Honey Pot

HoneyPots
Vrijesh Kothari
(1RV01CS117)
What is Honeypots
They are decoy servers Gather information regarding an attacker or intruder into the system. A honeypot is an information system resource whose value lies in unauthorized or illicit use of that resource. Honeypots act as scouts in the field of information security. Examples
Could be a password file An important entry in the database. Personal data.
Advantages
Small data sets of high value. Minimal resources. Can handle Encryption or IPV6. Very simple to deploy and use. It can collect in-depth information. The intruder does not know its there. Can capture new types of attacks.
Use of HoneyPots
Intrusion Detection and prevention. Attack Analysis.
Observe attackers behavior and better tools to guard against it.
Decoys
Populate all unused addresses on your network with honeypots. Attacker has to waste time trying to attack the honeypots.
Uses (cont..)
Can Divert an attacker from accessing critical systems. Burglar Alarms When the honeypot is compromised, admins know that an attack is going on in their network Honeypot logs provide detailed information about the attack
It can monitor Botnets. It can be used to detect pattern in the logged data.
Types of Honeypots
Low interaction Honeypot
Attacker interacts with a simulated computer. Many levels of simulation possible. Network stack Services Operating System Very simple, low risk and require very minimal resources. But can only collect limited information and attacker can easily detect the presence of honeypots. Used for intrusion detection. E.g specter, Honeyd and KFsensor.
Honeyd Low Interaction
Runs on a single computer

Simulates
a group of virtual machines. Simulates the physical network between them.

Simulates only the network stack of each machine. Intended primarily to fool fingerprinting tools. This can capture only known activity. Used for detecting worms and capturing spams.
Fingerprinting
Attackers often try to learn more about a system before attacking it. Can determine a machines operating system by testing its network behaviour.
How
the initial TCP sequence number is created. Response packets for open and closed ports. Configuration of packet headers.

Common Fingerprinting tools Nmap and Xprobe. Thus Honeyd can be used to deceive these tools.
Architecture of Honeyd

Components Packet Dispatcher Configuration database Protocol handlers. Routers Personality Engine
Honey-Nets
High Interaction Honeypots It implements two main thing

Data
Control Data Capture

Network of real machines Honeywall- a gateway between honeypots and the rest of the world. The honeypots should be invisible to the attacker.
Data Control
It allows the bad guys to come in but controls what they can do on their way out. It works by two ways Traffic scans. Connection counting Disable the attacks. The attackers can see the failure but cant predict why they occurred. Traffic scans: Uses snort_inline to scan all packets as they go through the gateway
Connection Counting
Limits the number of outbound connection a honeypot can initiate in a time period. Can be set individually for different protocols. Choosing the connection limits is a tradeoff between information and security.
Low
connection limit: can be used as a signature to identify the honeypot High connection limit: allows attacker to do much more damage!
Data Capture
Logs all the attacker activities within the honeynet, without the attacker noticing. Involves 3 levels :
Level
1 :The gateway sniffs all packets and records all activities for later analysis Level 2 : Control inbound and outbound operations Level 3: Captures the attackers keystrokes
Legal Issues - Privacy
Honeypots can capture extensive amounts of information about attackers, which can potentially violate their privacy, such as IRC chats or emails. This could violate the privacy of the attacker, or more likely people he is communicating with. Privacy Laws in US limits the right to capture data about an attacker, even it is breaking into your honeypot.
Legal Issues
Liability
You can potentially be held liable if your honeypot is used to attack or harm other systems or organizations. This risk is the greatest with high-interaction honeypots
Entrapment
They
are not a form of entrapment. Suitable messages should be displayed to indicate that access is not allowed
Thank You

Honey Pot

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Honey Pot

Uploaded by

Copyright:

Available Formats

HoneyPots

Could be a password file An important entry in the database. Personal data.

Observe attackers behavior and better tools to guard against it.

Low interaction Honeypot

Honeyd Low Interaction

Runs on a single computer

a group of virtual machines. Simulates the physical network between them.

High Interaction Honeypots It implements two main thing

Control Data Capture

Legal Issues - Privacy

You might also like