Slashdot Mirror
Honeytokens: The Other Honeypot
martyros writes "I just read a fascinating article
by Lance Spitzner securityfocus.com about a concept he calls
honeytokens. The idea is similar to that of a
honeypot, which he defines as "an information system resource whose value lies in unauthorized or illicit use of that resource". Rather than having a computer that's designed to be broken into, however, you have say, a record in a database or a file has no legitimate use; ergo, if anyone uses it, it must be illegitimate. An example he gives: adding a record to the hospital database for a guy named "John F. Kennedy". It doesn't correspond to a real person, so no one has any business looking at the file. If someone does access it, you know that they're abusing their privileges somehow.
The article has several other clever examples, which I found very thought-provoking."
Or there's a flaw in your software.
Or they were poking around bored.
Or you've been hacked in which case you won't have an access record anyway if the hacker did their job right.
Yes, quite superior to a honeypot, in every way.
The key to the enjoyment of pop music is to replace any instance of "love" with "C.H.U.D."
I seed all my pages with special "token" email addresses that will only be found by a spammer using harvesting software (or a really really bored user). Normal people will never find it and never want to use it. It works amazingly well.
This sort of thing has been around for decades. I remember as far back as the early 1970s, hobbyist magazines' "Buyer's Guide" issues would have deliberately bogus entries to ensure that their competitors didn't steal the data wholesale for their own buyer's guides.
I've used the same concept before on my work computer. I plant suspiciously named files on my desktop or (usually) less obvious places so if someone tries to search my computer and comes across this file, reports its contents, and I hear about it, I know it's time to change my password ;)
KappaStone
What corporation in this post dot-bomb era wastes resources and employee time on bogus bughunts like this anyways?
These all sound like over elaborate rube goldberg devices to secure the doggy door on your house.
I don't need no instructions to know how to rock!!!!
This is an interesting use of a known technique to help detect the unauthorized use of data, and alert administrators that the barn door is open--and maybe even who opened it.
Call (206) 338-5780 COLLECT for information about a genuine BA, BS, MA, MS, MBA, or Ph.D.
What happens if someone does a search for that happens to find "John F. Kennedy" and several other patients. Does that mean the person was in the wrong place?
The problem with this (and with a lesser degree, with honeypots) is that these tokens will get accessed in legitimate ways -- for example, what if your secretarial staff is creating a mailing list, and "JFK" gets sent something? Or you have a browse function in an application that uses the database?
It's a good idea, but not a panacea.
named John F. Kennedy at your hospital?
An example he gives: adding a record to the hospital database for a guy named "John F. Kennedy". It doesn't correspond to a real person, so no one has any business looking at the file.
Of course, there are some places where "John F. Kennedy" is a perfectly valid database entry. Actually, it's a database entry for which a lot of people make it their business to look at the file.
Which, I suppose, shows exactly why the Honeytoken concept makes sense...
Stressed? Me? Of course not. Stress is what a rubber band feels before it breaks, silly.
Yahoo (and presumably other search engines follow suit) keeps some bogus entries in the DB so they can detect someone stealing their whole DB.
Some print newspapers run bogus classified ads so they can detect a competitor trying to bulk up their own classified section.
Some anti-spam companies post to newsgroups specifically to get addresses harvested; any email to those addresses is the sign of a spammer.
Handy, but hardly breaking news. Might as well run an article about a researcher discovering the usefulness of packet switched networks.
Cheers
-b
To: Chief Financial Officer
From: Security help desk
Subject: Access to financial database
Sir,
The security team has updated your access to the company's financial
records. Your new login and password to the system can be found below.
If you need any help or assistance, do not hesitate to contact us.
https://finances.ourcompany.com
login: cfo
password: H0n3yt0k3n
Security Help Desk
-----------------------
Ok... whats stopping the Chief Financial Officer from logging in on that account...
Security 1: Hacker!.. Fry Him!!!
Security 2: Oops!
Security 1: Sorry boss!
Warning: This sig contains a small bug. ==> *
Maps have had these for years; they call them 'ducks.' Bogus small roads that don't exist for instance. If they show up on a competitor's map, they're poaching.
Strangely, couldn't find a reference to this on google. I wonder if google themselves practice this kind of thing...
-- Tristero
Otherwise though, I've been aware of these sorts of misuse/abuse detection schemes for some time- specifically in the area of email harvesting for spam. Place a fake or otherwise unused address in a list or directory, and if it ever receives mail, you know the sender was harvesting.
Another good example would be the RIAA putting bogus music files on P2P networks. For example, if you query and download a file that is named "Metallica - Enter Sandman.mp3" then chances are you have other files that are of dubious lineage.
The sword here cuts both ways, unfortunately.
----
Like listening to music? Then use Fission, the MP3 player with a brain!
By placing arsenic in your water bottle that you leave in the refrigerator, you can tell who's been pilfering your lunch.
Best Windows Freeware
If records are globally viewable, or easily accessed without particular trouble, curiousity might lead people who otherwise wouldn't look through something to peek. Granted, in the JFK/Hospital example, people really should no poke around, but in other Internet based examples, curiousity is common. Lock stuff up a bit if you want to keep the honest people out, it's much more legitimate than leaving it open yet without having business.
And before someone makes an analogy to leaving one's house's door unlocked, Like computers, I lock my front door unless I'm expecting company.
Do not look into laser with remaining eye.
...several years in fact, although in a different form.
A while back a bunch of businesses created a website called slashdot to monitor people who were surfing the net instead of doing work.
Famous Last Words: "hmm...wikipedia says it's edible"
Phone listings are not proprietary - anyone can publish a phone book. But you can't copy someone else's publication (like the telco's official phone book.)
In order to tell if a third-party phone book is legal or not, the telcos put a bunch of bogus listings in ever one. When third-party books are published, the telco can check to see if the bogus listings are in it. If they are, then they know that the book is an illegal copy of the telco's phone book. A book that doesn't pirate the telco's book (e.g. using listings purchased from the telco or by asking people to contribute contact information) will not have those listings in it.
