boston phonebook). My point is that someone might actually come in with a name that the honeytoken planter thought was obscure, but was actually in use. Any name the _couldn't_ be legitimate would probably be easy to spot as such.
From just a dozen systems. The problem is *not* methods of detecting hackers or people accessing information.
The problem is information overload. It's false
positives.
Can you imagine the number of badly coded VB applications there are out there in the real world? Can you imagine the number of mistakes people make when executing queries
In a perfect world or with an unlimited security budget this stuff would be useful, unfortunately some of us don't live in a perfect world or have unlimited security budgets.
Deleted
So the JFK record would have to be corrupted, because if it emulated a correct record, then when the senior ward supervisor (nurse) was rostering staff to look after patients, JFK would be selected and allocated automatically. You'd have to fake all the way up to the top, ie ward, doctor, everything. And then the staff would recognise it as fake. Hospital patient databases are mostly for making sure patients get the right treatment, and a legal record of that treatement, and a financial record of the cost of that treatment, so a fake record would still have to be accessible to people responsible for these.
It doesn't make sense to say that nobody should be looking at the JFK record. It would make more sense to see the ward staff go nuts trying to find where he nicked off to (like an altzheimer's patient). He's in the computer so he should be in the hospital. If it is merely a historical record, the same problem would apply to the accounting staff (why hasn't he paid his bill?).
And mostly when you go into a hospital or medical facility they get you to sign something that says vaguely that you consent to have your details available to anyone they deem appropriate. They're not going to come back and try to get your permission separately to give details to the cardiac doctor if you happen to have a heart attack while staying with them!
I understand the concept, but I think the example is fairly poor. Perhaps it would be more accurate to say something like "access to this record should be limited". And I think the concept may be fairly old, eg in WWII examples of feeding the enemy false data, rather than actually imprisoning the detected spy.
-- it must be true, it's on the internet.
I remember an old SF story with the same plot line - An Asimov or a Saberhagen (Berzerker) tale having to do with a fake entry on a "galactic chart" that leads the bad guys astray...
My question is; Is there a real word for this practice? How bought industry jargon, at least?
Hey you cryptographers/encyclopedea'istes (gah) out there - what's the term?
These don't cut it: "map trap", "copyright thingy", "honey token", etc...
I don't know what I am looking for, but I'll know it when I see it (and verify it with a dictionary, or at least lots of google hits :-)
This issue is a bit more complicated than you think.
This is standard process in the database biz, including things like mailing lists and (as others have noted here) maps. The term for it is "salting". Calling them "honeytokens" is applying the wrong seasoning... and treating it as new on /. is also silly.
A man's reach must exceed his grasp, or what's an erection for?
I've seen fake email addresses used well to detect spam going in to a university mail server. Any mail delivered to the fake address triggers deletion of suitably similar (I think spam was not clever back then, so read "identical" for that) mail delivered to other accounts. Its just a case of leaving the fake address(s) in places where spammers look.
The fake addresses were at the start of the alphabet to try to pick out spam sooner.
When I got my ATM card, I wrote three 4-digit numbers on the back of the card, and showed it to my friends.
Friend: "Oh, I see! You hid the pass code among some fake passcodes!"
Me: "No, ALL of them are fake. I keep the real one in my head. I figure that a thief will think what you are thinking, and try all three numbers. Then the machine will eat the card."
If so what's the point of storing those records in hospitals? Hospitals aren't storages for peoples various papers, let patients store their own damn records.
Preserve old classics: copy your collection onto all hard drives.
A variation of this scheme is used by vendors of antivirus and similar software: Bogus items are intentionally placed in e.g. a virus definition file, and when another company rips off their file for their own program, it is much easier to detect and provide evidence of the theft.
I would read it because it looks 'wrong' and would need to be checked to find out why the error took place.
The idea has been really in use for some time to protect secret British Cabinet documents. Each document would bve uniquely identified using variable spacing. I had heard word subsititution discussed but have doubts if it would be implemented. This is why when a newspaper gets hold of a leaked document, they are careful to destroy the original and not to quote too much verbatim.
See my journal, I write things there
So if a Doris sees 2 entries for Fred Bloggs she cannot correct the error until she has contacted both Fred Bloggs to ask their permission to delete the duplicate. Except she cannot look at the data to find out the address unless she writes to them and asks for permission...
I love stacking my barbecues in the shed at the end of summer - you can't beat a bit of grill on grill action.
In civilized countries you are not only not allowed to set traps for burglars, it has now been established that you owe a duty of care to anyone who breaks into your premises and trespasses on your land. If you know that kids might climb through your fence to hide in the long grass and get stoned, then KEEP OUT notices are not enough and if you have any hazards (deep wells, wires hidden in the grass) they must be made safe.
