This document provides an overview of honeypots, which are security resources that are intended to be probed, attacked, or compromised in order to gather information about attackers. Honeypots can be used to learn about past attacks, detect currently occurring attacks, and identify new types of attacks. They work by monitoring any traffic to resources that are not expected to receive data. Honeypots have advantages like reducing false alarms and providing data for analysis, but also have disadvantages like narrow visibility and risks of the attacker using the honeypot to attack other systems. The document discusses different types of honeypots including low and high interaction honeypots, and specific honeypot tools like Honeyd and Honeynets.

1. Honeypots Jayant Kumar Gandhi - www.jkg.in Himanshu Bhatnagar Sachin Gajjar Sameek Banerjee Shashwat Agrawal http://www.jkg.in/eel702/presentation.ppt

2. Agenda Motivation Definition Advantages/ Disadvantages Types

3. Motivation Key to effective intrusion detection is information Learn more about past attacks Detect currently occurring attacks Identify new types of attacks Do all this in real time

4. Definition “ Any security resource who’s value lies in being probed, attacked, or compromised” – L. Spitzner, Honeypots: Tracking Hackers , ISBN 0-321-10895-7

5. How honeypots work A resource that expects no data, so any traffic to or from it is most likely unauthorized activity

6. Advantages Reduce false positives and false negatives Data value Resources Simplicity

7. Disadvantages Narrow Field of View Fingerprinting Risk

8. Types Production (Law enforcement) Research (Counter-intelligence)

9. Production Honeypots Prevention Detection Response

10. Research Honeypots Early warning and prediction Discover new tools and tactics Understanding motives, behavior and organization Develop analysis and forensic skills

11. Level of Interaction Level of interaction determines the amount of functionality a honeypot provides Low Interaction Less learning, complexity and risk High Interaction High learning, complexity and risk

12. Risk Attacker can compromise your honeypot to harm, attack or infiltrate other systems and organizations

13. Low Interaction Provide emulated services No operating system to access Information limited to transactional information and attackers activities with the emulated services

14. High Interaction Provides actual Operating Systems Learn extensive amount of information Extensive risk

15. Honeyd Low-interaction honeypot Runs on a single computer Simulates a group of virtual machines Simulates the physical network between them Simulates only the network stack of each machine Intended primarily to fool fingerprinting tools

16. Honeyd Fingerprinting Attackers often try to learn more about a system before attacking it Can determine a machine’s operating system by “testing” its network behavior How the initial TCP sequence number is created Response packets for open and closed ports Configuration of packet headers Common fingerprinting tools: Nmap, Xprobe

17. Honeynets High-interaction honeypots Network of real machines (honeypots) Honeywall – a gateway between honeypots and rest of the world

18. Legal issues Privacy Entrapment Liability

19. Legal Mumbo Jumbo Design template is Copyright © 2006 Jayant Kumar Gandhi (www.jkg.in) Clip art is Copyright © 2006 Microsoft Corporation All trademarks, registered trademarks are acknowledged and are property of their respective owners

20. Bibliography Robert Graham, Network intrusion detection systems, 2000. http://www.robertgraham.com/pubs/network-intrusion-detection.html David Klug, Honeypots and intrusion detection. http://www.sans.org./infosecFAQ/intrusion/honeypots.htm Christian Plattner Reto Baumann, White paper: Honeypots. http://www.rbaumann.net,http://www.christianplattner.net Lance Spitzner, Honeypots: Tracking hackers ISBN: 0-321-10895-7 Lance Spitzner, Intrusion detection, 2000. http://www.enteract.com/lspitz/ids.html Lance Spitzner, Know your enemy: I, ii and iii, 2000 http://www.project.honeynet.org/papers

21. Questions?

22. http://www.jkg.in/contact-me/ Uploaded on SlideShare.net for the public.