This sounds like the same concept applied to a new purpose.
This really strikes me as a wasteful use of resources (as someone already pointed out earlier). However, this whole concept (honeypot, honeytoken) shows how people are so paranoid they INVITE other people to prove them right.
It's like this: Let's say there's a ravine. This ravine is in a somewhat dangerous area of the mountains, and so people are generally told to avoid it. However, this ravine is the shortest walking distance between two towns. Some park ranger with an inflated sense of superiority and WAY to much time on his hands decided that this ravine is now OFF LIMITS because it's dangerous, so he plants some mines. If people step on the mines, well, it's their fault, because the park ranger declared the ravine off limits.
I have no tag line
I can see someone accessing a record just because it's interesting.
A bored nurse at a hospital is browsing through patient files, sees "John F. Kennedy", and for shits and giggles, opens the record to see if he had a gunshot wound to the head.
Same if you call it "Bwana Guana the Flying Butt Monkey", or hide the file, or someone notices that it hasn't been accessed since last year, etc.
PC moderators can suck my White pierced, tattooed dick. If you think pride == hate, s/dick/Aryan meat mallet/g.
Fred Saberhagen describes using a Honeytoken to defeat an enemy in one of his Berserker stories. Apparently it's an old Dictionary & Encyclopeadia Publishers trick to prevent plagiarism. they put in a number of reasonable entries that nobody's ever going to need, and if anybody copies them, they know they've been plagiarised, and can prove it in court
'He copied our encyclopaedia, and we know this because he has entries we made up out of whole cloth.'
"You've got an invalid haircut" -Warren Zevon - Life'll Kill Ya
So how does the batch processing that runs against most databases work out the bogus records? You'd need a "bogus" flag or an exclude file. This is the kind of stuff that has systems pumping out thousands of letters to "John F. Kennedy" reminding him that his payment is overdue... Once this mechanism is embedded in the system design, then it will become widely known, and everyone including the janitor's dog will know that they will get fired if they look that the JFK record.
As an academic exercise, great. In the real world..no thanks. However the principle of slightly altering documents to catch the unwary is an old one - the person thinks the document is a copy, whereas it is really unique to them - they publish on f**kedcompany - and they get busted.
Telephone companies have been doing this for years.
They list bogus entries in phone books and then scan other lists for occurrences of these entries. Subscriber lists and customer information is copyrighted and non-freely-distributable, supposedly (these terms may be slightly wrong).
If they start showing up in other databases (like other companies' phone books), calls are made. It's an excellent way to prevent the copying of their property en masse.
The dangers of knowledge trigger emotional distress in human beings.
When I fill out forms or give out personal information, I will deliberately put in some erroneous data. For instance, putting X as my middle initial or putting an apartment number on the address for my house. Now when I get junk mail I can figure who is selling or giving away my information and stop doing business with those entities.
These are just another tool, which when employed with other layers of tools, *may* help provide you some circumstantial evidence of malintent.
As noted in other comments, if you just put in some trigger to notice on the database system itself if anyone access JFK's record - well, if the database system is compromised, the trigger can be bypassed as well. It will catch only "legit" accesses without system compromise - as in someone pulling the record through a normal interface such as a hospital records application, in which case the failure was on the part of whoever implemented your security policies and allowed the record to be accessed through this interface, it was not a hack.
The more interesting usage is the fake SSNs and CCs. These could prove more useful it would seem. If 5% of the credit cards in your company's database are known-fakes, and you register these known-fakes with Visa/MC centrally, then even if your DB was infiltrated carefully, they'll be caught when they try to use the numbers by Visa or MC themselves, a seperate system unlikely to have been simultaneously compromised.
But for numbers like SSNs and CCs, this really isn't a solution, it just raises the bar a notch. If this were common practice, then the intelligent theif would rip off CC databases from 2-3 seperate major retailers and compare them to figure out which were dupes. If there was a central list of fake cards from Visa that everyone used so that they matched, you'd just have to work at another company that also used the dupe list to have your own copy of the numbers to avoid. In the case of SSNs, before you go off using them for malicious purposes, you'd probably compare them against another database from state driver records or some such thing to filter out the bad ones...
In other words, you've made their job a bit harder, but it's not a magic bullet by far, nothing ever will be.
11*43+456^2
As has been pointed out in numerous replies, this practice has existed for decades if not centuries. The earliest version I am aware of was done by Almanacs and Encyclopedia's. Unindexed and uncross-referenced articles would be inserted on the theory that nobody except a copier would find them.
So all veteran /. readers should be awaiting a story on the issuance of a patent covering the technique.
I'm pretty sure you can leave access to that thing wide open and it'll still be as safe and untouched as if it were translated to Navajo and encrypted with 3DES.
the major advances in civilization are processes which all but wreck the societies in which they occur - A.N. White
I guess you didn't see this in the beginning of the article.
"While the concept of honeytokens may not be new (think Cliff Stoll and The Cuckoo's Egg), the term is."
Maybe you should educate the morons of tomorrow so they'll stop believing the leaders of tomorrow. - Dogbert
Or they were poking around bored.
Or there's a flaw in your software.
Well, then you'll just end up with a record of an 'intrusion' from localhost. if there is something wrong with your software, you should fix it anyway.
Or they were poking around bored.
The whole point is that they shouldn't be poking around. I certanly wouldn't want hospital employees 'poking around' in medical records. If someone is 'poking around' in sensitive data, then they are a hacker. If it's someone from your organization, you should either bitch at 'em or fire 'em, depending on what kind of work you do.
Or you've been hacked in which case you won't have an access record anyway if the hacker did their job right.
Not if you burn logs straight to a multisession CD...
autopr0n is like, down and stuff.
Isn't this what the cops/lawyers call "entrapment"?
