Honeypots mailing list archives

Re: Heisenberg in the honeypot


From: James Riden <j.riden () massey ac nz>
Date: Tue, 22 Jun 2004 16:50:32 +1200

Harlan Carvey <keydet89 () yahoo com> writes:

Chuck,

Thanks for the response...

This principle is flawed.  If you apply this
principle to a different
subject as well, let say, police sting operations,
Then this would become a
valid defense effectivly making All Sting operations
Illegal.

Interesting.  Are you saying that the HUP is flawed,
or the application I'm proposing is flawed?

HUP applies to quantum physics - there is no reason why observing a
honeypot has to change the behaviour of the person who is using
it.

I've seen a spectacularly inept cracker forget to remove the install
files for one of his/her root kits - stored in /rk no less - so it's
entirely possible a given attacker won't know it's a honeypot.

-- 
James Riden / j.riden () massey ac nz / Systems Security Engineer
GPG public key available at: http://www.massey.ac.nz/~jriden/
This post does not necessarily represent the views of my employer.


Current thread: