Re: deceptive content on honeypots

[Jim Yuill <jimyuill () pobox com>]

In-Reply-To: <20030331205931.442.qmail () www securityfocus com>

I've compiled and organized the SecurityFocus posts related to 
honeytokens.  I found about 30 posts.  Any feedback most welcomed, esp. 
regarding omissions.  Thanks to Jose Nazario, et. al, for informing me of 
the thread.

The .doc file is here:  http://www.freewebs.com/jimyuill/

Summary:

Search terms used on mailing-list archieve:
* IDS mailing list:  "honeypot"
* Honeypot mailing list:  "honeytoken"

Outline of compilation:
1       Design principles
1.1       General
1.2       Are honeytokens honeypots?
2       Network-based IDS detections
2.1       General
2.2       LDAP example
3       Examples of host-based bait & honeytokens