Please give me some ideas about it?
How to find out if a box I breaked in to is a Honeypot or not ?
Full Version: How To Identify A Box Is A Honeypot?
in my experience, if its easy to get into then its a honeypot :-)
but stilla good question, honeypots can be setup so you dont know it is one, hence i suppose the whole point of it all
but stilla good question, honeypots can be setup so you dont know it is one, hence i suppose the whole point of it all
any box can be a honeypot it's almost impossible to know if ur inside one since there is no "kit" to setup a honeypot they make it look like a normal vuln machine running programs etc....
my best bet is be safe use wingates, proxies etc
ohh and btw if u see folders like:
creditcard or credit card numbers
socialsecurity numbers
funds
i would leave the box asap since ya know (but this is in my opinion)
ohh and always use the badips list to check the range before u do anything to it
lastly use something to clear the windows event logs/security logs
good luck, and let's hope me and u don't fall into the honey
my best bet is be safe use wingates, proxies etc
ohh and btw if u see folders like:
creditcard or credit card numbers
socialsecurity numbers
funds
i would leave the box asap since ya know (but this is in my opinion)
ohh and always use the badips list to check the range before u do anything to it
lastly use something to clear the windows event logs/security logs
good luck, and let's hope me and u don't fall into the honey
You don't know. I run a honeypot on an EDU domain through a guy I know on campus and we actually catch kids and kill their botnets. We thought about setting up a website to describe how we do it, but then people would design around it. In the meantime, it doesn't matter what kind of rootkit you use, our IDS (sitting right next to the honey) is going to know if your trojan is connecting to an IRC server. 
We also do other checks too, it's pretty obvious if the machine initiates a connection that it's a trojan, since it doesn't do anything but sit and idle anyway.
We also do other checks too, it's pretty obvious if the machine initiates a connection that it's a trojan, since it doesn't do anything but sit and idle anyway.
The whole concept of a honeypot is that you should have no idea you just walked into a trap. I dont think you could use the 'how easy to break it' factor to determine if it is or not. just like normal targets, honeypots will come in many flavors, from way too easy, to almost impossible to get in.
The only way i could think of to check if they are honey or not, would be to use them for something blatently illegal, and see how long it lasts serving that purpose. Even there... how long were the fbi infiltrated in the warez top scene before the dod bust. they were contributing big hard drives and fast links too.
You just cant know.
The only way i could think of to check if they are honey or not, would be to use them for something blatently illegal, and see how long it lasts serving that purpose. Even there... how long were the fbi infiltrated in the warez top scene before the dod bust. they were contributing big hard drives and fast links too.
You just cant know.
| QUOTE |
| always use the badips list to check the range before u do anything to it |
the bad ips lists ive seen up to now were... suspicious to say the least. some well know edu ranges being tagged at bad ips. looked more like a way to scare people so the makers of the list can keep those edus to themselves. and im talking like whole class B networks composed of a mix of edus, companies and yes, some government/military. you dont black list a whole class cause of 20 blocks.
| QUOTE |
| lastly use something to clear the windows event logs/security logs |
as far as clearing windows logs, it wont do you any good if it *is* a honeypot. a firewall logging all your communications with the honeypot is what will be most likely be used. besides, completely clearing the logs will make it even more obvious that something happened, worse than to actually have a few events hidden in the haystack of normal events.
Some white papers on Honeypots. You may also want to review the section on HoneyTokens.
Honey Pot Whitepapers and Resources
Pretty good reading material if your wanting to learn more about Honey Pots
I would also say google for the paper done on the Super Bowl Hack.
Honey Pot Whitepapers and Resources
Pretty good reading material if your wanting to learn more about Honey Pots
I would also say google for the paper done on the Super Bowl Hack.
