Re: Anyone with experience w/VirtualMDA?
| Newsgroups | gmane.comp.security.honeypots |
|---|---|
| Message-ID | <[email protected]> |
On Wed, 30 Mar 2005 13:17:08 EST, JP Garcia said: > We've been using it for some time now, and have not sent 1 piece of > email. To verify, I removed the computer with VirtualMDA, and put a > machine with an SMTP engine on it and sent a message to another server. > My setup pulled the whole message transmission, no problem. All > VirtualMDA seems to do is initiate a telnet session and immediately > quit. I figure that VirtualMDA does this periodically to log and allow > people's dynamic IPs to connect to their servers. Maybe VirtualMDA is able to detect it's in your honeypot environment and refusing to do its song-and-dance while you're actively watching it? Somehow, this reminds me of Michigan J. Frog: http://en.wikipedia.org/wiki/One_Froggy_Evening
signature.asc
(application/pgp-signature, 226 B)
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.1 (GNU/Linux) Comment: Exmh version 2.5 07/13/2001 iD8DBQFCSwkBcC3lWbTT17ARAnEAAKD3X2O06/5ljB5ZCwhSi7QBA8s3jwCgq7o5 015JkIby87lUWmiPfExg3bQ= =2qK3 -----END PGP SIGNATURE-----