Printable View
Lol this might sound stupid lol...
Never heard of a honeypot and today saw this forum lol...
Anyways did some research on google instead of just running to u and asking what it is...
Anyways correct me if im wrong lol since I really dont know much about it...
Is a honeypot a software that protects you from adversaries that randomly scan the network?
I saw that it also triggers a counter-worm by immunizing infected hosts that contact virtual honeypots.
Thanks
/Scriptkiddie18
It can be software but it could also be an OS built from scratch. It can also be used for more than scans and worms (early warning system concept). You might use it as a research platform to understand better how and why attackers do what they do. Honeypots by Lance Spitzner is an excellent reference in regards to this.
Visit HoneyNet Project for some resources and details.
A honeypot is a bunch of different things really. The name for it comes from actual honeypots that might be used to draw away flies or other insects. The modern honeypot is the exact same thing, but for hackers.
The honeypot is designed to look like a real server, and act like it in many ways. This keeps an attacking entity busy with a fake server the entire time, and once they've managed to pierce the security, if at all, you can kick them out, patch up the honey pot and your real server, and be relatively safe. Generally, though, honeypots are mainly used on larger servers, and aren't designed for home computers or computers on a small network running a small file server, although it can be used that way.
There are a lot of variations on honey pots, and a lot more details that can go in with it, but that's the grand overview.
Edit: Dang, MsMittens. Beat me to it! Nice link, BTW.
a honey pot collects information about possible attacks... it sits around looking like a nice easy target, then collects all data from attackers to be analyzed later, many new attack techniques and worms are found in honeypots... goto honeynet.org for more info...
AHA...so its like a online trap so to say...it waits til somone attacks..it defends itself and counter attack the attacker?...wow nice thing :D
Thanks all and Thanks you too MsMittens for the link
/Scriptkiddie18
Ah.. Counter attacking isn't something that I've seen in all honeypots. In fact, from what I've read this isn't the preferred method. The reason is that the attacker may be using an innocent bystanders computer (so to speak) or could be spoofing (blind and half blind attacks) against the honeypot.
Unlike Senator Hatch, who thinks this is appropriate, it's not. Better to use to gain information and press charges than attack and be charged.
a honey pot can be used in different ways, from what i know the FBI started setting up honeypots so they could collect evidence before arresting a cracker or scriptkiddy.
But they are free to download, setup and use for anyone now.
Really? No wonder so many crackers and kiddies don't get jail time. That's "entrapment". Take a look at Lance Spitzner's discussion about the legalities of Honeypots, including entrapment and privacy issues (yes, privacy... go figure eh?)Quote:
a honey pot can be used in different ways, from what i know the FBI started setting up honeypots so they could collect evidence before arresting a cracker or scriptkiddy.
That isn't entrapment, atleast not by itself. Entrapment is generally when cops use the evidence of a crime against a criminal to black-mail them, or so I've been told. I've also heard it said that it could be considered entrapment if the criminal was actually baited first, but a honeypot on a server that would already have been attacked for those same types of servers....that's not baiting, that's putting up a shield.
That's my two cents, could be wrong.
You lost me Mittens...were you disagreeing, or providing a broader palette for discussion?
Setting up a honepot is not entrapment. If you advertised it as a server that could be hacked for the purpose of catching black hats, then the defense would be entrapment.
Am I misunderstanding you?
EDIT: Thanks Mittens..I figured I was missing your point :D
Misunderstanding. If an attacker is caught because of activities they did against a private citizen's or private corporation's honeypot, the attacker cannot use entrapment as a defence. If, however, the FBI or other law enforcement setup a honeypot, the potential is there. Quite often people assume that honeypot = entrapment, hence the reason why we don't see it. The reality is that the individuals setting it up must be in a law enforcement capacity for it to be close to entrapment.
Whether it is or not in the end, assuming it's set up by law enforcement, is a debate in the courts.
K lol so from what you told me i understand it now i think :D
but i bet thats not all honeypots do...(collect information that is) is it?
Act as a decoy and perform some intrusion detection but the primary function is information gathering. Remember that security is multiple layers. A honeypot is just one of those layers.
7 layers right...hmm i only know 2 lol.....honeypot and network...what are the other 5 layers then?
Depends on how much you are protecting and how $$ it will cost the company if it's stolen/broken into/etc. Generally, you'd use things like:
- firewall
- antivirus
- honeypot
- IDS
- logs
- auditing and testing
- patches/updates/fixes
- security policies
- procedures
- acceptable usage policies
- monitoring
- common sense
I'm sure I missed something. A few to all of these can be used, depending on resources, time and knowledge.
thats all for like big companies but for home computer security you should have...
