Honeypots For Network Security

www.1000projects.
com
www.fullinterview.com
www.chetanasprojects.com
HONEYPOTS FOR NETWORK SECURITY
Presented By
Abstract attacked and computerized to gain more
Honeypots are an exciting new information about the attacker, and used
technology. They allow us to turn the tools. One goal of this paper is to show
tables on the bad guys. In the past the possibilities of honeypots and their
several years there has been growing use in research as well as productive
interest in exactly what this technology environment.
is and how it works. Compared to an intrusion
A honeypot is used in the area of detection system, honeypots have the big
computer and Internet security. It is a advantage that they do not generate false
resource, which is intended to be alerts as each observed traffic is

www.1000projects.com
suspicious, because no productive information as possible about their
components are running in the system. attack patterns, used programs, purpose
of attack and blackhat community itself.
All this information is used to learn
1. Introduction more about the blackhat proceedings and
motives as well as their technical
Global communication is getting knowledge and abilities. This is just
more important everyday. At the same primary purpose if honeypot. There are a
time, computer crimes increasing. lot of other possibilities for a honeypot-
Counter measures are developed to divert hackers form productive systems
detect or prevent attacks-most of these for catch a hacker while conducting an
measures are based on known facts, attack are just two possible examples.
known attack patterns. As in the Honeypots are not the perfect
military, it is important to know, who solution for solving or preventing
your enemy is, what kind of strategy he computer crimes. Honeypots are hard to
maintain and they need the good
uses, what tools he utilizes and what he knowledge about the operating systems
is aiming for. Gathering this kind of and network security. In the right hands
information is not easy but important. honeypot is effective tool for the
By knowing attack strategies, information gathering. In the wrong,
countermeasures can be improved and inexperienced hands, a honeypot can
vulnerabilities can be fixed. To gather as become another infiltrated machine and
much information as possible is one an instrument for the black hat
main goal of honeypot. community.
A honeypot is primarily an
instrument for the information gathering 2. Honeypot basics
and learning. Its primary purpose is not
to be ambush for the blackhat
A honeypot is a resource
community to catch them in action and
whose value is being in attacked and
to press charges against them. The lies
compromised. This means, that a
on silent collection of as much
honeypot is expected to get probed,  Forensicsanalyzing new
attacked and potentially exploited. attacks and exploits
Honeypot do not fix anything. They  Trend analysislook for
provide us additional, valuable changes over time of types of
information. attacks,techniques,etc
A honeypot is a resource, which  Identificationtracks the bad
pretends to be real target. A honeypot is guys back to their home
expected to be attacked or compromised. machines to figure out who they
The main goals are the distraction of an are.
attacker and the gain of the information  Sociologylearn about the bad
about the attack and the attacker. guys as a group by snooping on
Value of honeypots: email, IRC traffic, etc which
There are two categories of honeypots. happens to traverse the honeypot.
 Production honeypots In general every traffic from
 Research honeypots and to a honeypot is unauthorized
A production honeypot is used activity. All the data that is collected by
to help migrate risk in an organization a honeypot is therefore interested data.
while the second category, is meant to Data collected by the honeypot is of high
gather as much information as possible. value, and can lead to better
These honeypots do not add any security understanding and knowledge which in
value to an oraganition, but they can turn can help to increase overall network
help to understand the blackhat security. One can also argue that a
community and their attacks as well as honeypot can be used for prevention
to build some better defenses against because it can deter attackers from
security threats. A properly constructed attacking other systems by occupying
honeypot is put on a network, which them long enough and bind their
closely monitors the traffic to and from resources.
the honeypot. This data can be used for a
variety of purposes. 3. Concepts:
3.1. Low-involvement honey:
A low-level involvement honeypot

