Scribd Logo
Upload

Welcome to Scribd!

  • 102 views

    Honey Pot

    Uploaded by

    Manu Kumar
    This document discusses honeypots, which are decoy servers that gather information about attackers. Honeypots come in two main types: low interaction honeypots that simulate systems to collect limited information, and high interaction honeypots ("honey-nets") that use real systems to capture extensive attacker behavior. The document outlines how honeypots work, including using them for intrusion detection, analyzing attacks, and diverting attackers. It also covers legal issues around privacy and liability in deploying honeypots.

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as PPT, PDF, TXT or read online from Scribd

    Honey Pot

    Uploaded by

    Manu Kumar
    102 views17 pages
    This document discusses honeypots, which are decoy servers that gather information about attackers. Honeypots come in two main types: low interaction honeypots that simulate systems to collect limited information, and high interaction honeypots ("honey-nets") that use real systems to capture extensive attacker behavior. The document outlines how honeypots work, including using them for intrusion detection, analyzing attacks, and diverting attackers. It also covers legal issues around privacy and liability in deploying honeypots.

    Original Description:

    a complete report.

    Original Title

    honey pot

    Copyright

    © Attribution Non-Commercial (BY-NC)

    Available Formats

    PPT, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    This document discusses honeypots, which are decoy servers that gather information about attackers. Honeypots come in two main types: low interaction honeypots that simulate systems to collect limited information, and high interaction honeypots ("honey-nets") that use real systems to capture extensive attacker behavior. The document outlines how honeypots work, including using them for intrusion detection, analyzing attacks, and diverting attackers. It also covers legal issues around privacy and liability in deploying honeypots.

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as PPT, PDF, TXT or read online from Scribd
    Download as ppt, pdf, or txt
    102 views17 pages

    Honey Pot

    Uploaded by

    Manu Kumar
    This document discusses honeypots, which are decoy servers that gather information about attackers. Honeypots come in two main types: low interaction honeypots that simulate systems to collect limited information, and high interaction honeypots ("honey-nets") that use real systems to capture extensive attacker behavior. The document outlines how honeypots work, including using them for intrusion detection, analyzing attacks, and diverting attackers. It also covers legal issues around privacy and liability in deploying honeypots.

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as PPT, PDF, TXT or read online from Scribd
    Download as ppt, pdf, or txt
    of 17

    HoneyPots

    Vrijesh Kothari
    (1RV01CS117)

    What is Honeypots

    They are decoy servers Gather information regarding an attacker or intruder into the system. A honeypot is an information system resource whose value lies in unauthorized or illicit use of that resource. Honeypots act as scouts in the field of information security. Examples

    Could be a password file An important entry in the database. Personal data.

    Advantages

    Small data sets of high value. Minimal resources. Can handle Encryption or IPV6. Very simple to deploy and use. It can collect in-depth information. The intruder does not know its there. Can capture new types of attacks.

    Use of HoneyPots
    Intrusion Detection and prevention. Attack Analysis.

    Observe attackers behavior and better tools to guard against it.

    Decoys
    Populate all unused addresses on your network with honeypots. Attacker has to waste time trying to attack the honeypots.

    Uses (cont..)

    Can Divert an attacker from accessing critical systems. Burglar Alarms When the honeypot is compromised, admins know that an attack is going on in their network Honeypot logs provide detailed information about the attack

    It can monitor Botnets. It can be used to detect pattern in the logged data.

    Types of Honeypots

    Low interaction Honeypot

    Attacker interacts with a simulated computer. Many levels of simulation possible. Network stack Services Operating System Very simple, low risk and require very minimal resources. But can only collect limited information and attacker can easily detect the presence of honeypots. Used for intrusion detection. E.g specter, Honeyd and KFsensor.

    Honeyd Low Interaction

    Runs on a single computer


    Simulates

    a group of virtual machines. Simulates the physical network between them.


    Simulates only the network stack of each machine. Intended primarily to fool fingerprinting tools. This can capture only known activity. Used for detecting worms and capturing spams.

    Fingerprinting

    Attackers often try to learn more about a system before attacking it. Can determine a machines operating system by testing its network behaviour.
    How

    the initial TCP sequence number is created. Response packets for open and closed ports. Configuration of packet headers.

    Common Fingerprinting tools Nmap and Xprobe. Thus Honeyd can be used to deceive these tools.

    Architecture of Honeyd

    Components Packet Dispatcher Configuration database Protocol handlers. Routers Personality Engine

    Honey-Nets

    High Interaction Honeypots It implements two main thing


    Data

    Control Data Capture


    Network of real machines Honeywall- a gateway between honeypots and the rest of the world. The honeypots should be invisible to the attacker.

    Data Control

    It allows the bad guys to come in but controls what they can do on their way out. It works by two ways Traffic scans. Connection counting Disable the attacks. The attackers can see the failure but cant predict why they occurred. Traffic scans: Uses snort_inline to scan all packets as they go through the gateway

    Connection Counting

    Limits the number of outbound connection a honeypot can initiate in a time period. Can be set individually for different protocols. Choosing the connection limits is a tradeoff between information and security.
    Low

    connection limit: can be used as a signature to identify the honeypot High connection limit: allows attacker to do much more damage!

    Data Capture
    Logs all the attacker activities within the honeynet, without the attacker noticing. Involves 3 levels :

    Level

    1 :The gateway sniffs all packets and records all activities for later analysis Level 2 : Control inbound and outbound operations Level 3: Captures the attackers keystrokes

    Legal Issues - Privacy

    Honeypots can capture extensive amounts of information about attackers, which can potentially violate their privacy, such as IRC chats or emails. This could violate the privacy of the attacker, or more likely people he is communicating with. Privacy Laws in US limits the right to capture data about an attacker, even it is breaking into your honeypot.

    Legal Issues

    Liability

    You can potentially be held liable if your honeypot is used to attack or harm other systems or organizations. This risk is the greatest with high-interaction honeypots

    Entrapment
    They

    are not a form of entrapment. Suitable messages should be displayed to indicate that access is not allowed

    Thank You

    You might also like