Honeypots mailing list archives

Re: logging facility

From: "KeyFocus" <support () keyfocus net>
Date: Thu, 28 Aug 2003 15:55:13 +0100

How can encrypted traffic be decrypted with a honeypot?

SSL is designed to prevent man in the middle attacks, which is why an IDS
cannot examine the traffic.

A honeypot is the end point of the SSL traffic so it decrypts it anyway. All
thats needed is a means to log it.

- Tom
www.keyfocus.net

Current thread:

logging facility Motayyam79 (Aug 27)
- Re: logging facility Valdis . Kletnieks (Aug 27)
  - Re: logging facility George Washington Dunlap III (Aug 27)
- Re: logging facility Floydman (Aug 27)
- <Possible follow-ups>
- Re: logging facility Motayyam79 (Aug 27)
  - Re: logging facility Richard Stevens (Aug 28)
  - Re: logging facility KeyFocus (Aug 28)
    - Re: logging facility Floydman (Aug 28)
  - Re: logging facility Floydman (Aug 28)
- Re: logging facility Motayyam79 (Aug 28)
  - Re: logging facility KeyFocus (Aug 28)
    - Re: logging facility urbn (Aug 29)
    - Re: logging facility KeyFocus (Aug 29)
  - Re: logging facility Valdis . Kletnieks (Aug 28)
  - Re: logging facility Edward Balas (Aug 29)
- Re: logging facility Peter Bates (Aug 28)
- Re: logging facility Ryan Barnett (Aug 29)