±Forensic Focus Partners

±Your Account


Nickname
Password


Forgotten password/username?


Membership:
New Today: 0
New Yesterday: 17
Overall: 27344
Visitors: 69

±Follow Forensic Focus

Join our LinkedIn group

Subscribe to news

Subscribe to forums

Subscribe to blog

Subscribe to tweets

Honeypots

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Go to page 1, 2, 3  Next 
  

Honeypots

Post Posted: Wed Feb 13, 2013 7:21 am

Hi everyone,

Has anyone got any experience of working with honeypots on Windows OS?
I'm doing my university project on someone hiding their tracks on a honeypot. But there doesn't seem to be much literature on it. I know of Lance Spitzner's Honeypot Project. Do you know where I can find more information?

Many thanks!  

Sarah_Camp
Newbie
 
 
  

Re: Honeypots

Post Posted: Wed Feb 13, 2013 8:12 am

I'm not sure that you'll find a great deal of literature on that topic. Honeypots are meant to provide tempting targets for attackers/intruders, and lead them into a heavily monitored system or subnet. As such, "hiding your tracks" is extremely difficult, if not impossible (based on what monitoring tools are in place).

A honeypot is akin to putting the last Hostess Twinkie on a pedestal in a room, and having all sorts of cameras, motion detectors, etc., in place. You then hope that the intruder goes after the Twinkie instead of your jewelry, and monitor their actions. With the right monitoring (network taps, file system and Registry monitors, etc.), the only way to avoid being detected is to not even attempt to get the Twinkie at all.  

keydet89
Senior Member
 
 
  

Re: Honeypots

Post Posted: Wed Feb 13, 2013 8:14 am

Isn't any Windows PC connected to the internet a honeypot by default?  

twjolson
Senior Member
 
 
  

Re: Honeypots

Post Posted: Wed Feb 13, 2013 9:53 am

- twjolson
Isn't any Windows PC connected to the internet a honeypot by default?


Nope. Honeypots are usually subjected to some sort of monitoring and/or analysis...  

keydet89
Senior Member
 
 
  

Re: Honeypots

Post Posted: Wed Feb 13, 2013 10:36 am

- keydet89

Nope. Honeypots are usually subjected to some sort of monitoring and/or analysis...


Ha, and some versions of Windows don't even bother with Event Logs. Cuz, you know, what point is there in knowing why Windows crashed and burned?  

twjolson
Senior Member
 
 
  

Re: Honeypots

Post Posted: Wed Feb 13, 2013 11:54 am

- twjolson

Ha, and some versions of Windows don't even bother with Event Logs.


To which versions are you referring? Win95/98?  

keydet89
Senior Member
 
 
  

Re: Honeypots

Post Posted: Wed Feb 13, 2013 12:46 pm

- keydet89
I'm not sure that you'll find a great deal of literature on that topic. Honeypots are meant to provide tempting targets for attackers/intruders, and lead them into a heavily monitored system or subnet. As such, "hiding your tracks" is extremely difficult, if not impossible (based on what monitoring tools are in place).

A honeypot is akin to putting the last Hostess Twinkie on a pedestal in a room, and having all sorts of cameras, motion detectors, etc., in place. You then hope that the intruder goes after the Twinkie instead of your jewelry, and monitor their actions. With the right monitoring (network taps, file system and Registry monitors, etc.), the only way to avoid being detected is to not even attempt to get the Twinkie at all.


Thank you for your prompt response.
Do you know if it is possible for an attacker/intruder to alter the logs created by the honeypot? Not using anything else but a honeypot. I.E. no network sniffers etc.
How would an investigator be able to tell if an attacker/intruder has altered the log files?  

Sarah_Camp
Newbie
 
 
Reply to topicReply to topic

Share this forum topic to encourage more replies



Page 1 of 3
Go to page 1, 2, 3  Next