Honeypot — a lure for intruders

Honeypot (literally — «a pot of honey») — a resource that acts as bait for attackers, being one of the types of bastion host.

Bastion host — the name given to a specially designated computer on a network, usually located on the outer side of an organization's demilitarized zone (DMZ). Such a host is fully exposed to attacks, since it is protected neither by a firewall nor by a filtering router. A bastion host must be carefully designed and configured to minimize the likelihood of a breach.

The purpose of a honeypot is to be attacked or subjected to unauthorized probing, which subsequently makes it possible to study the attacker's strategy and identify the set of tools that could be used to strike real security-critical assets. A honeypot implementation can be either a dedicated server or a single network service whose task is to attract the attention of intruders.

A honeypot is a resource that does nothing unless it is acted upon. A honeypot collects a small amount of information, the analysis of which builds up statistics on the methods used by intruders, and also reveals any new techniques that will subsequently be used in the fight against them.

For example, a web server that has no name and is in fact unknown to anyone should, accordingly, have no visitors, so anyone attempting to access it is a potential intruder. The honeypot collects information about the behavior of these intruders and their methods of acting on the server. Information security specialists then use this to develop strategies for repelling attackers' attacks.

History

Honeypots appeared alongside the first computer intruders; work on their creation and deployment was carried out in parallel with IDS research.

The first documented mention was in Clifford Stoll's book "The Cuckoo's Egg", written in 1990. Ten years later, in 2000, honeypots became widespread decoy systems.

Subsequently, IDS and honeypots would come to form a single integrated complex for ensuring an enterprise's information security.

Alternative protection methods

In addition to honeypots, the following computer network defense tools are used: honeynet, honeytoken, padded cell, IDS, IPS. The latter two do not fit the definition of a honeypot — they are not decoys but intrusion detection and prevention systems. At the same time, the concept closest to a honeypot is IDS — an intrusion detection system that logs all unauthorized connections to the target system.

Padded Cell is a type of "sandbox" decoy. Once inside it, an intruder cannot cause any harm to the system, since they remain constantly within an isolated environment.

Honeynet is a network of honeypots; see below.

In any case, regardless of which protection system is installed, it should hold decoy information as bait, not the original.

Types of honeypot

There are honeypots built on dedicated servers and software-emulated honeypots.

• Honeypots installed on a dedicated server make it possible to bring it as close as possible to the real server whose role it performs (a data server, an application server, a proxy server).

• An emulated honeypot recovers quickly after a breach and is also clearly isolated from the main OS. It can be created using a virtual machine or Honeyd.

The difference between them lies in the scale of the network. If, for example, it is a small office network, there is little point in setting up a dedicated server to log suspicious network events; a virtual system or even a single virtual service will suffice here. Large organizations use dedicated servers with network services fully replicated on them. Configuration errors are usually deliberately introduced into such services so that an attacker succeeds in breaching the system. This is the core idea of a honeypot — to lure the intruder in.

Advantages of honeypots

Honeypot technologies offer analysts several advantages:

• collection of meaningful information;
• low demand on system resources;
• simplicity of installation, configuration, and operation;
• a clear demonstration of the need for their use.

Disadvantages of honeypots

Honeypot tools have several drawbacks. Honeypots do not replace any security mechanisms; they only operate alongside and extend the overall security architecture.

The main problems with honeypot tools are:

• a limited field of view;
• the possibility of the honeypot being exposed;
• the risk of the honeypot being compromised and used to attack the hosts of third-party organizations.

Honeypot placement

Different placement options for a honeypot help provide a complete picture of an attacker's tactics. Placing a honeypot inside the local network gives insight into attacks originating from within the network, while placing it on publicly accessible servers of that network or in the DMZ reveals attacks against unprotected network services, such as: mail services, SMB, FTP servers, and so on.

Options for placing a honeypot within a local network

Honeypot in a local network

A honeypot can be installed inside a local network (behind the firewall) — that is, on local network computers and servers. If remote network administration is not performed, all incoming SSH traffic should be redirected to the honeypot. When receiving network traffic, the trap system must log all events, and at a low level. A honeypot is not a simple program that records server logs. If an intruder manages to gain access to the server, erasing all logs would be trivial for them. Ideally, all events in the system should be logged at the kernel level.

Honeypot in the DMZ

Publicly accessible servers are located in the demilitarized zone, or DMZ. For example, this could be a web server or a mail server. Since the presence of such servers often attracts the attention of spammers and intruders, it is necessary to ensure their information security. Installing a honeypot on DMZ servers is one solution to this problem.

If there is no dedicated web server, web services can be emulated using software honeypots. They make it possible to precisely reproduce a web server that does not actually exist and lure in an intruder. Emulation of mail and other network services is limited only by the choice of a specific software solution.

A network with two, three, or more honeypots is by definition called a honeynet. It can be isolated from the working network. Control traffic entering the honeynet must be captured by the traps within that network.

Honeypot implementations

All known honeypots can be divided into 2 classes — open-source and commercial

Below is a brief explanation of some of these implementations.

See also