Malware Analyst's Cookbook and DVD: Tools and Techniques for Fighting Malicious Code

Chapter 2. Honeypots

Honeypots are systems that are designed to be exploited, whether through emulated vulnerabilities, real vulnerabilities, or weaknesses, such as an easily guessable SSH password. By creating such systems, you can attract and log activity from attackers and network worms for the purpose of studying their techniques. Honeypots are usually categorized as either high-interaction or low-interaction:

• High-interaction: Systems with a real non-emulated OS installed on them that can be accessed and explored by attackers. These systems may be virtual machines or physical machines that you can reset after they are compromised. They are frequently used to gain insight into human attackers and toolkits used by attackers.

• Low-interaction: Systems that only simulate parts of an operating system, such as a certain network protocols. These systems are most frequently used to collect malware by being "exploited" by other malware-infected systems.

Honeynets, on the other hand, consist of two or more honeypots on a network. Typically, a honeynet is used for monitoring a larger and more diverse network in which one honeypot may not be sufficient. For example, an attacker may gain access to one honeypot and then try to move laterally across the network to another computer. If there are no other computers on the network, the attacker may realize that the environment isn't the expected corporate network; and then he'll vanish. The purpose of this chapter is not to study an attacker's every ...