Defeating Honeypots: System Issues

Full Version: Defeating Honeypots: System Issues

GovernmentSecurity.org > System Security > Networking Security / Firewall / IDS / VPN / Routers

forza

May 2 2005, 06:09 AM

nice articles on securityfocus about defeating honeypots:

Part 1
hxxp://www.securityfocus.com/infocus/1826
Part 2
hxxp://www.securityfocus.com/infocus/1828

sabrodiesel2000

May 2 2005, 07:43 AM

Yes steganography is indeed a growing science at this stage and i would really suggest & appreciate if we started a seperate section on this forum moderated by one of our seniors here that is specified for steganography. It is a pain in the back yes, but it is definitely going to benefit our growing knowledge.

Any comments are always welcomeD!

aelphaeis_mangarae

May 22 2005, 12:43 AM

What harm can steganography possibly do.....I'm not one of those people who believe "Terrorists" use steganography....

Salvia

May 22 2005, 02:38 AM

I am confused once connected to a honeypot you have been recorded, So in order to detect it as a honeypot you would have to measure the various execution times. So you would already be detected and logged.

I guess I would need to know more about honeypots and their usefulness before I understood this article.

sabrodiesel2000

May 22 2005, 04:06 PM

QUOTE(aelphaeis_mangarae @ May 22 2005, 12:43 AM)

What harm can steganography possibly do.....I'm not one of those people who believe "Terrorists" use steganography....

well "aelphaeis_mangarae" steganography does not bring harm to systems you are right... but how do the trojans work? how do covert communication take place?...etc its the same principal

steganography is hidden writing or embedded writing and everything is for a purpose.... and if u ask me... steganography will be mostly used by terrorists as it would hide the data/message to keep themselves disguised from the watching eyes....

what do u think about terrorists using steganography noW?

<think, think and think more till you believe in what i said>

EEnd

Jun 7 2005, 01:57 PM

nice m8

thx alot

NOTE FROM MOD PACKET: these sorts of posts are not useful at all, if you want to say "thx alot" please also put in notes as to how the article helped out and/or why you liked it. Warning point added.

lovepump

Jun 19 2005, 11:13 AM

Steganography code example:

Steg Example

(You must link the crypto and math libraries to compile: gcc -Wall -lcrypto -lm steg.c -o steg)

Its trivial, but an example of what is possible. It takes an input file in .gif format, hides an SHA1 hash in it, then outputs to another gif.

Usage:

steg infile.gif outfile.gif message

Once you finish, check out the files:

CODE

-sh-3.00$ md5sum init.gif
bacc90ab171a1f97b6f8a51aca36f788 init.gif
-sh-3.00$ ./steg init.gif final.gif HelloWorld
GIF:
Width = 640, Height = 480
Bits per pixel: 8, Colour map = 1
Colour table size: 256.000000 bits, 32.000000 bytes.
-sh-3.00$ md5sum final.gif
624cde5c93ca3d7a1a9c64627daf9193 final.gif
-sh-3.00$ diff init.gif final.gif
Binary files init.gif and final.gif differ

Bob

This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.


Help - Search - Member List - Calendar Full Version: Defeating Honeypots: System Issues GovernmentSecurity.org > System Security > Networking Security / Firewall / IDS / VPN / Routers forza May 2 2005, 06:09 AM nice articles on securityfocus about defeating honeypots: Part 1 hxxp://www.securityfocus.com/infocus/1826 Part 2 hxxp://www.securityfocus.com/infocus/1828 sabrodiesel2000 May 2 2005, 07:43 AM Yes steganography is indeed a growing science at this stage and i would really suggest & appreciate if we started a seperate section on this forum moderated by one of our seniors here that is specified for steganography. It is a pain in the back yes, but it is definitely going to benefit our growing knowledge. Any comments are always welcomeD! aelphaeis_mangarae May 22 2005, 12:43 AM What harm can steganography possibly do.....I'm not one of those people who believe "Terrorists" use steganography.... Salvia May 22 2005, 02:38 AM I am confused once connected to a honeypot you have been recorded, So in order to detect it as a honeypot you would have to measure the various execution times. So you would already be detected and logged. I guess I would need to know more about honeypots and their usefulness before I understood this article. sabrodiesel2000 May 22 2005, 04:06 PM QUOTE(aelphaeis_mangarae @ May 22 2005, 12:43 AM) What harm can steganography possibly do.....I'm not one of those people who believe "Terrorists" use steganography.... well "aelphaeis_mangarae" steganography does not bring harm to systems you are right... but how do the trojans work? how do covert communication take place?...etc its the same principal steganography is hidden writing or embedded writing and everything is for a purpose.... and if u ask me... steganography will be mostly used by terrorists as it would hide the data/message to keep themselves disguised from the watching eyes.... what do u think about terrorists using steganography noW? <think, think and think more till you believe in what i said> EEnd Jun 7 2005, 01:57 PM nice m8 thx alot NOTE FROM MOD PACKET: these sorts of posts are not useful at all, if you want to say "thx alot" please also put in notes as to how the article helped out and/or why you liked it. Warning point added. lovepump Jun 19 2005, 11:13 AM Steganography code example: Steg Example (You must link the crypto and math libraries to compile: gcc -Wall -lcrypto -lm steg.c -o steg) Its trivial, but an example of what is possible. It takes an input file in .gif format, hides an SHA1 hash in it, then outputs to another gif. Usage: steg infile.gif outfile.gif message Once you finish, check out the files: CODE -sh-3.00$ md5sum init.gif bacc90ab171a1f97b6f8a51aca36f788 init.gif -sh-3.00$ ./steg init.gif final.gif HelloWorld GIF: Width = 640, Height = 480 Bits per pixel: 8, Colour map = 1 Colour table size: 256.000000 bits, 32.000000 bytes. -sh-3.00$ md5sum final.gif 624cde5c93ca3d7a1a9c64627daf9193 final.gif -sh-3.00$ diff init.gif final.gif Binary files init.gif and final.gif differ Bob This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.