CertiGuide to Security+  9  Chapter 3:  Infrastructure Security (Domain 3.0; 20%)       9  3.4  Intrusion Detection

3.4.2.2  Passive Detection 1 2 3.4.4  Incident Response

Honey Pot Projects

Entire Internet projects such as Lance Spitzner’s Honeynet Project³⁴¹ revolve around using honey pots to study black hats in their native habitat (out in what looks like “the wild”).

For more information about the Honeynet Project, including recounts of some attacks staged against it and how the Honeynet team reacted to them, see Know Your Enemy³⁴², by The Honeynet Project.

While most honey pots, including those at the Honeynet Project, have traditionally been UNIX-based, there are also tools for setting up honey pots on Windows systems, which even include servers such as the free-for-personal-use BackOfficer Friendly from NFR³⁴³) which simulate popular Trojan servers like BackOrifice, but log, instead of act on, their requests.

“Luring? Deliberately going out of your way to create a target to attract ne’er-do-wells? What’s our legal department going to say?” The only answer we can give is: we don’t know. Some have claimed that honey pots are a form of entrapment. Others have pointed out that entrapment can only be committed by law enforcement, so random net administrators and security researchers aren’t affected by that regulation.

Additionally, if your honey pot is compromised, and the attacker does make off with information you wish he hadn’t… what do you do then? Does the fact that you set the honey pot up specifically for use by such individuals imply that they might have been (in some legally-defensible way) authorized users of that system and thus broke no privacy rules? It’s tough to say, since we’re still in the early stages of legal precedents in this area. There are enough questions here that, before you set up a honey pot of your own, you would be wise to confer with your legal counsel to determine potential legal ramifications³⁴⁴.

For more information on honey pots, check the paper by Lance Spitzner mentioned in the footnotes, as well as the http://www.honeynet.org site.

3.4.2.2  Passive Detection 1 2 3.4.4  Incident Response