Honey Net
Analyzing the Clues
For analysis purposes, the admin disconnects the honeypot computer from the network and mounts the compromised hard disks on a separate machine. This step disables the rootkit because the system programs on the mounted disk are not used.
Some cautionary measures improve the results of the analysis. The logfiles recorded by the honeywall might not give a true representation of the sources the attacker used to upload software to the system. For this reason, it is a good idea to search for them on the honeypot itself. Additionally, the monitoring software might hide from the attacker on the honeypot, but if the attacker encrypts the network, some information is lost. This potential for the attacker to go underground makes it vital to trace the attacker's activities in order to initiate countermeasures as quickly as possible.
Manipulation of the filesystem on the compromised honeypot is evident. Forensic methods let the administrator restore deleted logfiles and malware programs, thus revealing how an attacker attempts to cover their traces on the machine and the changes to the filesystem. In this case, the web application vulnerability scanner logfiles finally reveal all the IP addresses the attacker attempted to target from the honeypot.
Proceed with Caution
Break-in studies that use honeypots are educational and can help prevent repeat attacks. However, honeypot operators could be breaking the law. Keep in mind that a honeypot has legal implications for the operator. Possible issues include aiding and abetting, data protection and liability for any damage caused by the honeypot.
Of course, make sure you tighten the honeynet to the best of your ability to avoid damage to any networks [10]. Operating a honeypot is not something you should do lightly. In fact, you need to monitor the system constantly to stay ahead of your clandestine guests.
Infos
- Roo: https://projects.honeynet.org/honeywall
- Honeynet Project, "Roo CDROM User's Manual": http://yum.honeynet.org/roo/manual
- Snort Inline: http://snort-inline.sourceforge.net
- POF (p0f): http://lcamtuf.coredump.cx/p0f.shtml
- Swatch: http://sourceforge.net/projects/swatch/
- Sebek: https://projects.honeynet.org/sebek/
- Current version of phpAds: http://sourceforge.net/projects/phpadsnew/
- Edward Balas and Camilo Viecco, "Towards a Third Generation Data Capture Architecture for Honeynets": http://old.honeynet.org/papers/individual/hflow.pdf
- PHP XML-RPC vulnerability: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2498
- Ryan Talabis, "A Primer on Honeynet Data Control Requirements": http://www.philippinehoneynet.org/index.php?option=com_docman&task=doc_download&gid=7&Itemid=29
« Previous 1 2
Buy this article as PDF
(incl. VAT)
Buy Linux Magazine
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters
Find SysAdmin Jobs
News
-
OpenMandriva Lx 23.03 Rolling Release is Now Available
OpenMandriva "ROME" is the latest point update for the rolling release Linux distribution and offers the latest updates for a number of important applications and tools.
-
CarbonOS: A New Linux Distro with a Focus on User Experience
CarbonOS is a brand new, built-from-scratch Linux distribution that uses the Gnome desktop and has a special feature that makes it appealing to all types of users.
-
Kubuntu Focus Announces XE Gen 2 Linux Laptop
Another Kubuntu-based laptop has arrived to be your next ultra-portable powerhouse with a Linux heart.
-
MNT Seeks Financial Backing for New Seven-Inch Linux Laptop
MNT Pocket Reform is a tiny laptop that is modular, upgradable, recyclable, reusable, and ships with Debian Linux.
-
Ubuntu Flatpak Remix Adds Flatpak Support Preinstalled
If you're looking for a version of Ubuntu that includes Flatpak support out of the box, there's one clear option.
-
Gnome 44 Release Candidate Now Available
The Gnome 44 release candidate has officially arrived and adds a few changes into the mix.
-
Flathub Vying to Become the Standard Linux App Store
If the Flathub team has any say in the matter, their product will become the default tool for installing Linux apps in 2023.
-
Debian 12 to Ship with KDE Plasma 5.27
The Debian development team has shifted to the latest version of KDE for their testing branch.
-
Planet Computers Launches ARM-based Linux Desktop PCs
The firm that originally released a line of mobile keyboards has taken a different direction and has developed a new line of out-of-the-box mini Linux desktop computers.
-
Ubuntu No Longer Shipping with Flatpak
In a move that probably won’t come as a shock to many, Ubuntu and all of its official spins will no longer ship with Flatpak installed.