Security Overview: Honeypots Stuart Hoxie

General Concept Honeypot Servers are an intrusion detection system for medium, large and experimental networks. As the name implies, honeypots are used to attract and trap malicious traffic. Primary Values in being: Probed Attacked Compromised

Honeypot Solutions Generally there are three solutions for what a Honeypot server can do: Deceive attackers Detect attacks/attackers Be compromised and learned from

Achieving The Three Goals In order to achieve the three primary goals, the system should: Look as real as possible. Be constantly monitored and surveyed. Appear as usable and meaningful as the real thing

How It Works Attackers are drawn to large deposits of valuable informations and honeypots exploit this. By faking information and hiding their true purpose, a well placed server can contribute to overall network security. These servers are exposed and are rather difficult to break, not impossible. This makes them more a legitimate target. Monitoring and Tracking tools are loaded to trace all activity of the attackers in detail. Using many Honeypots is considered a Honeynet.

How It Works Example:

Why We Use Honeypots Divert attention from the real network Building attacker profiles Identify new vulnerabilities and risks associated with new software Capture & study new viruses, worms, and other malware

Research Honeypots Criteria: Not implemented for the purpose of protecting a network Used to study attack patterns, behaviors, offensive tools, and other threats Education/research driven

Production Honeypots Criteria: Implemented for the purpose of protecting an organization or environment Directly assist in securing a network Detection, prevention, and response For example Tarpits can be used to slow down automated attacks and worms. For humans, psychological defenses are used. Confusing the attacker with complex or unordinary layouts/design, misleading or deceiving and deterring attacks.

Advantages Live and Gathering Resources Information Gathering Designed to capture anything that interacts with them Unknown can be researched Resources Basic machines can be implemented to handle large networks Information Gathering Collect detailed information on all interactions as a security incident tool Real Environments IPv6/v4 implementation Simplicity Basic to design, implement and install Tactics never seen before and Zero day attacks can be researched and analysed

Disadvantages Vision Risk Limited to implemented scope and interaction with them Inability to support/analyse neighbors Risk Potential to hijacking and leveraging Misconfiguration

Resources https://www.powershow.com/view/12bd29-OWJiM/The_Honeypot_Project_powerpoint_ppt_presentation https://en.wikipedia.org/wiki/Honeypot_(computing) http://labrea.sourceforge.net/labrea-info.html https://github.com/paralax/awesome-honeypots https://www.anomali.com/blog/what-is-shockpot-and-how-can-it-keep-you-safe http://www.keyfocus.net/kfsensor/ https://elguber.wordpress.com/2015/06/18/list-of-honeypots/ https://www.slideshare.net/iradarji/honey-pot-presentation