Re: collecting spyware with a honeypot

[Tillmann Werner <tillmann.werner () gmx de>]

George,

> I wold like to setup a honeypot for collecting spyware and adware. As
> you know, spayware require user action, so i can't use the classic
> honeypot method to connect it on the internet and let the "bad guys"
> attack it.

You don't necessarily need user interaction. Lots of ad/spyware is installed 
after a bot infection. Samples can be collected with tools like honeytrap or 
nepenthes and then run in a controlled environment, e.g. a vm protected by a 
honeywall.

You then need some kind of automatism to initialize a clean image, place and 
start a sample and log changes as downloaded files.You can also use a 
hardware card that restores a clean system without the changes since the last 
reboot if you prefer a non-virtual installation. Such a setup should be able 
to process about one executable in 10 minutes.

Tillmann