Setting up a honeypot computer 10-07-2012, 02:09 PM
#1
What is a honeypot?
Honeypot is something you create to attract hackers. It can be anything - a computer in your network, a website on your server, an online device.
Why set up honeypots?
While it may seem counter-intuitive, correctly installed honeypot will improve your overall security. Yes, it will get hacked. Yes, it is a good thing. Why? There are easy ways of preventing hackers from accessing your network through it. By setting up something vulnerable and cutting it off from the rest of the network, you're making hackers attack something that won't help them - you're slowing them down and you're getting their IPs so you can always sue their asses.
Do I need a honeypot?
It depends. They are usually good in large networks/popular websites when you can assume you'll be attacked by hackers and you want to prevent those attacks. Since this tut is about using a whole computer as a honeypot, I only reccommend it for large networks storing valuable info (i.e. corporate extranets, research-related LANs, webhostings).
Making your honeypot attractive to hackers
Obviously. There are various ways of doing this. The easiest one is to have an old OS on it. An old Windows Server is the best one. It will work only if other computers have various systems. If every computer has Linux and for some reason there is only one Windows machine and it's running outdated OS, it's an obvious trap. If you can't have a vulnerable OS, try vulnerable software. Install something detectable as service while scanning IP range, maybe an old FTP server or something like that.
Isolating your honeypot
The most important thing here is preventing the honeypot from connecting to other computers. It must technically be a part of your LAN but it can't be allowed to interact with anything else on the LAN.
First, get on the honeypot computer and check its MAC and IP. Then, on every computer in the network block them. On Windows, you simply do it with your firewall of choice (easy, check program help if you can't). On Linux, you use good old iptables:
.
If you want to be completely sure, also do the reverse: on honeypot block all the 'good' computers.
Now we need to prevent sniffing and similar man-in-the-middle shit. The best way to do it is by assigning every machine static ARP and static IP. There are different ways of doing it depending on your router so you need to RTFM.
Logging
The best way to log is on your router, this way you'll be watching all the activity in the network, not only related to honeypot. A simple ctrl+f and copypasting honeypot IP will then reveal all the honeypot-related stuff.
Making your honeypot plausible
Your honeypot shouldn't look like a honeypot. It should look like a vulnerable computer on the network. Every computer has its purpose. Is it pretending to be a workstation? Then install all the shit that other workstations use. Is it pretending to be your company's filesharing server? Then it'd probably need FTP software - and so on.
You should also make sure that there are files on it that would be there if it wasn't a honeypot. Make sure those files are non-critical and the critical ones are convincing fakes (leads to lulz in case of 'leak'). Also, make sure that those files are regularly modified so their timestamps won't be too outdated. I guess it wouldn't be hard to automate small modifications that would make documents look the same but change timestamps (or just automate changing timestamps - Timestomp would be your friend). Also, you can backdoor some of the files to hack the hackers.
Additional warnings:
1. Badly made honeypot is a security problem, not a security feature. It provides a foothold into your network.
2. Not every honeypot-related thing on the log is an attack. Read up on what things on your logs mean.
3. Honeypots are not magic - you'll get the IPs and maybe MACs, that's all. There are ways to hide and spoof them.
Honeypot is something you create to attract hackers. It can be anything - a computer in your network, a website on your server, an online device.
Why set up honeypots?
While it may seem counter-intuitive, correctly installed honeypot will improve your overall security. Yes, it will get hacked. Yes, it is a good thing. Why? There are easy ways of preventing hackers from accessing your network through it. By setting up something vulnerable and cutting it off from the rest of the network, you're making hackers attack something that won't help them - you're slowing them down and you're getting their IPs so you can always sue their asses.
Do I need a honeypot?
It depends. They are usually good in large networks/popular websites when you can assume you'll be attacked by hackers and you want to prevent those attacks. Since this tut is about using a whole computer as a honeypot, I only reccommend it for large networks storing valuable info (i.e. corporate extranets, research-related LANs, webhostings).
Making your honeypot attractive to hackers
Obviously. There are various ways of doing this. The easiest one is to have an old OS on it. An old Windows Server is the best one. It will work only if other computers have various systems. If every computer has Linux and for some reason there is only one Windows machine and it's running outdated OS, it's an obvious trap. If you can't have a vulnerable OS, try vulnerable software. Install something detectable as service while scanning IP range, maybe an old FTP server or something like that.
Isolating your honeypot
The most important thing here is preventing the honeypot from connecting to other computers. It must technically be a part of your LAN but it can't be allowed to interact with anything else on the LAN.
First, get on the honeypot computer and check its MAC and IP. Then, on every computer in the network block them. On Windows, you simply do it with your firewall of choice (easy, check program help if you can't). On Linux, you use good old iptables:
Code:
/sbin/iptables -I INPUT -s [honeypot IP] -j DROP
/sbin/iptables -A INPUT -m mac --mac-source [honeypot MAC] -j DROPIf you want to be completely sure, also do the reverse: on honeypot block all the 'good' computers.
Now we need to prevent sniffing and similar man-in-the-middle shit. The best way to do it is by assigning every machine static ARP and static IP. There are different ways of doing it depending on your router so you need to RTFM.
Logging
The best way to log is on your router, this way you'll be watching all the activity in the network, not only related to honeypot. A simple ctrl+f and copypasting honeypot IP will then reveal all the honeypot-related stuff.
Making your honeypot plausible
Your honeypot shouldn't look like a honeypot. It should look like a vulnerable computer on the network. Every computer has its purpose. Is it pretending to be a workstation? Then install all the shit that other workstations use. Is it pretending to be your company's filesharing server? Then it'd probably need FTP software - and so on.
You should also make sure that there are files on it that would be there if it wasn't a honeypot. Make sure those files are non-critical and the critical ones are convincing fakes (leads to lulz in case of 'leak'). Also, make sure that those files are regularly modified so their timestamps won't be too outdated. I guess it wouldn't be hard to automate small modifications that would make documents look the same but change timestamps (or just automate changing timestamps - Timestomp would be your friend). Also, you can backdoor some of the files to hack the hackers.
Additional warnings:
1. Badly made honeypot is a security problem, not a security feature. It provides a foothold into your network.
2. Not every honeypot-related thing on the log is an attack. Read up on what things on your logs mean.
3. Honeypots are not magic - you'll get the IPs and maybe MACs, that's all. There are ways to hide and spoof them.
![[+]](https://sinister.li/images/modern/collapse_collapsed.png)