Well, there is never a 100% sure way to identify a machine as a honey pot, but I found that most people who setup the honey pot forget to make it look like it's actually been used. So look if someone is actually doing some work on the machine and maybe when the last login's of the useres were.
as far as my experience goes..
ive been in a live honeynet once..
there were too many services like chargen and day time service ..
and snmp commnity set to public.
and it was ofcourse entirely exploitable..
i was conected to it using a bess proxy
they are the fastest and also anonymous.
it was almost similar to any host but the amount
of services available for exploitation are too many
i could even use the unicode exploit on it.
when i tried downloading the ftp pssswd file
it gave a scary message that was enought to
say it was a Honeypot...
even Specter has emulated the same in the latest version of
its Honeypot Specter 7.0
ive been in a live honeynet once..
there were too many services like chargen and day time service ..
and snmp commnity set to public.
and it was ofcourse entirely exploitable..
i was conected to it using a bess proxy
they are the fastest and also anonymous.
it was almost similar to any host but the amount
of services available for exploitation are too many
i could even use the unicode exploit on it.
when i tried downloading the ftp pssswd file
it gave a scary message that was enought to
say it was a Honeypot...
even Specter has emulated the same in the latest version of
its Honeypot Specter 7.0
There are several ways u can tell. Look through the persons programs on their computer, do they look like the type of programs that somebody with network security experiance would use...like packet sniffers, etc. If they are, do u really think that that person would allow a script kiddy with an autohacker to break into their machine..no prolly so assume that it may be a honeypot or at the very least the host will figure out that an attack took place. Along the same lines take a look through their favorites. You can tell alot about a person by the type of links that they commonly visit.
Also, understand under what context u're supposed to be getting access to the target machine. If the exploit that u're using is supposed to be a system privelages exploit, then make sure that u're getting system rights. Chances are a honeypot would run various services under low user context to prevent the attacker from doing damage. So if u get access denied when trying to add users, modify registry, etc assume that the machine might be a honeypot.
Also, understand under what context u're supposed to be getting access to the target machine. If the exploit that u're using is supposed to be a system privelages exploit, then make sure that u're getting system rights. Chances are a honeypot would run various services under low user context to prevent the attacker from doing damage. So if u get access denied when trying to add users, modify registry, etc assume that the machine might be a honeypot.
| QUOTE (vnet576 @ Jan 17 2004, 09:41 PM) |
| There are several ways u can tell. Look through the persons programs on their computer, do they look like the type of programs that somebody with network security experiance would use...like packet sniffers, etc. If they are, do u really think that that person would allow a script kiddy with an autohacker to break into their machine..no prolly so assume that it may be a honeypot or at the very least the host will figure out that an attack took place. Along the same lines take a look through their favorites. You can tell alot about a person by the type of links that they commonly visit. Also, understand under what context u're supposed to be getting access to the target machine. If the exploit that u're using is supposed to be a system privelages exploit, then make sure that u're getting system rights. Chances are a honeypot would run various services under low user context to prevent the attacker from doing damage. So if u get access denied when trying to add users, modify registry, etc assume that the machine might be a honeypot. |
When you set up a virtual pc, you dont need the sniffer in the config.
you can make it totally look like a normal pc.
Lots of honeypots a virtual pc's, so might there be an easy way to see if it is.
Something like weird hd serials ore some weird respond when you ask some kind system info.
Heres some information from a recent episode on a honeypot - 
This was a visit from a Dialup Account. Since were talking honeypots. I thought this information might be of interest to some. For cmds For Response
USER anonymous
PASS xxxxxx@xxxxxx.xxx
CWD /pub/
CWD /public/
CWD /pub/incoming/
CWD /incoming/
CWD /_vti_pvt/
CWD /
MKD 040118002511p
CWD /upl
>>>>220-xxxxxxxxx.xxxx
>>>>220 Enter Username:
USER anonymous
>>>>331 Password Required.
PASS xxxxxx@xxxxxx.xxx
>>>>230 User logged in.
CWD /pub/
>>>>550 Access denied.
