Hi everyone,

Has anyone got any experience of working with honeypots on Windows OS?
I'm doing my university project on someone hiding their tracks on a honeypot. But there doesn't seem to be much literature on it. I know of Lance Spitzner's Honeypot Project. Do you know where I can find more information?

Many thanks!  

I'm not sure that you'll find a great deal of literature on that topic. Honeypots are meant to provide tempting targets for attackers/intruders, and lead them into a heavily monitored system or subnet. As such, "hiding your tracks" is extremely difficult, if not impossible (based on what monitoring tools are in place).

A honeypot is akin to putting the last Hostess Twinkie on a pedestal in a room, and having all sorts of cameras, motion detectors, etc., in place. You then hope that the intruder goes after the Twinkie instead of your jewelry, and monitor their actions. With the right monitoring (network taps, file system and Registry monitors, etc.), the only way to avoid being detected is to not even attempt to get the Twinkie at all.  

Isn't any Windows PC connected to the internet a honeypot by default?  

- twjolson

Isn't any Windows PC connected to the internet a honeypot by default?

Nope. Honeypots are usually subjected to some sort of monitoring and/or analysis...  

- keydet89

Nope. Honeypots are usually subjected to some sort of monitoring and/or analysis...

Ha, and some versions of Windows don't even bother with Event Logs. Cuz, you know, what point is there in knowing why Windows crashed and burned?  

- twjolson

Ha, and some versions of Windows don't even bother with Event Logs.

To which versions are you referring? Win95/98?  

- keydet89

I'm not sure that you'll find a great deal of literature on that topic. Honeypots are meant to provide tempting targets for attackers/intruders, and lead them into a heavily monitored system or subnet. As such, "hiding your tracks" is extremely difficult, if not impossible (based on what monitoring tools are in place).

A honeypot is akin to putting the last Hostess Twinkie on a pedestal in a room, and having all sorts of cameras, motion detectors, etc., in place. You then hope that the intruder goes after the Twinkie instead of your jewelry, and monitor their actions. With the right monitoring (network taps, file system and Registry monitors, etc.), the only way to avoid being detected is to not even attempt to get the Twinkie at all.

Thank you for your prompt response.
Do you know if it is possible for an attacker/intruder to alter the logs created by the honeypot? Not using anything else but a honeypot. I.E. no network sniffers etc.
How would an investigator be able to tell if an attacker/intruder has altered the log files?