11.3 - Honeypots

 11.3 - Honeypots 

 

Key Terms: 

• Honeypot – A physical or virtual network device set up to look like a legitimate network resource to attract a hacker. 
• Low-level – A honeypot that stimulates a limited number of services and applications of a target system. 
• Honeypot interaction levels – Indicates the amount of interaction that a hacker can have with a honeypot. 
• Medium-level – A honeypot that simulates a real OS, applications and services. 
• High-level – A honeypot that simulates all services and applications. It can be completely compromised to give a hacker access to a controlled area. 
• VMware – A virtualisation software. 
• User-Mode Linux (UML) - A software program which allows a user to virtually run one or more versions of Linux on one session. 

 

Honeypots 

Honeypots are network devices set up to look like a real network resource. They are implemented to attract hackers and can monitor the hacker’s activity if they try to break into it. Honeypot environments are designed to safely store and monitor malicious files and code if the hacker chooses to upload rootkits and malware. 

 

Honeypot Types 

• Physical – These are actual network devices with real IP addresses on the network. 
• Virtual – These are simulated devices on a network. Virtual honeypots are usually more cost-effective. 

 

Honeypot Placement 

Based on the topology of the network, honey pots can be placed inside or outside the firewall. If placed on the outside of the firewall, there is less risk of accidental breaches into the network. However, if placed inside the firewall, the honeypot will look more realistic and valuable. 

 

Honeypot Interaction Levels 

A low-level honeypot simulates a small number of applications and services on a network. They can’t be compromised fully, and they are generally set to collect information about attacks. Medium-level honeypots simulates a real OS, application and services. High-level honeypots simulate all services and applications that can be found on a real device. High-level honeypots look the most realistic however, they have the most risk and highest cost. 

 

Tools 

• KFSensor – An IDS and honeypot simulator. 
• HoneyBOT – Capable of simulating a wide range of services and applications. 
• HoneyDrive – A Linux based honeypot that contains preinstalled and configured services/applications. 

 

Find Honeypots 

To find a honeypot, a hacker may probe the services running to find suspicious activity that may indicate a honeypot. Ports that show running services but deny handshake connections may also indicate a honeypot environment.