Reading Slashdot is ruining my spelling and grammar.
I first saw it mentioned at Black Hat 2002 in Vegas last year. The idea was that you would create fake session tokens for web applications and then monitor them for access by applications trying to brute force the session token values.
I mentioned it to a web developer who said that the idea has actually been implemented in some of the large e-commerce sites he's worked on.
-- thalakan
I don't see this as a false alarm at all. Nobody is allowed to access a patient's records "for shits and giggles." Doing so is a violation and this person would be caught and rightfully so. Hopefully, they would lose their job, and be forced into a life of crime to support their family.
sHi
This idea sounds good on paper, but won't work in practice.
... updating information, reporting, etc.
... enable some form of auditing on the database server. Ok, but then the flaw... how does the auditing system know which data reads are good and which are bad? Even on a bogus fake record, there will be legitimate data reads by the application software that uses the database.
Here's the flaw... how does the system know when data is being accessed illegitimately? Just because there's a dummy record in a database, doesn't mean that it won't be accessed. The example given with the patient table fails to account for times when the software itself will access the data for various purposes
Exactly how would one go about monitoring data access? In theory, it's simple
Skiers and Riders -- http://www.snowjournal.com
It's also called "salting" the records, or seeding the records as well. It's been used for ages. Last time I remember seeing it on a large scale was with those whole-country telephone databases on CD that were popular in the 1990's, before they were availabel free on the net. Some companies were rather restrictive with the licenses, and prohibited using the databases for mailing lists, cold calls, etc., and seeded the database with fake entries so they could tell when it was being abused.
jX [ Make everything as simple as possible, but no simpler. - Einstein ]
Folks who rent mailing lists add "ringers," which, if they receive a mailing after the term of the rental is up, yield prima facie evidence of violation of the rental contract.
I can't think of a single legitimate reason to 'rent' a mailing list.
autopr0n is like, down and stuff.
I worked for one of the largest shareware catalog companies (yeah, way back then, my first job :), and had to write software that would come up with the reports of what customers were interested in, when they last purchased, etc. etc. etc.
:)
Whenever our company would sell this targeted list of previous customers to other companies, they would also insert several bogus names that led back to our owners. Each name was setup to recieve a particular piece of junk mail. This list could only be used by that company X many times.
That way, as soon as that other company sold our names to a 3rd party, we could sue.
I obviously don't work there any more.
You quitting proves that the karma kap worked. The most annoying of the whores shut up. --CmdrTaco
Are you coming on to me?
It was the honey that did it, wasn't it?
I knew I was probably doing it wrong.
There are some odd things afoot now, in the Villa Straylight.
One reason this idea would be especially good for hospitals is because such actions have gotten hospitals sued in the past. Simply put, no hospital employee is supposed to view a patient's information unless required. So, if Nurse Betty is looking up "John F. Kennedan's" file, and also sneaks a peek at "John F. Kennedy's", she just broke federal law, and the hospital is going to want to know about that.
As for false positives in other instances, people seem to be just trolling. For example, every single day at a former employer of mine, a cell phone provider, we'd get false positives on customer who may or may not have been using fraudulent information to sign up for service. As such, we would stop and call the verification services we used, and verify that customer. So sure, out of thirty customers a day, it would generate five warnings, four of which were false. But one of them wasn't, and that makes all the difference.
Theres never going to be some "All seeing Eye of God" security system, but every little bit helps. Especially, as noted, in both banking and hospitals, where customer's information is bound to a need-to-know basis by federal law.
Mod Points: Helping you keep your opinion to yourself.
It's mildly amusing to track how your name gets sold to credit cards and magazines and such. You may even get a telemarketer calling for Mr. J Quincy! Woo-hoo!
A bored nurse at a hospital is browsing through patient files, sees "John F. Kennedy", and for shits and giggles, opens the record to see if he had a gunshot wound to the head.
I don't think Nurses are supposed to be able read through random people's medical files out of bordom. There are all kinds of crazy regulations required by the HIPA or whatever for handling medical information in the US as it is.
autopr0n is like, down and stuff.
ergo it would see somone has been watching the Matrix ;)
cat
As far as I can tell, "honeytoken" is just a nice sounding buzzword for an ages-old technique.
I can imagine this reaching some level in intranet circles. This is not a new idea.... In fact, it's far more common in real life. You know, social engineering and all that stuff. As a quick example, the only thing memorable about "Eyes Wide Shut" was the "musican's password" goofup.
People have been doing this for ages, at least out here in the "really real world".
Mapmakers put fake cities on their maps in obscure places, so that they can tell whether another mapmaker just copied their maps (illegal) or whether they went out and compiled their own information.
Folks who put together directories (like phone books) that forbid their use by telemarketers put fake people (with real phone numbers) in there to identify telemarketers that are illegally using the directory as a basis for telemarking calls.
There's even a sort-of-backwards example from cryptography, that I believe Schneier came up with. You are all probably familiar with the basic concept that if you crack someone's crypto, you can't use the info you get from cracking their crypto unless you can plausibly explain how you got that info by another mechanism. There are big chunks of Cryptonomicon dedicated to this idea, and it's a real idea. Well, one way to tell if your crypto has been hacked is to find a really funny joke and to transmit it only by your crypto mechanism. Most folks who'd crack your crypto would have a hard time believing that the cleartext of the joke was never transmitted anywhere, so they see less reason to be anal about the normal procedures. So, you watch to see if the joke "leaks out" into the world. If so, and if you maintained other security, then your crypto has been broken.
You'll find all sorts of examples of this basic idea, going back for centuries.
basically because of a honeytoken like entity
someone at installshield had an entry in some internal company data source using her maiden name (and had used her maiden name nowhere else). she recieved solicitations from wise and got suspicious.
now installshield is sueing the hell out of wise, see this article, and this news release
Already been done.
I automatically generated reports on that basis.