The logical correlative of this is that if you provide files with the intention that they should be downloaded by people who break into your system, and those files are engineered to cause damage, you will be (possibly criminally) liable for any damage you cause. "I didn't expect anyone to come this way" would be no defence when the only conceivable purpose of these files is to cause harm.
Most databases offer very flexible triggers. E.g., at least in Oracle you get to execute a whole script if you want to. And if you go through some middleware, you've got even more freedom.
So a "select * from names where last_name = 'Smith'" can be made to trigger exactly nothing. Assuming that the names table really contains nothing but names and ids.
On the other hand let's say it's something like "select * from PATIENTS where last_name = 'Smith'", where the PATIENTS table also contains house address, private phone number, etc. That is already retrieving private data for every single patient with the last name 'Smith'. With a well programmed honeytoken for a bogus patient called 'Random J Smith', it won't trip because the statement scans for 'Smith', it will trip because it retrieves that kind of private data.
If you do get your trigger tripped by something like that, you probably at least have an incompetent programmer (should have selected only the fields needed anyway), or at worst someone mining data about the patients. (No doctor treats all patients named 'Smith', so they have _no_ business retrieving the data for _all_ of them.)
And precisely _because_ it's easy for beginners to write bad programs, I do expect that programs dealing with such sensitive data be thoroughly tested. Yes, including by honeytokens and whatnot.
When you deal with that kind of sensitive data, taking the usual "oh well, we'll just write bad buggy code and patch it later" approach is plain old irresponsible. Letting any newbie code directly against the live hospital data without any safety checks, is as irresponsible as letting any newbie reprogram an airplane's systems in flight. A program which has to work on that kind of data should be thoroughly tested for any possible flaws, and have a competent team trying to hack into it too.
And yes, you'll never be 100% sure that it's bug free, but the honeytokens sound like a great extra way in which you can test it. And I fail to see why more bugs caught is a horrible thing.
A polar bear is a cartesian bear after a coordinate transform.
In the case of the hospital, patient records must, by law, be kept confidential. Additionally as human beings we must respect the emotions and dignity of others, which means that health problems are private. Therefore redundancy, or at least strong a reprimand, is an appropriate course of action for an employee who violates patient privacy.
In the case of the private company I think that it is sad that the author would like to see an employee put out of work for attempting to access a financial report. It appears that the justification for this is that the user and pass for the report came from an email to somebody in "management" (those in management apparently being sacred)
I wonder if the same action would be taken against somebody in management who looked at the emails of their secretary...
I suspect not
Its bad enough that injustice and double standards in the workplace are encouraged by those at the top. But when sys-admin "collaborators" in the rank and file seem to enjoy putting their coworkers out of a job (either for selfish gain, or blind vindictiveness) it is particularly distasteful.
Whether it be a file they host that you download, or vice versa.
You rent a house, put some cops inside it, then deliberately lose the door key, with the address marked on the keyring. Then you just wait for the burglars to come visiting. The key with the address on it is the honeytoken, the house is the honeypot. Or would this be thrown out of court for being "entrapment"? IANAL.
That might be a good example of where not to use honeytokens. When the books were written, "nobody but a few scientific and engineering applications would need that kind of accuracy," but what if someone did? A faulty calculation could result in a failed project or worse.
Furthermore, this kind of honeytoken requires a list of honeytokens to be stored somewhere, which would be a high value target for thieves.
"According to this map the enemy couldn't have possibly come up this way. There's supposed to be a big wall over there. That's why I said that it would be a waste of time to send scouts to check that approach out."
"Sir, since we're all going to die, may I speak freely."
"Sure."
"You're an idiot, Sir."
Zero?
I have a file on my ftp server called "10yrold.jpg" which is a photo of a glass of Scotch whisky. Does this count?
Most comments on this article are complaints that this technology is old. Yes, it is, and those who actually read the beginning of the article will see that the author of the article admits it: "While the concept of honeytokens may not be new..."
Although the concept of the honeytokens may be the same in the examples given by the Slashdotters, nobody has yet noted that they have different purposes.
To prevent the copying maps or lists of credit card numbers, bogus entries are added. The idea here is, that if someone copies everything, the bogus entries will also be copied. Detecting those bogus entries will reveal that the content was stolen.
To prevent the copying of copyrighted material on a peer-to-peer network, the network can be poisoned by bogus files. The idea here is, that sharing of copyrighted files is discouraged, as a portion of those files are not functionable.
And to prevent an attacker from finding sensitive files, bogus directories and filenames can be created. For example, you can make a directory called "TopSecret". Your sensitive files are put in a directory called "Uninstall" or "Legal". Now, if the attacker browses your system, he will naturally search "TopSecret" first. But as soon as he accesses this directory, the Intrusion Detection System will lock out the user, preventing him for looking further and finding the documents in the correct directory.