CWD /public/
>>>>550 Access denied.
CWD /pub/incoming/
>>>>550 Access denied.
CWD /incoming/
>>>>550 Access denied.
CWD /_vti_pvt/
>>>>550 Access denied.
CWD /
>>>>250 "/" is current directory.
MKD 040118002511p
>>>>550 040118002511p: Permission denied.
CWD /upload/
>>>>550 Access denied.
This was a visit from a Dialup Account. Since were talking honeypots. I thought this information might be of interest to some. For cmds For Response
USER anonymous
PASS xxxxxx@xxxxxx.xxx
CWD /pub/
CWD /public/
CWD /pub/incoming/
CWD /incoming/
CWD /_vti_pvt/
CWD /
MKD 040118002511p
CWD /upl
>>>>220-xxxxxxxxx.xxxx
>>>>220 Enter Username:
USER anonymous
>>>>331 Password Required.
PASS xxxxxx@xxxxxx.xxx
>>>>230 User logged in.
CWD /pub/
>>>>550 Access denied.
CWD /public/
>>>>550 Access denied.
CWD /pub/incoming/
>>>>550 Access denied.
CWD /incoming/
>>>>550 Access denied.
CWD /_vti_pvt/
>>>>550 Access denied.
CWD /
>>>>250 "/" is current directory.
MKD 040118002511p
>>>>550 040118002511p: Permission denied.
CWD /upload/
>>>>550 Access denied.
How does that make it a honeypot? Plenty of anonymous FTPs won't let you do anything. Just because you can logon but not do anything doesn't instantly make it a honeypot.
@easternerd
| QUOTE |
there were too many services like chargen and day time service .. |
I think It's a good Idea. thanks
most honeypots have got almost nothing installed, and have a great speed and space.
But They must have run many Services to attract hackers!
| QUOTE (LittleHacker @ Jan 18 2004, 07:50 PM) |
| But They must have run many Services to attract hackers! |
indeed.
None of the things said here are in any way usefull.
If there arrent many services, maybe it's a well configured http server.
If there are, maybe it's just a pc used alot, like mine :/
You are all guessing.
Some honeypots can't be detected, they are normal pc's just like yorn said.
The onely way you can find those is you go sniffing in folders, see tasks running and so on. But some honeypotpc's use a rootkit to hide the admin files, so there is no way in hell you can find out. (unless you have 10 houres of time when rooting).
What you can find out (ore maybe) is if it's a virtual pc, ore a commercial software honeypot. They simulate, so there has to be something aboud that, but i would know for now.
Quite often honeypots have windows and unix services running at a time. Quite obvious it is some fake.
Though sometimes it is a router with port forwarding to internal boxes so you got win/unix services on one IP but from several boxes. Generally, really: too many ports, ain't good at all.
Once a possible honeypot has been compromised a broadcast ping and and a close look to the arp tables/MACs can really clear things up.
Though sometimes it is a router with port forwarding to internal boxes so you got win/unix services on one IP but from several boxes. Generally, really: too many ports, ain't good at all.
Once a possible honeypot has been compromised a broadcast ping and and a close look to the arp tables/MACs can really clear things up.
| QUOTE |
| eXist - How does that make it a honeypot? Plenty of anonymous FTPs won't let you do anything. Just because you can logon but not do anything doesn't instantly make it a honeypot |
I understand your question eXist but if I'm not misreading your thread I believe I posted that the visit came from a dialup account to a "honeypot". Not me connecting to a box I suspected of being an HpS
I thought my posting was straight forward enough it would be clear enough to the members that the box in question is a honeypot running an ftp server emulation module that I monitor and maintain.
If I wasnt clear on that my apologies to the fellow members, I'll try and slow the brain down so my fingers can catch up to my train of thought.
I would also say that when your configuring a honeypot - it should be tailored to the OS your trying to model after. Having an IIS banner, or MS FTP banner running on a box that is supposed to imitating a Solaris system probably wouldn't be a good idea.