I also generated reports for probes to some of the other 'nasty' ports.
Free Software: Like love, it grows best when given away.
Hi Slashdot People! (Score:6, Insightful)
by John F. Kennedy (666) on 2003.07.17 16:38 (#666)
I love Windows! It never crashes. Linux Sucks. Hilary Rosen is having my baby. Filesharers are evil. Lessig is a communist. Matrix Reloaded Sucked. The Twin Towers Sucked. Online gamers are asocial dweebs. No, you cannot make a beowulf cluster of these. Nothing like this whatsoever happens in Soviet Russia.
[ Reply to This ]
666 replies beneath your current threshold.
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
This sounds similar to (but distinct from) the Canary Trap that Tom Clancy described in one of his novels. I think it was "Cardinal of the Kremlin," though I may be wrong. I don't know if the idea was Clancy's originally, but that's where I saw it. Basically, each copy of a classified report has various meaningless differences, like an intentional misspelling or use of a different phrase. Each person is given a slightly different and unique version of the report. If it ends up being leaked, it's relatively straightforward to figure out where the leak originated. I guess that sounds a lot like watermarking/fingerprinting files as well, though this was for both hard and soft copies.
You have a choice: tax and spend Democrats, or borrow and spend Republicans. Choose wisely.
Friendly Fun,
... built from common interest and a few ... to much trouble. .... ... there were, I think, other gaffs. I know the F-500 company I work for has plenty of dupes. ....
Oh Boy! I like this, I can have fun at work. I can just do a little after work beer drinking with the network Gestapo and maybe some other stuff come up with some mutual interest topic. Then, I do an attack search for a few select terms, names, phrases,
Maybe, after $30 of beer, just ask "What are honeychips and honeypots?" [I know honeytoken, but I don't know what I am talking about]. I then remember the slurred examples with intent and context. Auh Heck, to much trouble, I'll do it my old fashion way
Next day I do a few innocent (stealthy) searches for information, identify probable honeytokens of interest, then surreptitiously share with the curiously paranoid (most of us humans) individuals. Then let them search for and access the honeytokens.
Great practical joke on a few managers and Bosses. I am willing to bet I can get a CIO a/o CTO to fall for the joke. I mean, I know the DoD CIOs implemented PKI for everyone in DoD, then forgot (or never knew) that a private e-Signature smartcard (non-biomet) encryption key does not have a DoD Master-key to unlock all the encrypted files wanted for a criminal investigation. Oh, whoops
I would never do it, but I would not want to work at a company that laid traps that anyone could fall in, due to normal curiosity and the right manipulation. Sounds like entrapment and poor ethics
OldHawk777
Reality is a self-induced hallucination.
Unaccountable leaders are masters, and unrepresented people are slaves. How do US and EU fare?
Nothing new here. The idea isn't necessarily to detect intrusion, but to track dissemination of data.
Say you have a soldier who you don't mind having a copy of your secret plans, but you'd still be willing to execute him if those secret plans ever appear anywhere else, say, in the possession of an enemy soldier you've captured.
So you put an intentional artifact into the plans, some subtle flaw or detail that is unique to that copy of the message.
The secret getting out is one thing. The trail needed to punish the individual responsible is another.
but I'd read about this in a small town (tribnet.com) newspaper ... ooh ... I'd say ... months ago...
sooo, yes i'm that special. and no, I'm not sure if the paper was intended for PKD.
...Tom Clancies rendition of finding out who is selling the secrets.
Assuming you have agents in your enemies area, you provide each of your local agents with a slightly different copy of the material. Each copy is worded slightly differently, or contains a different trivial but interesting fact as part of the document.
If one of the local agents is selling information to the enemy, and one of your agents in the enemies area is spotting the material comming in, the wording, or trivia that gets back to you will indicate which of your local people is passing the material on.
If you have time, you generate two slightly different reports each time, and start doing psuedo random distribution of the copies, and track who had which copies that made it to the other side.
If you do not have an agent on the other side, you can sometimes cause your enemies themselves to show their hand by how they react to "wrong" information.
-Rusty
You never know...
One place I worked at had 'root' as a honeytoken on all their production servers, there was a separate administrator account [they never would tell me what its name was...] and if anyone logged in as root it set off all sorts of alarms. I thought that was cool.
When the Boss steals, it's big-time, way more than any of you make in a year at your salaried job.
The big guys don't need to steal to drain the company. The laws (and corporate policies) allow them to do things the rest of us would spend hard time in the federal pen for.
As a trivial (though not unusual) example, at my previous job, the CEO made a bad call about handling a bug in a customer's software. Relatively minor bug, but due to the nature of the software, he and the company might actually have had to endure criminal proceedings if they handled his bad call poorly.
So the solution? He left the company with nearly a ten MILLION dollar parting bonus, sort of vaguely admitted responsibility, regulators considered the matter suitably dealt with, and the problem went away.
Think about that... This guy broke the law, so they gave him millions of dollars.
And some folks wonder why so many of us outright despise corporate America.
As Eric Idle once said, after killing a dozen or so tribesmen in Monty Python's "The Meaning of Life", "Back home they'd hang me, but here they gimme a fuckin medal!".
We did the same thing at our newspaper. We added a bogus name, but an address that went to one of our friends/relatives. If they ever recieved a magazine/newspaper/letter for them at that address with the bogus name, we'd know that our subscription lists was stolen. (Which is our largest asset)
Uhm, WHY would an organization have a table filled with names that isn't indexed? I agree with in concept, but any organization that has its act together enough to consider using honeytokens and honeypots should also know better than to have crappy db schemas where something like a customer's name isn't indexed...
man is machine
Columbo's First Name and The Supreme Court - The "Philip Columbo" Story
Honeytokens sounds similar to the map publisher's trick of adding fake towns to maps. If a competitor copies the map, the original author/copyright holder can catch the copier by looking for the fake town.
Two wrongs don't make a right, but three lefts do.
