Re: Heisenberg in the honeypot

[Valdis.Kletnieks () vt edu]

On Mon, 21 Jun 2004 09:18:03 PDT, Harlan Carvey said:

> Interesting.  Are you saying that the HUP is flawed,
> or the application I'm proposing is flawed?

Your application is flawed.

If Heisenberg actually applied in the honeypot environment, then running a
program to detect whether or not it was a honeypot would actually potentially
change the answer from 'yes' to 'no' or vice versa.

And although I'm positive that there have been black hats that ran their
honeypot-detection kits, found out that it was a honeypot, and left in a hurry,
the box in question didn't actually stop being a honeypot.  Nor do I know of
any cases where a blackhat ran their detection kit, and as a result of running
it, the box suddenly started being a honeypot rather than somebody's desktop
machine....

Attachment: _bin
Description: