Re: Heisenberg in the honeypot

Robert,

> An astute observation. A more proper (closer)
> analogy than the HUP is 
> the Criminal Forensics Sciences principle that
> states, essentially, 
> investigating a crime scene contaminates the crime
> scene.

I believe you're referring to Locard's Exchange
Principle.  Would this be correct?

Even so, I don't think that given what I'm trying to
get at, Locard's is more correct.  Essentially, what
I'm asking is, if the really, really bad guys (ie,
collectively referred to as the mysterious and
ethereal "underground" or "blackhats") know that
someone's watching, would they be inclined to use
their latest and greatest techniques, knowing that
doing so would leave evidence on a (properly set up,
monitored, and managed) honeypot that could be used to
identify that technique, and potentially warn others,
allowing them to protect their systems?

> Starting from the moment of discovery 
> of the crime, each action taken during the
> investigation disturbs the evidence somewhat 

I could see very well how Locard's would apply toward
incident response investigations...a supposedly
compromised system is approached by a first responder
or investigator.  
 
> HUP is an example of a broader "law" which manifests
> itself in various manners across all reality.

Exactly.

> Each attack will be tailored to the particular
> system under attack 
> according to the characteristics of the system under
> attack.

True, but that can't be done until the particular
system is identified...either a priori, or though OS
fingerprinting or header/banner analysis.  Some sort
of a priori knowledge of the system(s) can be obtained
through asking, disgruntled employees, DNS zone
transfers, etc...all w/o out sending packets to the
system itself.  

But that's where we get off topic, I'm afraid.  My
original question still applies...if an attacker has a
new technique or exploit, how likely is he/she to use
it knowing that honeypots are in use?  

Thanks for the response,

Harlan


-----------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com