There's a pair of roads near me with a cutover road between them. However, many years ago, when checking a map of the area (from a major name company) I found two cutovers listed. One correctly named and one with a bogus but plausible name. (Don't you love themed areas?) Bingo!
As far as safety or directions go, I can't see anyone having any problems. The cutover is really only there to avoid dumping people onto the main roads to go around the block; no firefighter would bother to zig-zag from one road to the other that way.
Well, I don't know about the rest of the world, but in Australia I don't think hospital staff in general know SQL! Besides, if someone can use SQL to access the hospital database you have a problem anyway. If you think about it, a hospital would have some kind of built interface to the database, wouldn't it?
Aren't all those fake files on the p2p networks honeytokens??
They are lures, if you bite then you are doing something illegal and they get your IP address just for biting the bait???
Bam! Nothing to it...
I've ALWAYS suspect this..
Not exactly revolutionary... This is just list seeding.
You shove in one-time known fake name into a mailing list (postal or e-mail) that you sell and then if any mail arrives at that address sent by someone you didn't sell the list to, then you know that they've been abusing their terms for use of the list. I do the same thing with websites... I register for websites I write with sitename_seed@mydomain.com and if any of the 'seed' addresses get mail, then I know that someone's been harvesting addresses from that site. Thankfully this has never happened (yet!).
Mapmakers will commonly seed slight defects into their maps (e.g. nonexistent roads) to detect copying.
A related practice in software engineering is "fault seeding", in which bugs are deliberately injected into code to see if they are found during V&V. (The deliberate bugs should be removed before the product ships, of course. :-)
Old ideas, but quite useful.
Our company uses this trick. There are 'honey-addresses' in our database. (a correct address belonging to an employee, with a completely wrong name) As soon as anything arrives at one of those adresses we know someone has made illegal use of an address from our database. Whatever gets send tells us who. Legal action follows ....
I heard that some police departments in the 70s had the license plate "853 OKG" for Jim Rockford's car (from "The Rockford Files" TV show) in their databases to detect cops running plates for their own amusement ...
He was talking about *querying* the database, not *modifying* it.
Or, do you umask 077 all your files, and just change ownership to who think should view 'em?
It must be a bitch trying to keep track of all those DSOs.
Do daemons dream of electric sleep()?
I heard about rand mcnally(sp?) doing this with their maps, they would insert a fake town name and when someone else ripped off their content to make new maps they would reproduce the fake town and get busted...
nice idea though...
While it is a good idea, it not a new idea at all. They ahve been doing it on maps for years. Maps nearly always have a non-existant feature so if copied the owner can say "we know it is our map". And his idea of using different content to try to identify who is leaking something? I did it years ago and was inspired by a book or newspaper story or somthing...
President ISES
(International Society for Elimination of Sigs)
If you go making up honeytoken credit card numbers and social security numbers, you'd better be sure they *are* bogus, not real numbers that belong to someone you don't know. Otherwise, your honeytoken might be someone's real data....
Oops wouldn't cover it in that case. <wry grin>
Catherine
Along the same lines as many of the other posts, I've seen instances of this in places I've worked all the times. In fact, my school already does this with SSN numbers in the database because there were incidents of the SSN database being stolen, and as many services in the town are offered to students, they were interested in seeing if the "honeytokens" (or we could just call them fake records like we've been doing for years) were actually being used.
What I don't get is the why the poster thought this article was so amazingly thought provoking? Ok, so it's a fairly interesting idea, but frankly it's just an old idea with a new name, and even if it was an original idea, it still wouldn't be that revolutionary.
Galactic center studies are though provoking. Graviational waves are thought provoking. Genome research is thought provoking. This is most definitely is not.
Damn!
I don't normally rant about shit like this but this just irked me this time....
Why are you letting beginners write SQL to access your live database without any testing on your test system?
This kind of comment is so fucking presumptuous. I wish that some people would account for the possibility that their assumption is not accurate - i.e. This doesn't mean that beginners are writing SQL to access a live database without any testing (although granted, it *could* mean that)!!!
What if it is a legitimate developer accessing the database in ways that legitimate developers do, running a legitimate query on a legitimate table that happens to not have an index on a column that should?
Maybe the DBA forgot to index that column???
Forgive my nit-pickishness but I'm a little pissy today.
You need people like me so you can point your fucking fingers, and say "that's the bad guy."
Is it just me, or are posters over-using "ergo"? Ever since Matrix Reloaded came out, every other post has "ergo." (yes, I'm exaggerating). Every time I hear that word, I imagine the architect saying "ERgooo." It's kind of annoying :p
I sig for world peace
get credit for this. She was the one who said something to the effect of "if the hacker wants data, then give it to them." They did, and the hacker was connected long enough for them to track him down. Greed is the downfall of most criminals, preceded only by stupidity.
Thankfully we've never encountered any cases of these records appearing in the outside world, but if (when?) one does, the record itself may help us to identify when the breach/leak occurred, so that we've got a starting point for futher investigation.
I suspect that this practice may be fairly common even though it isn't discussed much -- in order for it to be effective, you really shouldn't discuss the program at department or company-wide meetings.
While something like this won't make your data any more secure, part of any good security program is practices and tools to help you determine whether, when, and how your data *does* get compromised, and canaries can be one tool to help with the first two items on that list.
* * *
It is a dada story -- it has no moral.
I know of somebody working at a fast food delivery outlet with a customer db keyed to phone numbers (you do know the company) who would enter every local number anyone gave him to see if he got a hit. AFAIK he only used this to freak out girlfriends (by turning up to collect them from home for a second date when they hadn't yet given him their address), but it was a clear breach of the UK's Data Protection Act, and could have landed him in deep trouble.
twenty years ago we were marketing our mailing list of DECPro subscribers to our advertisers (suprise!)
every list sale had unique seed names/addresses inserted and we tracked whatever arrived at those addresses. every sales agreement had a paragraph in which the renter agreed that there were seed addresses inserted.