Well since we're on the topic of honeypots I figured I'd show a real live one in action. When u see the following things u can be pretty certain that the host is a honeypot. Heh forgot to hide the hostmask...
| CODE |
| These Windows 2000 services are started: Alerter Automatic Updates Background Intelligent Transfer Service Backup Exec Remote Agent for Windows Servers COM+ Event System Computer Browser Crystal APS Crystal Cache Server Crystal Input File Repository Server Crystal Output File Repository Server Crystal Page Server Crystal Report Job Server Crystal Web Component Server DameWare Mini Remote Control DHCP Client DHCP Server Diskeeper Distributed File System Distributed Link Tracking Client Distributed Transaction Coordinator DNS Client Event Log Event Log Watch IIS Admin Service Intel Alert Handler Intel PDS IPSEC Policy Agent License Logging Service Logical Disk Manager Logical Disk Manager Administrative Service Machine Debug Manager Microsoft Search MS IDS for TCP/IP MSSQLSERVER MSSQLServerOLAPService Net Logon Network Connections NT LM Security Support Provider PERC2 Remote Services Agent Plug and Play Print Spooler Protected Storage Remote Procedure Call (RPC) Remote Procedure Call (RPC) Locator Remote Procedure Call (RPC) System32 Remote Registry Service Removable Storage Resource Allocation RunAs Service Security Accounts Manager Server Simple Mail Transport Protocol (SMTP) SNMP Service SQLSERVERAGENT Symantec System Center Discovery Service System Event Notification Task Scheduler TCP/IP NetBIOS Helper Service Telephony Terminal Services VNC Server Windows Management Instrumentation Windows Management Instrumentation Driver Extensions Windows Time Wireless Configuration Workstation World Wide Web Publishing Service The command completed successfully. |
| CODE |
| TCP HIDEIP:22 HIDEIP:0 LISTENING TCP HIDEIP:telnet HIDEIP:0 LISTENING TCP HIDEIP:smtp HIDEIP:0 LISTENING TCP HIDEIP:http HIDEIP:0 LISTENING TCP HIDEIP:epmap HIDEIP:0 LISTENING TCP HIDEIP:https HIDEIP:0 LISTENING TCP HIDEIP:microsoft-ds HIDEIP:0 LISTENING TCP HIDEIP:1027 HIDEIP:0 LISTENING TCP HIDEIP:1028 HIDEIP:0 LISTENING TCP HIDEIP:1030 HIDEIP:0 LISTENING TCP HIDEIP:1034 HIDEIP:0 LISTENING TCP HIDEIP:1035 HIDEIP:0 LISTENING TCP HIDEIP:1036 HIDEIP:0 LISTENING TCP HIDEIP:1037 HIDEIP:0 LISTENING TCP HIDEIP:1043 HIDEIP:0 LISTENING TCP HIDEIP:1051 HIDEIP:0 LISTENING TCP HIDEIP:1052 HIDEIP:0 LISTENING TCP HIDEIP:1056 HIDEIP:0 LISTENING TCP HIDEIP:1063 HIDEIP:0 LISTENING TCP HIDEIP:1064 HIDEIP:0 LISTENING TCP HIDEIP:1065 HIDEIP:0 LISTENING TCP HIDEIP:1067 HIDEIP:0 LISTENING TCP HIDEIP:1069 