Tag Info

Hot answers tagged

11

Yes, Stephen Murdoch at the University of Cambridge has done it, earlier this year. You can read his results in the Security Research Group blog; the initial experiment is discussed in this article, and some more results appear in this article. My personal favourite bit was For example, there was a log-in attempt for the usernames “root” and “dark” ...


11

Has anyone else tried this: Certainly, yes. Almost every anti-spam service out there uses them, the industry term is "spamtraps" How do you go about doing it? Normally, find an address in one of the domains which receives a lot of spam and confirm with the owner that it is not in use and they have no plans to resurrect it. This process can be ...


8

There are a few books on the subject (although I've never bothered with them), however I can recommend you some readily updated websites: The always interesting honeyblog The European Network of Affined Honeypots has many recent papers and presentations The Honeynet Project has some good papers Distributed honeypot management software and a video ...


5

Project Honey Pot may give you some ideas as to methods and effectiveness. If you want, you can subscribe to their blacklist and let them handle all this. I am confused as to what you mean by "legitimate senders using harvested addresses" - I would, in almost all cases, deem such a sender illegitimate by definition.


4

i have not tried this method, but i think [ unless you handle tens of thousands of mailboxes ] you'll be much better off using anti-spam system that takes decision based on multiple rbls and content checks like dcc / razor / pyzor. many rbls use spam traps on much wider scale than i think you could deploy.


4

Since SSH attacks are dictionary-attacks with some flair, downloading a text file of a dictionary would provide you with a lot of potential passwords. It wouldn't hurt to set up a honeypot as that would provide you with more common passwords. If you feel lazy however, you could download a plaintext of password dumps from major websites, as there are plenty ...


4

If you want to allow legitimate SSH logins while disallowing (via honeypot) fake, I'd change tack. Put your SSHD on another port, like 2323 or some other oddball port, and forward connections to that. Ideally you have a separate machine for that, so you can tell your router to forward port 2323 to internal machine XYZ port 22. Open port 22 to be forwarded ...


3

You want Honeyd - Honeyd is a small daemon that creates virtual hosts on a network. The hosts can be configured to run arbitrary services, and their personality can be adapted so that they appear to be running certain operating systems. Honeyd enables a single host to claim multiple addresses - I have tested up to 65536 - on a LAN for network simulation. ...


3

14.1.0.0 with the subnetmask 255.255.255.0 is no valid host address! It is the address of the subnet. Try using another IP for your host (like 14.1.0.1)


3

You can't. At least not with the standard ssh. You need to edit the source code (auth.c is the file to look at) and recompile the software. It is a damn stupid idea though, unless you are specifically building a honey-pot system. Doing this violates the whole purpose of the secure shell. The system-log is readable by most users on the system so as soon as ...


3

With the relative scarcity of IPv4 addresses, I'd guess that you'll have a hard time finding a host that will be willing to part with "a lot of IP addresses". From what I've been able to gather, most people who are running honeypot servers are associated with either Universities or other organizations that have access to a large IP space to begin with.


2

Hmm... Just adding my opinion to the discussion. I don't think this method has a good success rate. Just had a look on a bunch of Spams. Generally spammers use fake email addresses while spamming and they never use the same address again and again. So blacklisting the Email addresses or Domains would not be a good solution. But your hidden address thing ...


2

My concern with blacklisting every sender is that it is fairly easy to spoof who sent an email.


2

You could write something for fail2ban to parse iptables rules, and ban ips that hit particular ports.


2

Honeypots are extremally useful for any environment and they don't need to be anything fancy or crazy. Examples that we do: -Create a fake account on or mailserver (say userX) with a few fake links in his mailbox (things like user directory link, payment link, etc all pointing to an internal server). Now we monitor any access to these pages via the logs ...


2

You can achieve this by patching the auth.c file of opensshd. But it is never a good idea to store passwords to a log file because you will end up logging successful logins too. There is an article talking about this issue here You can also try to edit sshd_config and set the LogLevel of SyslogFacility to VERBOSE SyslogFacility AUTH LogLevel VERBOSE ...


2

Here someone describes an approach using PAM with a customized module. Haven't tried this myself, but it seems to be what you're looking for.


1

Is it the same for me blocking these pages or will they see the 403 Forbidden page? Blocked images, including favicon, does not result in a 403 page being displayed. The image will simply not be displayed in the same fashion as if it was not found.


1

14.1.0.0/24 (/24 -> netmask = 255.255.255.0) is a "Network ID". it is a reserved address, and cannot be used for hosts. Valid addresses go from 14.1.0.1-14.1.0.254 (.255 is reserved as a broadcast address).


1

You can only set gateways on local subnets. This is because once you give a packet to another machine, it's free to route the packet any way it wants. So you might say "look, I want to route this packet destined for 14.1.0.1 via 10.156.149.144, so to get the packet there I'll pass it to 10.156.16.1", and then when you hand the packet to 10.156.16.1, it ...


1

I cant think of a useful thing to do, but you can have code to redirect the scanner back to the connecting ip address. Or if you don't mind the open connections, have some php or other code sleep for 5-10 seconds or more before sending a redirect, a 404, or some 500 error.


1

spam@uce.gov is meant for US citizens to send e-mail to that is "deceptive". If you are manually sorting through your spam e-mail you can help out by forwarding the e-mail there to maybe put a legal dent in spammers. SpamCop, which is a spam filtering service you described also has a procedure for this. It would be better to read their blurb instead of me ...


1

It's going to be almost impossible to get "varied" IP addresses for a single host. An ISP providing VPS services is going to have a block of IP addresses on the same subnet assigned to the machine hosting the VPS instances. You could get a few IPs, but they'll be contiguous. Also, it's unlikely the ISP will appreciate you running a honeypot on the VPS, ...


1

In theory you can avoid the slow load time by making your blackhole list part of your root hints file (e.g. via $INCLUDE) and then changing that file from being a hint to a master. That last bit is necessary to prevent your server from download the real root hints from the internet. e.g. in named.ca: a.root-servers.net. IN A .... m.root-servers.net. IN ...


1

I don't know what OS you are running, but certain firewalls have the ability to create rules that allow you to automatically ban a user if they hit a certain port within a certain amount of seconds. The other option is to run a script of some sort that reads the log file, and when it sees attempts on the ports in question that it automatically adds a new ...


1

You should expect a machine on the Internet to be scanned basically continually. Automatically banning IPs that scan certain ports is not what a honeypot is. The attackers have access to multiple networks. You can't block them. You can frustrate a portscanner, but if the goal is to frustrate people scanning your network and not add security, your best ...


1

I just finished reading the book Beautiful Security, and it has a nice chapter on 'honey clients'. Instead of focusing on server side exploits, they look at how malware installs itself onto a client. The book has some good suggestions on using VMWare, and detecting system changes.


1

Our anti-spam product allows us to do this, an automated blacklist of everything sent to a honeypot. Here are a couple of the bullet points: You post an email address on your website such that bots can find it and pick it up, but no real person would see it or send messages to that address. You tell your anti-spam product to monitor incoming email sent to ...


1

My first though was that this would be of little value since the addresses are always changing. But in my experience, spammers often send to a load of addresses@yourdomain.com - almost in a brute forced way. It might be worth setting an address up (say adam@yourdomain.com) and filtering not on the from address or IP, but on content - filter out any email ...



Only top voted, non community-wiki answers of a minimum length are eligible