This reminds me of the cddb being stolen by Gracenote. Last time I checked, they were still claiming to own the database of audio discs (they may have changed their tune by now), despite the fact that it was built mostly from submissions by people like me. Gracenote basically took our diligent work, and started restricting access to it in order to make money. How do we know that they didn't build their own database? Because it contains entries for unpublished CDs that don't exist outside the homes of a few specific people; effectively honeytokens.
(Fortunately, an alternative now exists.)
I've always thought this would be a good way to stop email viruses on a local server, if you're foolishly using a virus propagator like Outlook. You create a special mail alias that doesn't belong to anyone. Everyone puts it in their Outlook address books. Any message sent to that address is a virus, and the server automatically blocks any subsequent messages that look like it.
Simple enough. In fact I once asked a sysadmin about it and he said they were doing just that, which wouldn't surprise me. On the other hand I was still receiving bonehead viruses, so maybe it wasn't working as well as it might have.
How many of us have used fake email addresses to identify spammers?
Do you have ESP?
Note in the definition that we do not state a honeypot has to be a computer, merely that its a resource that you want the bad guys to interact with. That is exactly what a honeytoken is, a honeypot that is not a computer. Instead it is some type of digital entity. A honeytoken can be a credit card number, Excel spreadsheet, PowerPoint presentation, a database entry, or even a bogus login and password.
Then why the new buzzword?
GodD&*Mnit!!
We don't want to hear about any more GOOD IDEAS!!!
We only want to hear about PANACEAS!!!
Don't post any more articles unless it describes something that that is an END ALL - BE ALL for ALL situations.
Otherwise, we're just not interested!!
Avoid Missing Ball for High Score
And look what a bunch of theives we have here they must have simply coppied other people's phone books! They ought to be hung like horses for the crime of unauthorized copying. So immoral.
Friends don't help friends install M$ junk.
I guess I'm not talking about the US then.
I don't quite remember which novel it was (maybe "Hunt for Red October"?) but in one of his novels, Clancy tells that Jack Ryan rose to prominence within the CIA because he proposed / developed a method of traversing confidential internal documents and replacing insignificant words with similar words (that retained the meaning of the sentence). The different versions of the document were then handed out to people that were entitled to a copy. If there was an internal leak, you knew who compromised security by comparing the leaked document with the documents distributed to individuals. This idea is going back 15 years.
I think the concept of honeytokens has much merit, and the author does emphasise that they are inexpensive to implement (for all those who think they offer little benefit).
Among Novell people. Netware's logging and auditing has always been excellent, and we would take advantage of this by leaving directories lying around named "admin" or similar, that were located outside normal userspace. This means that only people with more rights than normal users could access the file. It was an excellent way to weed out excess privileges on the network, especially when walking into a previously ill managed mess.
So, whenever a careless engineer trips something, he merely writes in the log "deliberately tripped such and such safety to demonstrate it to so-and-so", and no one is the wiser...
It is called a lure, you fish with it! Computer people should get out more!
Now move alone folks nothing new here.
This reminds me of the current trend to re-write every law on the books to deal with computers systems. We don't need it, just use your heads folks.
I remember a long time ago, at a company I worked for, we were having an issue with someone poking into someone else's mailbox.
I mean, what we did was no big deal at all really, all we did was have a script run out of cron that would report a change to the mailboxes atime to an outside address.
The idea was that the person whose mailbox was being violated would KNOW when they accessed it, and a notification that happened at a time they didnt expect would alert them to someone poking around.
Anyhoo... just popped into mind reading this.
Have you painted a shed today?
If you're worried about the Germans infiltrating your data stream, might I suggest an appropriate joke?
Q:Wenn ist das Nunstruck git und Slotermeyer?
A:Ja!...Beiherhund das Oder die Flipperwaldt gersput.
I Browse at +4 Flamebait
Open Source Sysadmin
Back in the 1980s, for example, science fiction bookstores would have to deal with people who found a previously undiscovered JRR Tolkien novel by browsing through Books in Print. The book didn't exist, however; it was merely an artifact added to provide evidence of someone stealing the BIP publisher's data.
If memory serves, Tom Clancy touched on a similar idea in one of his novels, having slightly different phrasings to key parts of intelligence documents which would allow investigators to better determine the route of leaked information.
Folks in magazine publishing used to use a similar ruse to track how subscriber info was being sold by competitors. You'd subscribe to one magazine as "Elvis J. Presley", for example, and another as "Elvis Q. Presley." By checking the middle initial of incoming junk mail, you could tell who had been selling your name and to whom they'd sold it.
Like I said, the idea's been around a while. The honeypot aspect is merely a new context and tracking mechanism.
Tyler
From just a dozen systems. The problem is *not* methods of detecting hackers or people accessing information.
The problem is information overload. It's false
positives.
Can you imagine the number of badly coded VB applications there are out there in the real world? Can you imagine the number of mistakes people make when executing queries
In a perfect world or with an unlimited security budget this stuff would be useful, unfortunately some of us don't live in a perfect world or have unlimited security budgets.
Deleted
So the JFK record would have to be corrupted, because if it emulated a correct record, then when the senior ward supervisor (nurse) was rostering staff to look after patients, JFK would be selected and allocated automatically. You'd have to fake all the way up to the top, ie ward, doctor, everything. And then the staff would recognise it as fake. Hospital patient databases are mostly for making sure patients get the right treatment, and a legal record of that treatement, and a financial record of the cost of that treatment, so a fake record would still have to be accessible to people responsible for these.
It doesn't make sense to say that nobody should be looking at the JFK record. It would make more sense to see the ward staff go nuts trying to find where he nicked off to (like an altzheimer's patient). He's in the computer so he should be in the hospital. If it is merely a historical record, the same problem would apply to the accounting staff (why hasn't he paid his bill?).
