Slashdot Mirror
Fun Things To Do With Your Honeypot System
An anonymous reader writes "Whitedust is running an interesting article on honeypots and their uses. From the article: 'Most papers deal with the potential gains a honeypot can give you, and the proper way to monitor a honeypot. Not very many of them deal with the honeypots themselves... Honeypots can be used to ensnare and beguile potential hackers; entice them to give you more research information, and actively defend your production network."" From the article: "Once an attacker has taken all the trouble to set up shop on your honeypot, he'll probably want to see what else there is to play with. If your honeypot is like most traditional honeypots, there's not much for an attacker to do once he gets in. What you really want if for the attacker to transfer down all the other toys in his arsenal so you can have a copy as well. Giving an attacker additional targets with various operating systems and services can help him decide to give you his toys. The targets can be real, but you'll get almost as much mileage if they're simulated. A good place to start is to put a phantom private network up hung off the back of the honeypot."
In addition to all of the things on the network I normally have to do at the office let me set up an entire phantom network just to "jack" with hackers. Yeah, I'll get right on that.
--And sektor spoke and said unto the people. Hey, buttwipe hand me the cheezeos.
____________________________________________
Honeypot is literally the term for a container of honey but is used in several different ways, often playing off the image of sweetness being used as a lure:
* A computer system set up as a trap for attackers; see Honeypot (computing)
* Traps designed to catch conventional criminals; see honey trap
Wincopy
What with the rumours that Mckinnon was caught by a US Military Honeypot it's interesting to read what can be done with sych systems.
No I get the point. I was making a joke, but I still thing it's silly. Why don't you just secure your network and you don't have to worry about it. Unless I worked for a security company or network vendor I wouldn't waste my time trying to score a hacker's toolkit. Unless I'm running something that's home made I don't really need to honeypot it. The # of "real" hackers out there compared to script kiddies is very small. I can download the script kiddie tools myself if I want. Nice AC post by the way.
--And sektor spoke and said unto the people. Hey, buttwipe hand me the cheezeos.
Just put on unpatched Win 98 box naked on the Internet and a wait. You will soon have a hard drive full of porn and warze.
:)
Actually it sounds like fun. Throw up VMWare and a few images and you could make an enter virtual network for a hacker to go nuts over.
Add in a PDP-11 Emulator, some hacked NASA and Air Force sites, a fake database or two, some Word documents showing that the US has a secert base in the middle of the everglades.....
could be fun.
Sounds like a great Hacker DnD game. Get a bunch of people to set up these things and the game is too find out what the is going on.
See my blog http://ilovecookes.blogspot.com/ for light hearted technical information.
Why don't you just secure your network and you don't have to worry about it
Oh, is that all? Good to see you've boiled network security down to a single step. I'd say write a book, but it would only have one page so that's probably a waste of your time.
Slashdot - where whining about luck is the new way to make the world you want.
Host NASA servers? :)
My other account has a 3-digit UID.
Most people use their honey pots for surfing the web, checking email and sometimes playing games.
"If you are going through hell, keep going." - Winston Churchill
Give them a virus that you wrote. Put a bunch of what appear to be self-extracting zip files in a directory and attach a virus to the extractor. Give them fun names, too. Like Montauk Project, Philadelphia Experiment, Roswell, etc.
Job? I don't have time to get a job! Who will sit around and bitch about being broke and unemployed then?
What if someone uses the trojans, etc. they install on your honeypot to launch an attack on some other site? Since your express purpose is to watch what they do, you can't claim ignorance.
Are you liable for any damages?
Are you causing problems for law enforcement or other sysadmins by helping the attacker obscure their identity?
Seems like you would need to filter outbound traffic VERY carefully. It would be almost impossible to do this without the attacker knowing -- they'd realize it was a honeypot and get the hell out of there.