-firewall
-antivirus
-monitoring
-logs
right? or am i missing something also? :D
An IDS (intrusion detectin system). You will find that many firewalls have some type of IDS built into them. It's just as easy to build a SNORT system and have that running (I have one on an old P100 with FreeBSD).
And you forgot common sense for the home user.
A nice one to add to the firewall & honeypot topic might be a tarpit. If you want to know what it is use google, because there's people who can tell you much better then me...
Short explenation: it's a deamon that can listen on all free ip adresses (on one switch because of the arp stuff so not the entire internet lol) and all free ports of those free adresses. All ports appear to be open and if for example a worm tryes to spread itself by connecting to a port or something, the deamon will keep the connection with the worm. The worm tryes to use it's onboard exploiting toolbox, but that doesn't affact the tarpit. It can slowdown worms because they stay connected until they get disconnected (wich they won't do themselves and the tarpit won't either)... they can stay stuck in the tarpit forever.
We have a thing here called the car bait program. It's a car that is left unlocked with the sole purpose of being stolen.
Legally the police are in a panic because the argument as to whether or not it is a form of entrapment, is hot topic. In the real world however, and IMO, opportunistic crime is still a crime. If an honest person sees a car that is unlocked with the keys in it he/she would attempt to find the owner or take some other responsible action rather than hop in and take off with it.
So I think Honeypots and bait programs [such as the one I mention] are a good thing.
The powers that be [that we put into power to begin with] think otherwise.
And before anyone says it, let me make it clear, honeypots ARE bait. Exploit scanners will pick them up in a heartbeat because of the pure nature of the honeypot and the pure nature of the exploit scanner. :-)
Kwi.
a honeypot is a pot full of honey.
this pot is usually a sort of container that looks like it can easily be broken or steal from. it's appearance can be very deceiving sometimes, and often tempting. you can find these pots decorated with gold linings and adored with sweet scent of delicious honey. you might not notice any difference if you compare this pot to any other pots, only that it is really tempting. sweet honey. so sweet.
you probably won't notice those thousand bees keeping careful watch of what's happening. They are very, very patient type of bees. they just take note of what people are doing on their honeypot. you know, people will take very little notice of bees watching if they see a very tempting pot of honey. so the bees can gather a lot of usefull information by keeping an eye on those people with honeythoughts on their mind.
sweet honey.
pot full of honey.
pot full of delicious sweet honey...
honeypots.
-jet
:D
Don't honeypots also suck up the resources of the computer that is hacking into it? I've heard that they also bog down the resources of the attacking computer making it so that their machine is unable to function?
Fastball: That's a Tarpit..... You get into it.... you get stuck and you can't get out..... It's really a honeypot on speed..... All the "attraction" of the honeypot but with the nasty side effect of locking up your resources that could be used to attack others.
As far as I am concerned the argument about honeypots being entrapment is a lot like the BS about the unlocked car with the keys in...... I'm a law abiding citizen, If I pass a car that is unlocked with the keys in my first thought is "Moron".... It isn't "Wow, a freebie"... If it was I'd be a criminal. Same principle applies to a honeypot..... I don't search the internet for machines with "the door unlocked and the keys in"..... Because i have no intent to commit a crime. But those people who are searching have an intent..... The intent is to exploit a machine if they can. But they started with the intent.... and even if they came across it by accident, they had the choice to "walk on by".... They don't!
Opportunistic crime is no better nor worse than premeditated. It goes to the psyche of the individual involved.... if they are predisposed to commit a crime they will..... If they aren't they won't.... period......
The fact that the liberal "idiots" in this world can't see that a crime is still a crime and the defense lawyers "prey" upon that notion is the issue.
Entrapment _should_ be: If I send you an attackable IP address, (there's millions, don't forget), and tell you it's attackable and I'm a law enforcement official and you attack it.... that's entrapment..... If I'm a law enforcement official who simply places a honeypot out there and says nothing about it and you attack it..... Your @$$ is grass.... Because _you_ searched it out, _you_ assessed it and _you_ attacked it......
It's really that simple..... But there's those lawyers preying on the "bleeding hearts" that will make sure that this is considered "illogical"..... :mad:
On the subject of Honeypots being protective vs entrapment, here's a nice .PDF for you guys to read up on. I think it's only about 5 pages worth. I read it and it seems a legal 'fine line' if you will. It appears though, that law enforcement officials have an easy way out of being charged with entrapment, they have use someone who is not a law enforcement officer to set up the honeypot.
Check out the bottom of page 3, Societal Issues. This deals alot with the question in hand.
http://www.sosresearch.org/publicati...2honeypots.PDF