And mostly when you go into a hospital or medical facility they get you to sign something that says vaguely that you consent to have your details available to anyone they deem appropriate. They're not going to come back and try to get your permission separately to give details to the cardiac doctor if you happen to have a heart attack while staying with them!
I understand the concept, but I think the example is fairly poor. Perhaps it would be more accurate to say something like "access to this record should be limited". And I think the concept may be fairly old, eg in WWII examples of feeding the enemy false data, rather than actually imprisoning the detected spy.
-- it must be true, it's on the internet.
I remember an old SF story with the same plot line - An Asimov or a Saberhagen (Berzerker) tale having to do with a fake entry on a "galactic chart" that leads the bad guys astray...
My question is; Is there a real word for this practice? How bought industry jargon, at least?
Hey you cryptographers/encyclopedea'istes (gah) out there - what's the term?
These don't cut it: "map trap", "copyright thingy", "honey token", etc...
I don't know what I am looking for, but I'll know it when I see it (and verify it with a dictionary, or at least lots of google hits :-)
This issue is a bit more complicated than you think.
This is standard process in the database biz, including things like mailing lists and (as others have noted here) maps. The term for it is "salting". Calling them "honeytokens" is applying the wrong seasoning... and treating it as new on /. is also silly.
A man's reach must exceed his grasp, or what's an erection for?
When I got my ATM card, I wrote three 4-digit numbers on the back of the card, and showed it to my friends.
Friend: "Oh, I see! You hid the pass code among some fake passcodes!"
Me: "No, ALL of them are fake. I keep the real one in my head. I figure that a thief will think what you are thinking, and try all three numbers. Then the machine will eat the card."
If so what's the point of storing those records in hospitals? Hospitals aren't storages for peoples various papers, let patients store their own damn records.
Preserve old classics: copy your collection onto all hard drives.
The idea has been really in use for some time to protect secret British Cabinet documents. Each document would bve uniquely identified using variable spacing. I had heard word subsititution discussed but have doubts if it would be implemented. This is why when a newspaper gets hold of a leaked document, they are careful to destroy the original and not to quote too much verbatim.
See my journal, I write things there
So if a Doris sees 2 entries for Fred Bloggs she cannot correct the error until she has contacted both Fred Bloggs to ask their permission to delete the duplicate. Except she cannot look at the data to find out the address unless she writes to them and asks for permission...
I love stacking my barbecues in the shed at the end of summer - you can't beat a bit of grill on grill action.
In civilized countries you are not only not allowed to set traps for burglars, it has now been established that you owe a duty of care to anyone who breaks into your premises and trespasses on your land. If you know that kids might climb through your fence to hide in the long grass and get stoned, then KEEP OUT notices are not enough and if you have any hazards (deep wells, wires hidden in the grass) they must be made safe.
The logical correlative of this is that if you provide files with the intention that they should be downloaded by people who break into your system, and those files are engineered to cause damage, you will be (possibly criminally) liable for any damage you cause. "I didn't expect anyone to come this way" would be no defence when the only conceivable purpose of these files is to cause harm.
Most databases offer very flexible triggers. E.g., at least in Oracle you get to execute a whole script if you want to. And if you go through some middleware, you've got even more freedom.
So a "select * from names where last_name = 'Smith'" can be made to trigger exactly nothing. Assuming that the names table really contains nothing but names and ids.
On the other hand let's say it's something like "select * from PATIENTS where last_name = 'Smith'", where the PATIENTS table also contains house address, private phone number, etc. That is already retrieving private data for every single patient with the last name 'Smith'. With a well programmed honeytoken for a bogus patient called 'Random J Smith', it won't trip because the statement scans for 'Smith', it will trip because it retrieves that kind of private data.
If you do get your trigger tripped by something like that, you probably at least have an incompetent programmer (should have selected only the fields needed anyway), or at worst someone mining data about the patients. (No doctor treats all patients named 'Smith', so they have _no_ business retrieving the data for _all_ of them.)
And precisely _because_ it's easy for beginners to write bad programs, I do expect that programs dealing with such sensitive data be thoroughly tested. Yes, including by honeytokens and whatnot.
When you deal with that kind of sensitive data, taking the usual "oh well, we'll just write bad buggy code and patch it later" approach is plain old irresponsible. Letting any newbie code directly against the live hospital data without any safety checks, is as irresponsible as letting any newbie reprogram an airplane's systems in flight. A program which has to work on that kind of data should be thoroughly tested for any possible flaws, and have a competent team trying to hack into it too.
And yes, you'll never be 100% sure that it's bug free, but the honeytokens sound like a great extra way in which you can test it. And I fail to see why more bugs caught is a horrible thing.
A polar bear is a cartesian bear after a coordinate transform.
In the case of the hospital, patient records must, by law, be kept confidential. Additionally as human beings we must respect the emotions and dignity of others, which means that health problems are private. Therefore redundancy, or at least strong a reprimand, is an appropriate course of action for an employee who violates patient privacy.
In the case of the private company I think that it is sad that the author would like to see an employee put out of work for attempting to access a financial report. It appears that the justification for this is that the user and pass for the report came from an email to somebody in "management" (those in management apparently being sacred)
I wonder if the same action would be taken against somebody in management who looked at the emails of their secretary...
I suspect not
Its bad enough that injustice and double standards in the workplace are encouraged by those at the top. But when sys-admin "collaborators" in the rank and file seem to enjoy putting their coworkers out of a job (either for selfish gain, or blind vindictiveness) it is particularly distasteful.
You rent a house, put some cops inside it, then deliberately lose the door key, with the address marked on the keyring. Then you just wait for the burglars to come visiting. The key with the address on it is the honeytoken, the house is the honeypot. Or would this be thrown out of court for being "entrapment"? IANAL.
That might be a good example of where not to use honeytokens. When the books were written, "nobody but a few scientific and engineering applications would need that kind of accuracy," but what if someone did? A faulty calculation could result in a failed project or worse.