typically only provides certain fake
services. In a basic form, these services
could be implemented by having a
listener on specific port.
In such a way, all incoming traffic can
easily be recognized and stored. With
such a simple solution it is not possible
to catch communication of complex
protocols. On a low-level honeypot there
3.2. Mid-involvement honeypot
is no real operating system that attacker
can operate on. This will minimize the
A mid-involvement
risk significantly because the complexity
honeypot provides more to interact with
of an operating system is eliminated. On
but still does not provide a real
the other hand, this is also disadvantage.
underlying operating system. The fake
It is not possible to watch an attacker
daemons are more sophisticated and
interacting with operating system, which
have deeper knowledge about the
could be really interesting. A low-level
specific services they provide. At the
honeypot is like one-way connection.
same moment, the risk increases. The
We only listen, we do not ask any
probability that attacker can find a
questions.
security hole or vulnerability is getting
bigger because the complexity of
honeypot is increasing.
Through the higher level of
interaction, more complexity attacks are
possible and can therefore be logged and
analysed. The attacker gets a better
illusion of a real operating system. He
has more possibilities to interact and A high-involvement honeypot is very
probe the system. Developing a mid- time consuming. The system should be
involvement honeypot is complex and constantly under surveillance. A
time consuming. Special care has to be honeypot which is not under control is
taken for security check as all developed not of much help even become a danger
fake daemons need to be as secure as or security hole itself. It is very
possible. important to limit a honeypot’s access to
local intranet, as the honeypot can be
used by blackhats as if it was a real
compromised system. Limiting outbound
traffic is also important point to
consider, as the danger once a system is
fully compromised can be reduced.
By providing a full operating
system to attacker, he has the
possibilities to upload and install new
files. This is where the high-involvement
honeypot can show its strength, as all its
actions can be recorded and analyzed.
3.3. High-involvement honeypot
A high-involvement honeypot has a real

underlaying operating system. This leads
to much higher risk as the complexity
increases rapidly. At the same time, the
possibilities to gather the information,
the possible attacks as well as the
attractiveness increase a lot. As soon as a
hacker has gained access, his real work
and therefore the interesting part begins.
By placing the honeypot in front of
firewall the risk for the internal works
does not increases. A honeypot will
attract and generate lot of unwished
traffic like port scans or attack patterns.
By placing a honeypot outside the
firewall, such events do not get logged
by the firewall and an internal IDS
4. Honeypot location system will not generate alerts.
Otherwise a lot of alerts would be
A honeypot does not need a certain generated on the firewall or IDS.
surrounding environment, as it is a Probably the biggest advantage
standard server with no special needs. A is that the firewall or IDS, as well as any
honeypot can be placed anywhere a other resources, have not to be adjusted
server could be placed. But certainly, as the honeypot is outside the firewall
some places are better for certain and viewed as any other machine on the
approaches as others. external network. Running a honeypot
A honeypot can be used does therefore not increase the dangers
on the Internet as well as the intranet, for the internal network nor does it
based on the needed service. Placing a introduce new risks.
honeypot on the intranet can be useful if The disadvantage of placing a
the detection of some bad guys inside a honeypot in front of the firewall is that
private network is wished. If the main internal attackers cannot be located or
concern is the Internet, a honeypot can trapped that easy. Placing a honeypot
be placed at two locations: inside DMZ seems a good solution as
1. In front of firewalls long as the other systems inside the
(Internet) DMZ can be secured against the
2. DMZ honeypot.Most DMZs are not fully
3. Behind the firewall accessible as only needed services are
(Intranet) allowed to pass the firewall. In such a
case, placing the honeypot in front of the
firewall should be favored as opening all to the internet or intranet, depending on
corresponding ports on the fire is too the goal. This attempt enables tight
time consuming and risky. control as well as flexible environment
A honeypot behind a firewall with maximal security.
can introduce new security risks to the
internal network, especially if the
internal network is not secured against
the honeypot through additional
firewalls. This could be a special
problem if the Ips are used for
authentication. By placing the honeypot
behind a firewall, it is inevitable to
adjust the firewall rules if access from
internet should be permitted. The biggest
problem arises as soon as the internal
5. Host based information gathering
honeypot is compromised by an external
attacker. He gains the possibility to
This section will discussion
access the internal network through the
possibilities that offer gain of
honeypot.This traffic will be unstopped
information about ongoing on a
by the firewall as it is regarded as traffic
honeypot by installing information
to the honeypot only, which in turn is
gathering mechanisms on the honeypot
granted. Securing an internal honeypot is
itself.
therefore mandatory, especially if it is a
high-involvement honeypot. The main
Basic possibilities
reason for placing a honeypot behind a Information gathering facilities can
firewall could be to detect internal basically be grouped into two categories;
attackers. facilities that generate streams of
The best solution would be to information and facilities that offer the
run a honeypot in its own DMZ, information to peek into the system and
therefore with a preliminary firewall.
The firewall could be connected directly
get the information about a certain state network traffic only gets analyzed but
of the honeypot. not manipulated. Network based
information gathering is safer as it is
Microsoft windows harder to be detected and quiet
One could think the large impossible to disable.
amount of observed attacks on systems
running ms windows operating system
makes them ideal for the honeypot, but
unfortunately the structure of this
operating system makes the data
gathering rather difficult. Until today the
source code of the operating system of
Microsoft is not freely available, which
means that changes to the operating
system are very hard to achieve.
6. Dangers
UNIX derivates
Unix derivatives operating Running a honeypot or honeynet is not
system offers interesting opportunities something that should be
for deploying data gathering underestimated- there are some dangers
mechanisms since all of their one must be aware of which basically
components are available as source code. are:
Network based Information 1. Unnoticed takeover of the honeypot
Gathering: Host based information by an attacker
gathering is always located at the host 2. Lost control over the honey pot
itself and is therefore vulnerable to installation.
detection and once detected it can also 3. Damage done to third party.
be disabled. Network based information
gathering does not have to be located on 7. Attractiveness
the honeypot itself. It can also be
implemented in an invisible way, as
Being the owner of a honeypot  Catching False
can be an interesting experience, but NegativesHoneypots can
what if the members of the blackhat easily identify and capture new
community do not find their way to the attacks never seen before.
honeypot or, even more dramatically, are  Minimal ResourcesHoneypots
not interested in the honeypot at all. require minimal resources, even
Another approach to lure attackers is the on the largest of networks. This
offering of the interesting services on the makes them an extremely cost
honeypot. Of course the question arises, effective solution.
what an interesting services is or what it  EncryptionHoneypots can
should look like. capture encrypted attacks.
8. Advantages 9. Disadvantages
 Small Data setsHoneypots  Single Data PointHoneypots

