Honeypot as a Service • Hacker News Board

Re: Honeypot as a Service

#11

Post by oefrha » Tue, Apr 14, 2020, 4:31 AM UTC

> You install and run the HaaS proxy application, downloadable from our website

Said website is a GitLab repo without a release artifact in sight, so I guess “downloadable” means you can download the source code, compile it yourself, and figure out how to set it up on your own.

Sure makes it easy to join...

Re: Honeypot as a Service

#12

Post by spicyramen » Tue, Apr 14, 2020, 7:36 AM UTC

teruakohatu wrote: post #5

If a honeypot is widely used, won't scammers just detect the honeypot? or even just detect latency from their connection being proxied elsewhere?

I wrote my dissertation using honeypots and in VoIP you can actually act as a real system and pretend you have been hacked by emulating real system behavior, in this case PSTN. Most of the scammers wouldn't dare to check each system as they normally attack ranges of ip addresses

Re: Honeypot as a Service

#13

Post by waihtis » Tue, Apr 14, 2020, 11:04 AM UTC

Self plug: founder at https://www.avesnetsec.com and launching something like this as a SaaS-offering very soon - doing limited access trials right now and expect full launch in 4 weeks' time.

Some of the comments here around usability echo our early customer feedback very much - which is why we want to be as smooth on the plug and play side as possible.

Re: Honeypot as a Service

#14

Post by LinuxBender » Tue, Apr 14, 2020, 11:28 AM UTC

teruakohatu wrote: post #5

If a honeypot is widely used, won't scammers just detect the honeypot? or even just detect latency from their connection being proxied elsewhere?

Targeted attacks will eventually figure out the honeypot, though may trip over it a bit and create some noise. Hopefully this causes someone to look at the attacker. This can also be useful forensic data to provide to the authorities.

Bots doing initial discovery won't figure it out. I have the same bots trying to log into my SFTP server today that have been trying for years. It's not even a honeypot. I literally create accounts for all the bots with a null password in hopes they one day upload something neat.

Re: Honeypot as a Service

#15

Post by PappaPatat » Tue, Apr 14, 2020, 11:46 AM UTC

This submission is a better honeypot than the software link it points to. It has not been updated (latest blog entry 19/02/2018, latest code release Jul 30 2018).

Honeypots are high maintenance, or easy detectable.

Better example (disclaimer, I might have had something to do with this when it was being developed) is the DT Honeypot initiative.

Website: https://sicherheitstacho.eu/start/main

Code (Deutsche Telekom AG Honeypot Project on 01 Apr 2019): https://dtag-dev-sec.github.io/