Slashdot Mirror
Fun Things To Do With Your Honeypot System
An anonymous reader writes "Whitedust is running an interesting article on honeypots and their uses. From the article: 'Most papers deal with the potential gains a honeypot can give you, and the proper way to monitor a honeypot. Not very many of them deal with the honeypots themselves... Honeypots can be used to ensnare and beguile potential hackers; entice them to give you more research information, and actively defend your production network."" From the article: "Once an attacker has taken all the trouble to set up shop on your honeypot, he'll probably want to see what else there is to play with. If your honeypot is like most traditional honeypots, there's not much for an attacker to do once he gets in. What you really want if for the attacker to transfer down all the other toys in his arsenal so you can have a copy as well. Giving an attacker additional targets with various operating systems and services can help him decide to give you his toys. The targets can be real, but you'll get almost as much mileage if they're simulated. A good place to start is to put a phantom private network up hung off the back of the honeypot."
Just put on unpatched Win 98 box naked on the Internet and a wait. You will soon have a hard drive full of porn and warze.
:)
Actually it sounds like fun. Throw up VMWare and a few images and you could make an enter virtual network for a hacker to go nuts over.
Add in a PDP-11 Emulator, some hacked NASA and Air Force sites, a fake database or two, some Word documents showing that the US has a secert base in the middle of the everglades.....
could be fun.
Sounds like a great Hacker DnD game. Get a bunch of people to set up these things and the game is too find out what the is going on.
See my blog http://ilovecookes.blogspot.com/ for light hearted technical information.
Why don't you just secure your network and you don't have to worry about it
Oh, is that all? Good to see you've boiled network security down to a single step. I'd say write a book, but it would only have one page so that's probably a waste of your time.
Slashdot - where whining about luck is the new way to make the world you want.
My other account has a 3-digit UID.
Most people use their honey pots for surfing the web, checking email and sometimes playing games.
"If you are going through hell, keep going." - Winston Churchill
What if someone uses the trojans, etc. they install on your honeypot to launch an attack on some other site? Since your express purpose is to watch what they do, you can't claim ignorance.
Are you liable for any damages?
Are you causing problems for law enforcement or other sysadmins by helping the attacker obscure their identity?
Seems like you would need to filter outbound traffic VERY carefully. It would be almost impossible to do this without the attacker knowing -- they'd realize it was a honeypot and get the hell out of there.
Sorry to do this, but I think that it is somewhat careless to assume that all new parents that might be reading Slashdot are in fact aware of the unique danger that honey presents to infants. Just in case someone comes across this and isn't aware, please look into the concerns related to infant botulism before getting the bright idea to feed your newborn some honey. Now go ahead and make the jokes - I just think that this needed to be said.
non-Geek: "Is this a sexual reference? I don't get it...are they talking about that weird cyber thing?"
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
until someone uses your honeypot as a platform to attack someone else. Or were you thinking that bad guys never use machines under their control in this manner?
Who are these security people with so much free time that they can monitor a honeynet for hours on end and create bogus traffic to move across it in order to entertain a bored 16-year-old hacker from who knows where? Every serious professional I know is up to his eyeballs in real work.