Re: Heisenberg in the honeypot

[MrDemeanour <mrdemeanour () jackpot uk net>]

Qv6 wrote:

> On Friday 18 June 2004 12:47 pm, H Carvey wrote:
>
> > This is a question that's been banging around inside my head for a
> > while...
> >
> > So my question is...has anyone considered the Heisenberg
> > Uncertainty Principle, with regards to honeypots?  Specifically,
> > honeypots are used to capture/"observe" attacks, and the HUP states
> > that by the very act of observing something, we inherently alter
> > that event/object.  As the HUP applies to honeypots, please bear
> > with me...
>
>
> It is an interesting mental exercise, and I have a dual response:
>
> 0. I do not see how HUP applies to Honeypots/Honeynets. How do you 
> alter an attack by capturing/observing it in realtime or at a later
> time using Honeypots?
>
> 1. From a different perspective, the very act of "redirecting" an 
> attack to Honeypots affects an aspect of the attack, i.e, the real
> target of that attack and the damage it was designed to produce has
> been altered. By redirecting an attack to a controlled environment,
> you have altered that attack significantly.

Hmmm. It is not necessarily the case that the honeypot is different from
the "real target" of an attack; some (many?) honeypots are real systems.
And the "observation" of a honeypot need not occur in real-time - it
could be that the "observation" consists of inspecting logs after the fact.

The capturing of packets (if it occurs) could be performed by a
transparent firewall, as described in another thread on this list. From
what I have read, it appears that such capture MAY be completely
non-intrusive, and might have zero impact on either the attack or the
honeypot.

So to stretch this droll analogy well beyond breaking-point, is it
possible that a super-position of attack states might exist, up until
the moment at which the honeypot is inspected; at which point a
quantum-like collapse would occur? In other words, is it possible to
conceive of a honeypot that contains a cat?

--
Jack.