Honeypots mailing list archives
Re: High interaction Windows Honeypot
From: Thorsten Holz <thorsten.holz () mmweg rwth-aachen de>
Date: Mon, 08 Aug 2005 18:07:18 +0200
Ahmed Ameen wrote:
Hello All, I am currently planning for my CS thesis which I decided to do on Windows Honeypots. I was wondering if anyone has experience on building a high interaction honeypot using a windows environment and VMware.
Some experience from me and the German Honeynet Project:* For the Honeywall, the easiest way to setup is the Honeywall CDROM Roo (http://www.honeynet.org/tools/cdrom/). This is Linux-based, but that should be no big problem. Just boot a computer with three interfaces (two also works, but for management a dedicated interface is best) and within 20 minutes your are done. Customization is very easy and the web-interface allows you to monitor what's going on. If you really need it, you can also install the Honeywall "by Hand", but that's rather time-consuming...
* Unfortunately, no Sebek version 3.x exists for Windows yet. It is in development, but not ready up to now. So you have to use Sebek version 2.x (http://www.honeynet.org/tools/sebek/2/sebek-win32-2.1.5.zip). Just install Windows and you are basically done. If you don't apply some patches, a default installation of Windows will be compromised by a bot in an automated way within several minutes...
* If you want to setup a virtual honeynet, just follow the steps outlined in the paper "Virtual Honeynet: Deploying Honeywall using VMware" (http://www.honeynet.org.pk/honeywall/) written by the Pakistan Honeynet Project.
Cheers, Thorsten
Current thread:
- High interaction Windows Honeypot Ahmed Ameen (Aug 08)
- Re: High interaction Windows Honeypot Thorsten Holz (Aug 08)
- <Possible follow-ups>
- RE: High interaction Windows Honeypot Stejerean, Cosmin (Aug 08)
- RE: High interaction Windows Honeypot Stejerean, Cosmin (Aug 08)
- RE: High interaction Windows Honeypot Michael A. Davis (Aug 08)
- RE: High interaction Windows Honeypot Michael A. Davis (Aug 09)
- Re: High interaction Windows Honeypot George Bakos (Aug 11)
- Re: High interaction Windows Honeypot Ahmed Ameen (Aug 12)
- RE: High interaction Windows Honeypot Michael A. Davis (Aug 12)
- Re: High interaction Windows Honeypot Ahmed Ameen (Aug 14)
- RE: High interaction Windows Honeypot mnelson (Aug 16)
- Re: High interaction Windows Honeypot Ahmed Ameen (Aug 17)
- RE: High interaction Windows Honeypot Michael A. Davis (Aug 08)