Sorry to do this, but I think that it is somewhat careless to assume that all new parents that might be reading Slashdot are in fact aware of the unique danger that honey presents to infants. Just in case someone comes across this and isn't aware, please look into the concerns related to infant botulism before getting the bright idea to feed your newborn some honey. Now go ahead and make the jokes - I just think that this needed to be said.
Do you have so much time on your hands that you find it amusing to prattle on about common spelling errors? Or does it some how make you feel superior to spot a misused "an" and point it out to the whole world as is "see, this person is an idiot, whereas I am a superior human!". Good lord, get a life.
Errors:
1. "Somehow" is one word.
2. as is "see, this person is an idiot As is?
3. a superior human!". With the type of English that one uses in the U.S., sentence-ending punctuation is usually contained within the quotation marks and one doesn't usually use two of them in one sentence.
4. Good lord Generally, "Lord"--when used in this context--is capitalized.
Damn, it's great to have so much time on my hands so I can feel so superior!
Dude (or Dudette), are you new here? Didn't you realize that correcting other people and then feeling superior is what /. is all about. Heck, it's one big "I'm smarter than you" pissing contest.
a fake database or two, some Word documents showing that the US has a secert base in the middle of the everglades....
You'll then get pulled in by Homeland Security and shipped to Gitmo for revealing that the US has a secret base in the middle of the Everglades.
Just fill the honeypot with pr0n and there will be plenty for the hacker to play with.
Make sure that everything rlogs to an append-only hardened blackbox with a high securelevel. Preferably obsd. Also, make sure you have banners that will hold up in court. A honeypot is not something to be viewed as 'extra work' for a network administrator, but ESSENTIAL when combined with a few IDS sensors. It is the way to keep on top of your overall network security, and gives you a few extra IP blocks to add to your overall firewall ruleset. If you are really lucky, you will bring down some asshat that tries to compromise the network you have spent all those hours configuring and hardening.
Simulated traffic can be used in conjunction with simulated targets....If you want to really see what the attacker is all about, simulate traffic that looks like someone trading MP3s, or traffic that looks like someone transferring business documents. If the attacker spends most of his time looking at the MP3 traffic, he is probably pretty harmless. If he spends his time looking at the documents, he is probably pretty dangerous.
Yea, right. Great advice, right up to the day that the RIAA and their FBI thugs come breaking down your door and taking every computer that you own and anything else they want too, because the hacker that broke into your system and saw all that traffice was an RIAA hacker.
I'm an American. I love this country and the freedoms that we used to have.
non-Geek: "Is this a sexual reference? I don't get it...are they talking about that weird cyber thing?"
Zonk, is it necessary to edit down what your submitters give you and take half of the post to include part of the referenced article?
- jon
Ganymede, a GPL'ed metadirectory for UNIX
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
until someone uses your honeypot as a platform to attack someone else. Or were you thinking that bad guys never use machines under their control in this manner?
Who are these security people with so much free time that they can monitor a honeynet for hours on end and create bogus traffic to move across it in order to entertain a bored 16-year-old hacker from who knows where? Every serious professional I know is up to his eyeballs in real work.
Why don't you just secure your network and you don't have to worry about it.
In my life, I've identified a few key words that are highly accurate in ferreting out people who waste time. One of these is "paradigm". Those who wax poetic about "paradigm" are typically those who haven't bothered to figure out how things work, and are trying to convince you to do whatever it is that they think might work.
Big waste - RUN!
I've come to discover that "just" is a key word. It positively identifies those who have no idea what they're talking about. The most rediculous, inane, and useless activities I've ever seen all started with the word "just" in the job description. Like:
"Solar power is feasible - just bring down the cost of manufacturing"...
or,
"Sex is no big deal - just get a girlfriend"... (big one for many who peruse these boards)
or,
"The software works great - we just need to change a few basic assumptions..."
So, watch that word, "just". It usually fortells major catastrophe and certainly unrealistic expectations!
I have no problem with your religion until you decide it's reason to deprive others of the truth.
A visiting what? C'mon - I mean seriously.....this *is* slashdot!