Honeypots mailing list archives
Heisenberg in the honeypot
From: H Carvey <keydet89 () yahoo com>
Date: 18 Jun 2004 12:47:41 -0000
This is a question that's been banging around inside my head for a while... It's been said that honeypots can be used to "know your enemy"...but setting up a honeypot and having someone attack it, you get to see how attacks are performed, what steps a particular attacker takes once on the system, etc. So my question is...has anyone considered the Heisenberg Uncertainty Principle, with regards to honeypots? Specifically, honeypots are used to capture/"observe" attacks, and the HUP states that by the very act of observing something, we inherently alter that event/object. As the HUP applies to honeypots, please bear with me... Honeypots and honeynets for detecting activity have been around for a while now, and are essentially public knowledge. While it may not be publicly known exactly *where* these systems are, many know that they're out there. So...if someone has a 0-day exploit or a new technique that they've developed, would one think that they'd fire it off against a system that *could be* a honeypot, thereby exposing that new exploit/technique? Or would they specifically target machines that they know are NOT honeypots? The next question, I guess, would be...what kind of things are we really seeing in the honeypots? Worms are pretty indiscriminate, as are skript kiddies. So, are we (or perhaps more appropriately, the honeypots) seeing new things? If so, where are such things documented? I helped Lance decipher the attack that was listed in his "Know your enemy: Worms at War" paper. Even that was a classic, textbook example of what someone would do on a Win9x system. Thoughts are appreciated...
Current thread:
- Heisenberg in the honeypot H Carvey (Jun 19)
- Re: Heisenberg in the honeypot Qv6 (Jun 21)
- Re: Heisenberg in the honeypot Harlan Carvey (Jun 21)
- Re: Heisenberg in the honeypot Valdis . Kletnieks (Jun 21)
- Re: Heisenberg in the honeypot Ranjeet Shetye (Jun 21)
- Re: Heisenberg in the honeypot MrDemeanour (Jun 21)
- Re: Heisenberg in the honeypot Harlan Carvey (Jun 21)
- Re: Heisenberg in the honeypot Christian Kreibich (Jun 21)
- Re: Heisenberg in the honeypot Robert Judy (Jun 21)
- Re: Heisenberg in the honeypot Harlan Carvey (Jun 22)
- Re: Heisenberg in the honeypot Valdis . Kletnieks (Jun 22)
- Minefields Lance Spitzner (Jun 22)
- Re: Heisenberg in the honeypot Harlan Carvey (Jun 22)
- Re: Heisenberg in the honeypot Qv6 (Jun 21)