Re: logging facility

[Edward Balas <ebalas () iu edu>]

On Thu, 28 Aug 2003 Motayyam79 () aol com wrote:

> "Encrypted traffic such as that to an SSL web server can be decrypted and 
> logged."
>
> How can encrypted traffic be decrypted with a honeypot?

Check out a tool called Sebek, its bread and butter is encryption 
circumvention on honeypots.  It works as hidden kernel module that 
collects all sys_read activity and covertly exports it to a collection 
system.

http://project.honeynet.org/tools/index.html

I should also note that a new version of sebek, including a nice
whitepaper, will be available in about 3 weeks.