HIDEIP:0 LISTENING TCP HIDEIP:1075 HIDEIP:0 LISTENING TCP HIDEIP:1094 HIDEIP:0 LISTENING TCP HIDEIP:1102 HIDEIP:0 LISTENING TCP HIDEIP:1103 HIDEIP:0 LISTENING TCP HIDEIP:1104 HIDEIP:0 LISTENING TCP HIDEIP:1105 HIDEIP:0 LISTENING TCP HIDEIP:1106 HIDEIP:0 LISTENING TCP HIDEIP:1107 HIDEIP:0 LISTENING TCP HIDEIP:kpop HIDEIP:0 LISTENING TCP HIDEIP:1110 HIDEIP:0 LISTENING TCP HIDEIP:1112 HIDEIP:0 LISTENING TCP HIDEIP:1113 HIDEIP:0 LISTENING TCP HIDEIP:1118 HIDEIP:0 LISTENING TCP HIDEIP:1119 HIDEIP:0 LISTENING TCP HIDEIP:1120 HIDEIP:0 LISTENING TCP HIDEIP:1121 HIDEIP:0 LISTENING TCP HIDEIP:1122 HIDEIP:0 LISTENING TCP HIDEIP:1123 HIDEIP:0 LISTENING TCP HIDEIP:1124 HIDEIP:0 LISTENING TCP HIDEIP:1139 HIDEIP:0 LISTENING TCP HIDEIP:1140 HIDEIP:0 LISTENING TCP HIDEIP:1144 HIDEIP:0 LISTENING TCP HIDEIP:1145 HIDEIP:0 LISTENING TCP HIDEIP:1146 HIDEIP:0 LISTENING TCP HIDEIP:1147 HIDEIP:0 LISTENING TCP HIDEIP:1148 HIDEIP:0 LISTENING TCP HIDEIP:1149 HIDEIP:0 LISTENING TCP HIDEIP:1150 HIDEIP:0 LISTENING TCP HIDEIP:1151 HIDEIP:0 LISTENING TCP HIDEIP:1154 HIDEIP:0 LISTENING TCP HIDEIP:1155 HIDEIP:0 LISTENING TCP HIDEIP:1158 HIDEIP:0 LISTENING TCP HIDEIP:1159 HIDEIP:0 LISTENING TCP HIDEIP:1160 HIDEIP:0 LISTENING TCP HIDEIP:1161 HIDEIP:0 LISTENING TCP HIDEIP:1162 HIDEIP:0 LISTENING TCP HIDEIP:1170 HIDEIP:0 LISTENING TCP HIDEIP:1177 HIDEIP:0 LISTENING TCP HIDEIP:1183 HIDEIP:0 LISTENING TCP HIDEIP:1190 HIDEIP:0 LISTENING TCP HIDEIP:1194 HIDEIP:0 LISTENING TCP HIDEIP:ms-sql-s HIDEIP:0 LISTENING TCP HIDEIP:1500 HIDEIP:0 LISTENING TCP HIDEIP:1638 HIDEIP:0 LISTENING TCP HIDEIP:1645 HIDEIP:0 LISTENING TCP HIDEIP:1846 HIDEIP:0 LISTENING TCP HIDEIP:1853 HIDEIP:0 LISTENING TCP HIDEIP:2725 HIDEIP:0 LISTENING TCP HIDEIP:2986 HIDEIP:0 LISTENING TCP HIDEIP:3119 HIDEIP:0 LISTENING TCP HIDEIP:3121 HIDEIP:0 LISTENING TCP HIDEIP:3125 HIDEIP:0 LISTENING TCP HIDEIP:3251 HIDEIP:0 LISTENING TCP HIDEIP:3281 HIDEIP:0 LISTENING TCP HIDEIP:3290 HIDEIP:0 LISTENING TCP HIDEIP:3372 HIDEIP:0 LISTENING TCP HIDEIP:3389 HIDEIP:0 LISTENING TCP HIDEIP:4444 HIDEIP:0 LISTENING TCP HIDEIP:5800 HIDEIP:0 LISTENING TCP HIDEIP:5900 HIDEIP:0 LISTENING TCP HIDEIP:6129 HIDEIP:0 LISTENING TCP HIDEIP:info-aps HIDEIP:0 LISTENING TCP HIDEIP:info-was HIDEIP:0 LISTENING TCP HIDEIP:9191 HIDEIP:0 LISTENING TCP HIDEIP:10000 HIDEIP:0 LISTENING TCP HIDEIP:netbios-ssn HIDEIP:0 LISTENING |
In my experience, if you are on a true honeypot, its going to simulate the services and their exploits, but you won't be able to get anywhere with them. Also, the box will typically look like almost too good to be true in terms of ease of exploit.
