Tag Info

Hot answers tagged

11

Has anyone else tried this: Certainly, yes. Almost every anti-spam service out there uses them, the industry term is "spamtraps" How do you go about doing it? Normally, find an address in one of the domains which receives a lot of spam and confirm with the owner that it is not in use and they have no plans to resurrect it. This process can be ...


11

Yes, Stephen Murdoch at the University of Cambridge has done it, earlier this year. You can read his results in the Security Research Group blog; the initial experiment is discussed in this article, and some more results appear in this article. My personal favourite bit was For example, there was a log-in attempt for the usernames “root” and “dark” ...


8

There are a few books on the subject (although I've never bothered with them), however I can recommend you some readily updated websites: The always interesting honeyblog The European Network of Affined Honeypots has many recent papers and presentations The Honeynet Project has some good papers Distributed honeypot management software and a video ...


5

Project Honey Pot may give you some ideas as to methods and effectiveness. If you want, you can subscribe to their blacklist and let them handle all this. I am confused as to what you mean by "legitimate senders using harvested addresses" - I would, in almost all cases, deem such a sender illegitimate by definition.


4

i have not tried this method, but i think [ unless you handle tens of thousands of mailboxes ] you'll be much better off using anti-spam system that takes decision based on multiple rbls and content checks like dcc / razor / pyzor. many rbls use spam traps on much wider scale than i think you could deploy.


4

Since SSH attacks are dictionary-attacks with some flair, downloading a text file of a dictionary would provide you with a lot of potential passwords. It wouldn't hurt to set up a honeypot as that would provide you with more common passwords. If you feel lazy however, you could download a plaintext of password dumps from major websites, as there are plenty ...


3

14.1.0.0 with the subnetmask 255.255.255.0 is no valid host address! It is the address of the subnet. Try using another IP for your host (like 14.1.0.1)


3

You can't. At least not with the standard ssh. You need to edit the source code (auth.c is the file to look at) and recompile the software. It is a damn stupid idea though, unless you are specifically building a honey-pot system. Doing this violates the whole purpose of the secure shell. The system-log is readable by most users on the system so as soon as ...


3

You want Honeyd - Honeyd is a small daemon that creates virtual hosts on a network. The hosts can be configured to run arbitrary services, and their personality can be adapted so that they appear to be running certain operating systems. Honeyd enables a single host to claim multiple addresses - I have tested up to 65536 - on a LAN for network simulation. ...


3

With the relative scarcity of IPv4 addresses, I'd guess that you'll have a hard time finding a host that will be willing to part with "a lot of IP addresses". From what I've been able to gather, most people who are running honeypot servers are associated with either Universities or other organizations that have access to a large IP space to begin with.


2

You could write something for fail2ban to parse iptables rules, and ban ips that hit particular ports.


2

Honeypots are extremally useful for any environment and they don't need to be anything fancy or crazy. Examples that we do: -Create a fake account on or mailserver (say userX) with a few fake links in his mailbox (things like user directory link, payment link, etc all pointing to an internal server). Now we monitor any access to these pages via the logs ...


2

My concern with blacklisting every sender is that it is fairly easy to spoof who sent an email.


2

Hmm... Just adding my opinion to the discussion. I don't think this method has a good success rate. Just had a look on a bunch of Spams. Generally spammers use fake email addresses while spamming and they never use the same address again and again. So blacklisting the Email addresses or Domains would not be a good solution. But your hidden address thing ...


2

Here someone describes an approach using PAM with a customized module. Haven't tried this myself, but it seems to be what you're looking for.


2

You can achieve this by patching the auth.c file of opensshd. But it is never a good idea to store passwords to a log file because you will end up logging successful logins too. There is an article talking about this issue here You can also try to edit sshd_config and set the LogLevel of SyslogFacility to VERBOSE SyslogFacility AUTH LogLevel VERBOSE ...


1

Is it the same for me blocking these pages or will they see the 403 Forbidden page? Blocked images, including favicon, does not result in a 403 page being displayed. The image will simply not be displayed in the same fashion as if it was not found.


1

That's pretty easy with telnet. You could do something like this: open a command prompt (Execute cmd on Windows) and type these three lines: telnet www.yoursite.com 80 GET /favicon.ico HTTP/1.1 host: www.yoursite.com Type twice for an output Type Ctrl+C to return to command prompt You will get a nice output with headers and html. Tips for those of ...


1

14.1.0.0/24 (/24 -> netmask = 255.255.255.0) is a "Network ID". it is a reserved address, and cannot be used for hosts. Valid addresses go from 14.1.0.1-14.1.0.254 (.255 is reserved as a broadcast address).


1

I cant think of a useful thing to do, but you can have code to redirect the scanner back to the connecting ip address. Or if you don't mind the open connections, have some php or other code sleep for 5-10 seconds or more before sending a redirect, a 404, or some 500 error.


1

You can only set gateways on local subnets. This is because once you give a packet to another machine, it's free to route the packet any way it wants. So you might say "look, I want to route this packet destined for 14.1.0.1 via 10.156.149.144, so to get the packet there I'll pass it to 10.156.16.1", and then when you hand the packet to 10.156.16.1, it ...


1

I have done this. I noticed in my logs certain invalid addresses getting hit again and again. These are addresses that were never active or posted anywhere. So I setup a mailbox that sends those emails to sa-learn to help train spamassassin's Bayesian database. I've never tested the effectiveness of this in any way, but I'm not too worried about it as it ...


1

My first though was that this would be of little value since the addresses are always changing. But in my experience, spammers often send to a load of addresses@yourdomain.com - almost in a brute forced way. It might be worth setting an address up (say adam@yourdomain.com) and filtering not on the from address or IP, but on content - filter out any email ...


1

Our anti-spam product allows us to do this, an automated blacklist of everything sent to a honeypot. Here are a couple of the bullet points: You post an email address on your website such that bots can find it and pick it up, but no real person would see it or send messages to that address. You tell your anti-spam product to monitor incoming email sent to ...


1

I put an address in a comment on my main page. It gets about 5 emails a day.


1

In theory you can avoid the slow load time by making your blackhole list part of your root hints file (e.g. via $INCLUDE) and then changing that file from being a hint to a master. That last bit is necessary to prevent your server from download the real root hints from the internet. e.g. in named.ca: a.root-servers.net. IN A .... m.root-servers.net. IN ...


1

It's going to be almost impossible to get "varied" IP addresses for a single host. An ISP providing VPS services is going to have a block of IP addresses on the same subnet assigned to the machine hosting the VPS instances. You could get a few IPs, but they'll be contiguous. Also, it's unlikely the ISP will appreciate you running a honeypot on the VPS, ...


1

spam@uce.gov is meant for US citizens to send e-mail to that is "deceptive". If you are manually sorting through your spam e-mail you can help out by forwarding the e-mail there to maybe put a legal dent in spammers. SpamCop, which is a spam filtering service you described also has a procedure for this. It would be better to read their blurb instead of me ...


1

I just finished reading the book Beautiful Security, and it has a nice chapter on 'honey clients'. Instead of focusing on server side exploits, they look at how malware installs itself onto a client. The book has some good suggestions on using VMWare, and detecting system changes.



Only top voted, non community-wiki answers of a minimum length are eligible