Honeypots mailing list archives
Using an IDS to redirect hostile traffic to a Honeypot
From: "Jack Whitsitt \(jofny\)" <xaphan () violating us>
Date: Sat, 22 Feb 2003 21:18:26 -0500 (EST)
All: For a few months I've been looking for a more interesting way to make an IDS interactive than just dropping route or resetting sessions. What we've come up with is some code for linux that will, in combination with snort, actively redirect traffic from hostile sourceIP's to a honeypot. Using this system, you can set up a production server and a honeypot - both with the same IP (and potentially the same MAC) address - behind a gateway box and let snort decide which machine the traffic goes to. Files and information can be found at: http://violating.us/projects/baitnswitch/ or http://baitnswitch.sourceforge.net There are certain things I need to point out: 1. B&S does not mirror session state right now. There are important non-technical reasons for *not* doing so, but we're looking into resolving them over the next few months. 2. Your snort ruleset on the gateway/routing box needs to be very specific and very toned down. It's not meant to be your primary IDS and it's not meant to replace a good firewall. It is an *additional* layer of network security. In recent emails I've seen talk about honeytokens. This would be a very good way to react to seeing those tokens pass through your system. You should never see xxxx.doc or "root" pass through your traffic? Redirect the source IP to your honeypot. 3. This is for information that people are going to make repeated attempts against. This is not good for your scan-the-world kids. However, since it does drop all sessions from the hostile source IP, you're not worse off than you are than if you're just dropping route. In fact, you can potentially gain more information about the intruder if they choose to return - they'll be going to your honeypot now. 4. The code is listed as beta, but that is mostly due to configuration and interface features I'd like to add in the short-term. The code works with no known bugs as-is, although we're going to harden the code in the next releases. Those things said, hopefully this system will be useful to some people or (at the very least) provide some interesting suggestions as to how IDS's and Honeypot technology can be combined. Have a good day - Jack Whitsitt (jofny) ------------------------------------------- xaphan () violating us | electr0n () violating us Violating Networks http://www.violating.us -------------------------------------------
Current thread:
- Using an IDS to redirect hostile traffic to a Honeypot Jack Whitsitt (jofny) (Feb 23)