Re: which part of dynamic honeypot that needs 'intelligent'?

On Tue, 26 Apr 2005 17:26:40 EDT, Randy said:
> I'm flushing out details for implementation and response plans for a highly 
> interactive honeynet on the part of the admin...haven't come up with a term 
> that fully grasps where I want to go with this yet. honey TRAP comes to 
> mind, since I do want to continually make things not work for the intruder 
> after I get them interested and show initial success.

Read Cheswick's "An Evening with Berferd".  Remember that if you do what Cheswick
did with the fake FTP password file, the game will probably be over... :)

The secret here is that you don't want *everything* to not work once they're
interested - you want to emulate that "90% works, 5% is broken, and 5% is so
wonky we're not sure *what* it is" that poorly administered systems tend to
degrade into (remember - if much more than 10% is broken, the machine will
eventually fail to return from one of its frequent reboots, or it may be
summarily defenistrated by the user....)

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)
Comment: Exmh version 2.5 07/13/2001

iD8DBQFCbzqncC3lWbTT17ARAnUsAKCbHJNj+MIlBXt/FHtEvfYvGVhXoACcDBkI
mlkib9BxE9Zka+cqPn0lG9g=
=TRfB
-----END PGP SIGNATURE-----