Honey Pot
This document was uploaded by user and they confirmed that they have the permission to share it. If you are author or own the copyright of this book, please report to us by using this DMCA report form. Report DMCA
Overview
Download & View Honey Pot as PDF for free.
More details
- Words: 702
- Pages: 20
HONEYPOTS TRACKING HACKERS By Nishesh Bakshi
A WORD ON SECURITY
“The secret to a good defense is good offense” - Anonymous
Brief Background • Who is a Hacker? – A Hacker is a person who tries to gain unauthorized access to a network.
How a hacker affect a server? • Steals confidential data. • Imposes someone else. • Causes loss of resources. • Sometimes causes even hardware loss.
What are the security issues? • To provide secure connection between the client and the server. • E.g. email service provided by various web-sites.
How Hackers work • Gathers information about the server • Chooses the weakest link • Start exploiting that link
How Honeypots work.
Definition of Honeypots “ A honeypot is a security resource whose value is in being probed, attacked or compromised “
HONEYPOT ? • HoneyPots are not a single tool but a highly flexible technology. • HoneyPots come in variety of shapes and sizes. everything from a simple windows system emulating a few services to an entire network of production systems waiting to be hacked !!!
• HoneyPots have a variety of values.
everything from a burglar alarm that detects an intruder to a research tool that can be used to study the motives of the black hat community !!!
QUESTIONS ON HPs ?
• What are the different values this unique technology can have? What are the different HoneyPot technologies available today? • What the advantages and disadvantages of using HoneyPots? • Are there any deployment and maintenance issues associated with HoneyPots? • Are all HoneyPots offensive in nature?
IS THIS A HONEYPOT ? On a network, install a firewall which restricts all outbound traffic. Attackers can get into the network but not use this network to spread out the infection.
CONCERNS (THE “WHAT-IF” FACTOR) • What if the attacker is lured into a HoneyPot? He/She will be infuriated by the deception and retaliate against the organisation. • What if the HoneyPot is misconfigured?
THEN WHY USE HONEYPOTS ? • At the end of year 2000, the life expectancy of a default installation of Red Hat 6.2 was less than 72 hrs ! • One of the fastest recorded times a HoneyPot was compromised was 15 min. This means that within 15 min of being connected to the internet, the system was found, probed, attacked, and successfully exploited by the attacker! The record for capturing a worm was 90 sec !! • During an 11 month period (Apr 2000 – Mar 2001), there was a 100% increase in IDS alerts based on Snort. • In the beginning of 2002, a home network was scanned on an average by three different systems a day. • The year 2001 saw a 100% increase in reported incidents from 21,756 to 52,658 reported attacks.
WHAT CAN HONEYPOTS DO ? • Can they capture known attacks ?
• Can they detect unknown attacks ?
ADVANTAGES OF USING HONEYPOTS • Data Value HoneyPots collect very little data, but they collect is essentially of very high value. HoneyNet project research group collects less than 1 MB data per day !
• Resources HoneyPots typically donot have problems of resource exhaustion.
• Simplicity No fancy algorithms to develop. No signature databases to maintain. No rule-bases to misconfigure !
DISADVANTAGES OF HONEYPOTS
• Narrow field of view HoneyPots only see the activity directed against them.
• Fingerprinting An incorrectly implemented HoneyPot can identify itself and others of the same kind.
CLASSIFICATION OF HONEYPOTS (1/2)
[Based on level of INTERACTION] Are you hoping to catch the attackers in action and learn about their tools and tactics? OR
Are you interested in detecting unauthorized activity ? OR
Are you hoping to capture latest worm for analysis ?
CLASSIFICATION OF HONEYPOTS (2/2)
LEVEL OF
WORK TO INSTALL
WORK TO DEPLOY
INFORMATION
LEVEL OF
INTERACTION
AND CONFIGURE
AND MAINTAIN
GATHERING
RISK
Low
Easy
Easy
Limited
Low
Medium
Involved
Involved
Variable
Medium
High
Difficult
Difficult
Extensive
High
Conclusion • Honeypots are good resources for tracing hackers. • The value of Honeypots is in being Hacked. • Honeypots have their own pros and cons and this technology is still developing.