only collect attack or all share one huge drawback;
unauthorized activity, they are worthless if no one
dramatically reducing the amount
 Attacks them. Yes, they can
of data they collect.
accomplish wonderful things,
Organizations that may log
but if the attacker does not sent
thousands of alerts a day may
any packets to the honeypot, the
only log a hundred alerts with
honeypot will be blissfully
honeypots. This makes the data
unaware of any unauthorized
honeypots collect much easier to
activity.
manage and analyze.
 RiskHoneypots can introduce
 Reduced False
risk to your environment. As we
PositivesHoneypots discuss later, different honeypots
dramatically reduce false alerts, have different levels of
as they only capture unauthorized risk.Some introduce very little
activity. risk, while others give the
attacker entire platforms from best practices can do that. However,
which to launch new attacks, honeypots may be a tool to help
Risk is variable, depending on contribute to those best practices.
how one builds and deploys the
honeypot.
10. Conclusion
A honeypot is just a tool. How you use

that tool is up to you. There are a variety
of honeypot options, each having
different value to organizations. We
have categorized two types of
honeypots, production and research.
Production honeypots help reduce risk in
an organization. Research honeypots are
different in that they are not used to
protect a specific oraganization. Instead
they are used as a research tool to study
and identify the threats in the Internet
community. Regardless of what type of
honeypot you use, keep in mind the
‘level of interaction’. This means that
the more your honeypot can do and the
more you can learn from it, the more risk
that potentially exists. You will have to
determine what is the best relationship of
risk to capabilities that exist for
you.Honeypots will not solve an
oraganization’s security problems. Only

Honeypots For Network Security

Caricato da

Informazioni sul documento

Descrizione originale:

Titolo originale

Copyright

Formati disponibili

Condividi questo documento

Condividi o incorpora il documento

Opzioni di condivisione

Hai trovato utile questo documento?

Questo contenuto è inappropriato?

Copyright:

Formati disponibili

Honeypots For Network Security

Caricato da

Copyright:

Formati disponibili

www.1000projects.

Abstract attacked and computerized to gain more

interest in exactly what this technology environment.

is and how it works. Compared to an intrusion

resource, which is intended to be alerts as each observed traffic is

A low-level involvement honeypot

3.3. High-involvement honeypot

A high-involvement honeypot has a real

 Small Data setsHoneypots  Single Data PointHoneypots

A honeypot is just a tool. How you use

Potrebbero piacerti anche