| QUOTE (s54 @ Jan 18 2004, 09:08 PM) |
| Quite often honeypots have windows and unix services running at a time. Quite obvious it is some fake. Though sometimes it is a router with port forwarding to internal boxes so you got win/unix services on one IP but from several boxes. Generally, really: too many ports, ain't good at all. Once a possible honeypot has been compromised a broadcast ping and and a close look to the arp tables/MACs can really clear things up. |
Also, I disagree with this statement. While it may be true that honeypots sometimes do emulate services for both, it is not true that *Nix services cannot be run in windows, and vice versa. Checkout the Unix Services for Windows CD from Microsoft. There are also several programs and services that can be emulated in a *Nix environment. Consider Samba. Perhaps it is a different animal than windows file sharing, but it works the same.
Basically, a traditional honeypot, as I said can be detected from not being able to exploit anything, or being able to exploit something but not having any permissions once its done. Of course, even this is just conjecture because as others have said, it could just be a very secure machine. Also, whoose to say a honeypot isn't going to LET you exploit a service? Couldn't a honeypot also just be considered a machine that is fully exploitable but has nothing of use that is being monitored by an outside program, say Snort? I think so.
| QUOTE |
| A honeypot is an information system resource whose value lies in unauthorized or illicit use of that resource |
I don't think there would be much point to a honeypot unless permissions are granted, because the whole purpose is to observe the attacker at work and learn his techniques etc.
| QUOTE |
| But They must have run many Services to attract hackers! |
Not true. Some honeypots only study one type of exploit, such as FTP.
No one mentioned the best way to avoid honeypots (which is the same way to avoid pregnancy): stay out of the box in the first place.
(I say that tongue-in-check only slightly).
hmm...I was on google that day an found a link to a honey pot project running under supervision of Pakistani Government to trace hackers supported by Cyber.net.pk .
As I m also a Paki so I mailed them and requested them that I wanna join that but they didnt allow after they got the wind of my age.
The website is www.honeynet.org.pk
It contains real Honey Pot stats etc. and other info.
Regards
~Faceless Master
As I m also a Paki so I mailed them and requested them that I wanna join that but they didnt allow after they got the wind of my age.
The website is www.honeynet.org.pk
It contains real Honey Pot stats etc. and other info.
Regards
~Faceless Master
@ beardednose
| QUOTE |
| Some honeypots only study one type of exploit |
well it may be right !
So Any there comments ?
They scare the shit out of me to be honest...
A question, so what if you've 'hacked' into a honeypot and they know all your info. What would be their next step? Take legal actions against you? ...
A question, so what if you've 'hacked' into a honeypot and they know all your info. What would be their next step? Take legal actions against you? ...
In all honesty, one must think of what a honey pot is used for. It is simply used to study hackers. Any machine could do this, just setup something to monitor it remotely.
| QUOTE |
| A question, so what if you've 'hacked' into a honeypot and they know all your info. What would be their next step? Take legal actions against you? |
MHSICKNESS- I can't answer for others but my own interest is not to pursue legal actions but more for research..
I would assume all honeypots are there for research in some way or another and I dont think they would all be easily exploitable.
Why set up a honeypot if all you plan to watch is someone use x-scan the sqlexec, if I was running one I would want it on a pretty secure and on a fast line to... you would need a good incentive to make them go to all the effore of hacking a secure server
Why set up a honeypot if all you plan to watch is someone use x-scan the sqlexec, if I was running one I would want it on a pretty secure and on a fast line to... you would need a good incentive to make them go to all the effore of hacking a secure server
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.