Some posters have complained about the false positives which are the result of using these honeytokes. Those have not read the article correctly. "Whatever you create as a honeytoken, no one should be using or accessing it." If no one should be using or accessing the honeytoken, there are no false positives. The boss knows that he should not look at the "TopSecret" file, all other people looking at the file are therefore intruders.
Having worked in catalog sales we used to spike our lists with fictional names using address's of co-worker before loaning/renting out the lists for limited use. Everytime a piece of mail was r'cvd for that name, the co-worker would simply bring it in for the list manager and he'd double check to make sure that our list was being used by authorized person's only. Or that our outsourced list broker was properly compensating us. I like the idea of taking this old technique and updating it for data access. The one drawback is how will you know if the person actually accessed the file maliciously or by mistake? Database endusers sometimes need to browse records to verify and compare information.
I remember reading this sort of idea in a Berserker Novel, by Saberhagen.
... the point is, people do this all the time anyway, with existing data (i.e books) , so they can find who plagurises them.....
As I recall, the Berserkers (think alien terminator endoskeletons, built for a war that ended eons ago, but now trying to exterminate mankind) had captured a space ship.
So the captain had to destroy the galactic encyclopedia, so the Berserkers couldn't find any human planets.
However, he was stopped by one of the passengers, because the passenger was one of the authors of said encyclopedia.
As an anti-piracy measure, fake "honeyplanets" had been added to the encylopedia, so if anyone brought out their own version, the authors could point out the fictious planet.
Of course, this fooled the machines and everyone was happy in the end.
Quite old news. Our largest national phone company (Telstra, in Australia) has put artificial names and addresses in its phone books for years.
They then monitor these lines and addresses and see if anything turns up aimed at those personal details. If it does, the person doing it (ie usually a company) has been illegally using their copyright phone books as a source list of potential clients, mail-outs etc.
If you are scanning down a list of entries, names, etc. You are NOT going to delve into that person's records. Boundaries need to be set, as per the ability to point out that a misspelling might have occurred on a patient's name. But how are you to know if someone has been horribly misdiagnosed unless you really look into the records? You can't, therefor what you are proposing is a reason why you should be allowed to poke around. And if you know you shouldn't be privvy to that information, why are you there?
Whay makes you go to work every day and fool around with other people's personal information they don't want you to have unless you've already resigned your ethics?
So this isn't about misspellings, it's about a rationalization for you to continue having power over people's information.
This is the same ideology that religious people who go door to door believe. "If I can SAVE this person, I disserve to invade their life, because I just MIGHT do some good." Nevermind that 90 percent of the time, they are just snooping bastards.
That's what you are if you believe you should take over for the doctors and nurses assigned to a patient.
>> "Another element of a honeytoken's value is their flexibility. You are really only limited by your imagination. As we have demonstrated in the section above, honeytokens excel as a detection mechanism. However, honeytokens can do so much more. Not only can they detect an..."
Selection of a honeytoken, while apparently a useful tool, is not trivial. For example, an IDS seeing the honeytoken on the wire is not adequate to determine a security violation. Suppose that the executive is actually reading her email. It sounds like a good idea, but while only limited to your imagination, it is also limited by the ability to determine context of the use of the honeytoken.
But, even in that case there are valid explanations. Suppose you're checking your hospital database, for, say, males, certain age, certain blood type, etc. Depending on what data is entered for the Kennedy record, it could match many searches. Not all database checks are by name.
"Honeytokens represent one of the simplist and most cost effective security technologies that can be used with minimal risk."
These people seem to be seriously out of touch with reality. Imagine having to add a "WHERE ID NOT IN ()" to every single database-query your application performs. Imagine doing this for all applications in your organization. Imagine every organization dealing with sensitive data doing this. And don't forget this all has to be done in some middle or UI tier, storing these ID's in the DB (either a table or sp/view like construct) would defeat the purpose. And they claim this is cost-effective? Nonsense.
A relational, or even SQL database managment system that contains data without value or meaning is not cost-effective, as any DBA or database developer can tell you. The simple amount of extra processing power and development time needed to build in the exceptions to prevent the honeytokens being accessed by regular (legal) application processes would astronomical.
You miss the point. Sure, a select * on PRODUCTION data may happen. HOWEVER: we're talking millions of rows.
If you see this:
SELECT *
FROM NAMES
WHERE fname LIKE 'Kenn%'
on PRODUCTION data.. man.. that's really really dodgy.
