Re: turning the actiontec board into a honeypot

john wrote:

> Should I start with the obligatory "Wow it's been quiet lately"?
> Anyway, I finally got around to my actiontec mod.
> I thought it would be cool to make an ARM based honey pot.  I really
> wanted to get honeyd running on it (with nmap fingerprints and whatnot)
> but that didn't work.. I don't think I have enough space on the flash
> anyway.
> I wrote a small C-program that simulates samba shares, done with
> intention of attracting people who query the samba ports.. Not sure how
> much of a honey pot it really is but it ended up looking pretty cool
> none-the-less.  Let me know what you think.  If anyone has other
> honey-pot ideas I would be happy to hear them.   
> 
> http://jarv.nu/honeypot.shtml
> 
> -John

Ha ha ha...  That's really cool!  You've sent my mind racing thinking 
about other ways to "abuse" an Actiontec Dual PC Modem using "alternate" 
packaging.

As someone that used to get 40,000+ port 139 probes per week logged to my 
Linux firewall on the cable modem at home before I simply changed the "IP 
tables" to quietly drop port 139 traffic, I think your "honeypot" is a 
good way to fight back!  Plus it looks good in the living room!

Best regards,

Bruce

-- 
  Bruce D. Lightner
  Lightner Engineering
  La Jolla, California
  Voice: +1-858-551-4011
  FAX: +1-858-551-0777
  Email: lightner-2huV/[email protected]
  URL: http://www.lightner.net/lightner/bruce/
__
ActionHack Mailing List - ActionHack-W7/[email protected]
http://www.express.org/mailman/listinfo/actionhack
http://www.embeddedlinuxinterfacing.com/wiki.php/ActiontecDualModem