Furthermore, this kind of honeytoken requires a list of honeytokens to be stored somewhere, which would be a high value target for thieves.
"According to this map the enemy couldn't have possibly come up this way. There's supposed to be a big wall over there. That's why I said that it would be a waste of time to send scouts to check that approach out."
"Sir, since we're all going to die, may I speak freely."
"Sure."
"You're an idiot, Sir."
Having worked in catalog sales we used to spike our lists with fictional names using address's of co-worker before loaning/renting out the lists for limited use. Everytime a piece of mail was r'cvd for that name, the co-worker would simply bring it in for the list manager and he'd double check to make sure that our list was being used by authorized person's only. Or that our outsourced list broker was properly compensating us. I like the idea of taking this old technique and updating it for data access. The one drawback is how will you know if the person actually accessed the file maliciously or by mistake? Database endusers sometimes need to browse records to verify and compare information.
I remember reading this sort of idea in a Berserker Novel, by Saberhagen.
... the point is, people do this all the time anyway, with existing data (i.e books) , so they can find who plagurises them.....
As I recall, the Berserkers (think alien terminator endoskeletons, built for a war that ended eons ago, but now trying to exterminate mankind) had captured a space ship.
So the captain had to destroy the galactic encyclopedia, so the Berserkers couldn't find any human planets.
However, he was stopped by one of the passengers, because the passenger was one of the authors of said encyclopedia.
As an anti-piracy measure, fake "honeyplanets" had been added to the encylopedia, so if anyone brought out their own version, the authors could point out the fictious planet.
Of course, this fooled the machines and everyone was happy in the end.
>> "Another element of a honeytoken's value is their flexibility. You are really only limited by your imagination. As we have demonstrated in the section above, honeytokens excel as a detection mechanism. However, honeytokens can do so much more. Not only can they detect an..."
Selection of a honeytoken, while apparently a useful tool, is not trivial. For example, an IDS seeing the honeytoken on the wire is not adequate to determine a security violation. Suppose that the executive is actually reading her email. It sounds like a good idea, but while only limited to your imagination, it is also limited by the ability to determine context of the use of the honeytoken.
But, even in that case there are valid explanations. Suppose you're checking your hospital database, for, say, males, certain age, certain blood type, etc. Depending on what data is entered for the Kennedy record, it could match many searches. Not all database checks are by name.
...or at least it seems so. I was proofing a script against HTML insertion attacks, and tried that for kicks. It doesn't crash IE6/Win2k.
I hereby place the above post in the public domain.
as many have already pointed out, this is not a new idea.
Here in Germany the Telekom (former govment owned) has used this since years.
When the first phone books and yellow pages on CD appeared, many other companies came up with the idea to reverse engineer the data and do their own.
To prevent other companies from stealing these data they had several fake entries, that were only on these CDs.
The other companies had first to scan and OCR the paper books and since a few years the government forced the Telekom to sell these data.
If there's a record in a database about a famous dead person and I stumble upon it, aren't I more likely to click on it than if it was just a no-name person? Is that not the very definition of entrapment? Even if I wasn't looking at the record for nefarious reasons, I'd be in violation, for being curious. Granted, what's wrong is wrong is wrong... but for god's sake we're human beings!
"Politicians find new names for institutions which under old names have become odious to the people."
The mailing list industry has been using this sort of concept for years with rented lists. Say you want to buy a list from a list-house for a one-time use. In that list will be several "seed" addresses which are checked by that mail-house. That way they can nail you for using the list more than once or sharing it.
In a former life, I was managing the data for the alumni department of a college. They had several 'bogus' records in their data. The idea being that Mrs. Martha Jones (fictitious, but better than Jane Doe, no?) at such and so an address actually ended up in the home mailbox of the VP, or his mom, or the director in charge of mailings. If the mailing house managing the account ever sold the list (that would be early-90s data hacking), they would know because the VP would suddenly start getting non-college mail addressed to this fictitious name.
Decidedly low-tech, but effective.
And then see what Junk Mail I recieve.
It's amazing who makes the Data Protection Act.
A blog I run for the wealth
Poor Pooh is going on a wild honeypot chase....
I read the article so no RTFA replies please and IANAL.
It looks more like tempting a person to commit an activity and may be of questionable legal validity. Moreover if you enticingly share invalid information or have a bad security model you are equally liable.
All this stuff about honeypots and honeytokens seems to be some sort of PSYCHOLOGICAL/SOCIOLOGICAL maneuvuring to solve a technical problem
Direct mail advertisers often use lists "rented" from a list provider, paying a lease fee. Certain demographics / list subsets may be quite valuable and are priced appropriately.
If the advertiser is paying for a fixed number of uses of the list, the list provider wants to ensure that the advertiser doesn't go beyond the agreed-upon number of uses. So the lists are seeded with dummy names back to the provider.
If the list provider sees too many mailings on those seed names, the advertiser gets busted.
They've been doing this for at least twenty years (that I know about), but has probly been going on for lots longer...
Mine was mostly used in public hospitals where insurance payouts were generally irrelevant as your stay in a public hospital is fully paid by our Australian Government. Sometimes it takes a long time to get in. The system doesn't determine the correct treatment. The medical staff do that, and then key in what their plan is, and the system keeps track of it, so that the next shift know what pills to give patients when etc. There is usually a hardcopy somewhere (that the rellies can't find it, times have changed). The hardcopy gets scribbled on and the scribble gets typed into the computer. I knew a doctor who described the system as a device to keep nurses away from patients. And it was keeping nurses busy for at least 25% of their shift. Bleck. Even my GP keeps all his notes on the computer and the computer prints the scripts - so even I can read them. I agree that the "expert systems" for determining treatment are about as useful as the yellow pages for finding a music shop in a CBD shopping area.
-- it must be true, it's on the internet.