----
Just to update you:
I work in a place that has medicare records for a lot of people. Millions. Now, I assure you that people simply do not do a SELECT * on a production table. Yes, we can see prod data: we need it sometimes for our jobs. Yes, we have access to READ it, but not delete/update (of course).
However, your example is useless as it would never happen. If it did, your DAs or DBAs would be down asking you why your SPUFI or BMC unload grabbed the entire table.. and you would be in a world of pain.
Further information: Systems of this size have checks on how much data you can retrieve in one go. It's usually 5K to 10K of records. Again, you would NEVER see a full SELECT * on prod data.. you need to qualify it with a where clause on the key.
----
I would like to conclude that you need to have a look at any countries phonebook and count how many SMITH 's there are. Seriously. Honey pot or not, they'll notice.
...or at least it seems so. I was proofing a script against HTML insertion attacks, and tried that for kicks. It doesn't crash IE6/Win2k.
I hereby place the above post in the public domain.
as many have already pointed out, this is not a new idea.
Here in Germany the Telekom (former govment owned) has used this since years.
When the first phone books and yellow pages on CD appeared, many other companies came up with the idea to reverse engineer the data and do their own.
To prevent other companies from stealing these data they had several fake entries, that were only on these CDs.
The other companies had first to scan and OCR the paper books and since a few years the government forced the Telekom to sell these data.
in ye olde database days.
If it were done when 'tis done, then t'were well it were done quickly... MacBeth
If there's a record in a database about a famous dead person and I stumble upon it, aren't I more likely to click on it than if it was just a no-name person? Is that not the very definition of entrapment? Even if I wasn't looking at the record for nefarious reasons, I'd be in violation, for being curious. Granted, what's wrong is wrong is wrong... but for god's sake we're human beings!
"Politicians find new names for institutions which under old names have become odious to the people."
The mailing list industry has been using this sort of concept for years with rented lists. Say you want to buy a list from a list-house for a one-time use. In that list will be several "seed" addresses which are checked by that mail-house. That way they can nail you for using the list more than once or sharing it.
In a former life, I was managing the data for the alumni department of a college. They had several 'bogus' records in their data. The idea being that Mrs. Martha Jones (fictitious, but better than Jane Doe, no?) at such and so an address actually ended up in the home mailbox of the VP, or his mom, or the director in charge of mailings. If the mailing house managing the account ever sold the list (that would be early-90s data hacking), they would know because the VP would suddenly start getting non-college mail addressed to this fictitious name.
Decidedly low-tech, but effective.
And then see what Junk Mail I recieve.
It's amazing who makes the Data Protection Act.
A blog I run for the wealth
Poor Pooh is going on a wild honeypot chase....
Some of the examples I've heard make sense, but it seems to me that more often than not a fake database record is going to be more trouble than it's worth. I'm not even talking about how you detect access of the record while ignoring incidental accesses; I'm talking about cases where the record actually gets in the way.
For example, many database applications actually generate summary reports describing their data. It becomes more difficult to count your user population when you have to step around your fake record of John Kennedy to avoid skewing your numbers.
I read the article so no RTFA replies please and IANAL.
It looks more like tempting a person to commit an activity and may be of questionable legal validity. Moreover if you enticingly share invalid information or have a bad security model you are equally liable.
All this stuff about honeypots and honeytokens seems to be some sort of PSYCHOLOGICAL/SOCIOLOGICAL maneuvuring to solve a technical problem
Direct mail advertisers often use lists "rented" from a list provider, paying a lease fee. Certain demographics / list subsets may be quite valuable and are priced appropriately.
If the advertiser is paying for a fixed number of uses of the list, the list provider wants to ensure that the advertiser doesn't go beyond the agreed-upon number of uses. So the lists are seeded with dummy names back to the provider.
If the list provider sees too many mailings on those seed names, the advertiser gets busted.
They've been doing this for at least twenty years (that I know about), but has probly been going on for lots longer...
Mine was mostly used in public hospitals where insurance payouts were generally irrelevant as your stay in a public hospital is fully paid by our Australian Government. Sometimes it takes a long time to get in. The system doesn't determine the correct treatment. The medical staff do that, and then key in what their plan is, and the system keeps track of it, so that the next shift know what pills to give patients when etc. There is usually a hardcopy somewhere (that the rellies can't find it, times have changed). The hardcopy gets scribbled on and the scribble gets typed into the computer. I knew a doctor who described the system as a device to keep nurses away from patients. And it was keeping nurses busy for at least 25% of their shift. Bleck. Even my GP keeps all his notes on the computer and the computer prints the scripts - so even I can read them. I agree that the "expert systems" for determining treatment are about as useful as the yellow pages for finding a music shop in a CBD shopping area.
-- it must be true, it's on the internet.