Honeypots are effective tools for detecting and analyzing hacker activities by mimicking real systems and trapping malicious behavior.

Title: P1: P0: Security and hacking: Honeypots [2024-11-03 Sun] I have been reading about honeypots. It is a popular security tool to trap hackers and global botnets detector. They may be simple: just emitate open ports, complex: have whole OS, distributed: forward connections, virtual: #dailyreport #hack #hacking #honeypot #honeypots #infosec #security

Title: P2: P0: Security and hacking: Honeypots [2024-11-03 Sun] emulate IP subnet. Honeypots may be detected, they: - do not provide complete environment: ex. in shell not implement commands - have strange ports: #dailyreport #hack #hacking #honeypot #honeypots #infosec #security

Title: P1: P2: Security and hacking: Honeypots [2024-11-03 Sun] - fingerprint physical devices over the network - use ping flood and calc latency correlation. - “time-based TCP fingerprinting methods.” - “discrepancies” a single TCP packet, with both SYN and #dailyreport #hack #hacking #honeypot #honeypots #infosec #security

Title: P1: Security and hacking: Honeypots [2024-11-03 Sun] - too many open ports - uncommon combination of open ports. ex. has server ports: FTP, SSH, HTTP, and POP3 *and* Windows ports - rarely used ports: 17300 - nmap is not able to identify the version of one service because HELLO is not implemented. - change password over time - honeypot often virtual and exhibit several IP we can use: #dailyreport #hack #hacking #honeypot #honeypots #infosec #security

Title: P2: P2: Security and hacking: Honeypots [2024-11-03 Sun] RST, to an open port could solicit a reply from Honeyd. No other machine on the Internet would reply to such a packet. - analyzing files such as /proc/mounts, /proc/interrupts, #dailyreport #hack #hacking #honeypot #honeypots #infosec #security

Title: P3: Security and hacking: Honeypots [2024-11-03 Sun] and /proc/cmdline, which contain UML-specific information. - strange HELLO or Banner on ports. Example: https://www.shodan.io/host/43.203.236.174 蠡 #dailyreport #hack #hacking #honeypot #honeypots #infosec #security