Slashdot Mirror
Dell Open Sources DCEPT, a Honeypot Tool For Detecting Network Intrusions (helpnetsecurity.com)
An anonymous reader writes: Dell SecureWorks researchers have developed a tool that allows Windows system administrators to detect network intrusion attempts and pinpoint them to the original source (i.e. a compromised endpoint), and have made it available for everybody. The tool is called DCEPT (Domain Controller Enticing Password Tripwire). It consists of: The DCEPT Generation Server, which creates unique honeytoken credentials for Active Directory (AD), the Windows component used by network administrators to manage accounts, processes, and permissions on devices within their domain. The DCEPT Agent, which introduces them daily into the memory of each endpoint on the network. The DCEPT Sniffer, which looks for Kerberos pre-authentication packets destined for the AD domain controller that match the honeytoken username. If it detects one, it alerts the network administrator and points towards the compromised workstation. DCEPT has been open sourced and is available on GitHub, along with instructions for deployment.
DCEPT Icon?
*slow clap*
Misread as 'tripeware', which tbh is all I can imagine it being when Dell has put their name to it
"DCEPT (Domain Controller Enticing Password Tripwire) is a honeytoken-based tripwire for Microsoft's Active Directory." ref
Thanks all.. It certainly does have the potential to Transform security.
I, for one, consider this more of a honeydick than a honeytoken or a honeypot.
He once inserted random mutations into his code, just so he could have the experience of debugging.
Hate to break it to you: but you are already running Linux in your business. You just don't know it.
Humor in disguise.
For the longest time the never arriving "Year of Linux on the Desktop" was to herald the success and legitimization of Open Source Software. Perhaps we were a bit narrow minded. Linux as a desktop OS, however popular and yes I am a user of 20 years myself, is dwarfed in the world of Open Source by so many massively successful and important products. Over the last couple of years we have seen many major companies, traditionally closed source all the way, begin to Open Source massive products. Even Microsoft, as they migrate their business model to a cloud company, is increasingly investing efforts in Open Source. Likely there will always be closed source platforms, but it is looking increasingly likely that they will wholly depend on a larger Open Source ecosystem. The year of Open Source is here and now.
Awaiting rebuttals, criticism and commentary.
Brought to you by Carl's Junior.
Hate to break it to you: but you are already running Linux in your business. You just don't know it.
Hate to break it to you, but the CxO doesn't really give a shit beyond their Outlook, Internet Exploder, Exchange, and MS Office toolset.
One could argue that Java runs the world, except that CFOs still think you're talking about a pot of fucking coffee.
Any IT manager who uses the most compromisable OS on which to base intrusion detection and security tools needs to have hizzerher ass fired. Out of a cannon. Into the sun.
Open source tools like in the title of this post need to run on a hardened Unix/Linux platform.
I deny that I have not avoided attaining the opposite of that which I do not want.
I know I asked this before, but, Dell has an R&D?
Megatron, a.k.a. Calvin Johnson, just retired from the NFL. I guess he ran out of Energon.