REFERENCES
• • • • • •
WWW.SNORT.ORG WWW.HACKINGEXPOSED.COM WWW.INFOSECWRITERS.COM WWW.SECURITYFOCUS.COM WWW.SANS.ORG WWW.SPECTER.COM
A WORD ON SECURITY
“The secret to a good defense is good offense” - Anonymous
Brief Background • Who is a Hacker? – A Hacker is a person who tries to gain unauthorized access to a network.
How a hacker affect a server? • Steals confidential data. • Imposes someone else. • Causes loss of resources. • Sometimes causes even hardware loss.
What are the security issues? • To provide secure connection between the client and the server. • E.g. email service provided by various web-sites.
How Hackers work • Gathers information about the server • Chooses the weakest link • Start exploiting that link
How Honeypots work.
Definition of Honeypots “ A honeypot is a security resource whose value is in being probed, attacked or compromised “
HONEYPOT ? • HoneyPots are not a single tool but a highly flexible technology. • HoneyPots come in variety of shapes and sizes. everything from a simple windows system emulating a few services to an entire network of production systems waiting to be hacked !!!
• HoneyPots have a variety of values.
everything from a burglar alarm that detects an intruder to a research tool that can be used to study the motives of the black hat community !!!
QUESTIONS ON HPs ?
• What are the different values this unique technology can have? What are the different HoneyPot technologies available today? • What the advantages and disadvantages of using HoneyPots? • Are there any deployment and maintenance issues associated with HoneyPots? • Are all HoneyPots offensive in nature?
IS THIS A HONEYPOT ? On a network, install a firewall which restricts all outbound traffic. Attackers can get into the network but not use this network to spread out the infection.
CONCERNS (THE “WHAT-IF” FACTOR) • What if the attacker is lured into a HoneyPot? He/She will be infuriated by the deception and retaliate against the organisation. • What if the HoneyPot is misconfigured?
THEN WHY USE HONEYPOTS ? • At the end of year 2000, the life expectancy of a default installation of Red Hat 6.2 was less than 72 hrs ! • One of the fastest recorded times a HoneyPot was compromised was 15 min. This means that within 15 min of being connected to the internet, the system was found, probed, attacked, and successfully exploited by the attacker! The record for capturing a worm was 90 sec !! • During an 11 month period (Apr 2000 – Mar 2001), there was a 100% increase in IDS alerts based on Snort. • In the beginning of 2002, a home network was scanned on an average by three different systems a day. • The year 2001 saw a 100% increase in reported incidents from 21,756 to 52,658 reported attacks.
WHAT CAN HONEYPOTS DO ? • Can they capture known attacks ?
• Can they detect unknown attacks ?
ADVANTAGES OF USING HONEYPOTS • Data Value HoneyPots collect very little data, but they collect is essentially of very high value. HoneyNet project research group collects less than 1 MB data per day !
• Resources HoneyPots typically donot have problems of resource exhaustion.
• Simplicity No fancy algorithms to develop. No signature databases to maintain. No rule-bases to misconfigure !
DISADVANTAGES OF HONEYPOTS
• Narrow field of view HoneyPots only see the activity directed against them.
• Fingerprinting An incorrectly implemented HoneyPot can identify itself and others of the same kind.
CLASSIFICATION OF HONEYPOTS (1/2)
[Based on level of INTERACTION] Are you hoping to catch the attackers in action and learn about their tools and tactics? OR
Are you interested in detecting unauthorized activity ? OR
Are you hoping to capture latest worm for analysis ?
CLASSIFICATION OF HONEYPOTS (2/2)
LEVEL OF
WORK TO INSTALL
WORK TO DEPLOY
INFORMATION
LEVEL OF
INTERACTION
AND CONFIGURE
AND MAINTAIN
GATHERING
RISK
Low
Easy
Easy
Limited
Low
Medium
Involved
Involved
Variable
Medium
High
Difficult
Difficult
Extensive
High
Conclusion • Honeypots are good resources for tracing hackers. • The value of Honeypots is in being Hacked. • Honeypots have their own pros and cons and this technology is still developing.
REFERENCES
• • • • • •
WWW.SNORT.ORG WWW.HACKINGEXPOSED.COM WWW.INFOSECWRITERS.COM WWW.SECURITYFOCUS.COM WWW.SANS.ORG WWW.SPECTER.COM
Related Documents
Honey Pot
November 2019 21
Projeto Honey Pot
December 2019 7
Project Honey Pot Vs John Does
May 2020 4
Project Honey Pot Vs John Does
May 2020 6
Honey
October 2019 22