RE: Honeypot detection and countermeasures

From: Rob Shein <shoten(at)starpower.net>
Date: Mon Jun 23 2003 - 09:58:14 EDT

This wouldn't work. Seeing the packets/traffic on the wire doesn't tell you the tools that are used, and it also doesn't really give you much else. Considering that a honeypot is either not really rootable (DTK) or is very low hanging fruit (and very rootable, like a honeynet.org system), they either won't see tools downloaded to the system or won't see anything more than the bare minimum needed to exploit a system that is too vulnerable to begin with.

> -----Original Message-----
> From: Michael Boman [mailto:michael.boman@securecirt.com]
> Sent: Wednesday, June 18, 2003 11:32 PM
> To: Larry Colen
> Cc: Brass, Phil (ISS Atlanta); pen-test@securityfocus.com
> Subject: Re: Honeypot detection and countermeasures
>
>
> On Wed, 2003-06-18 at 10:15, Larry Colen wrote:

---

Latest attack techniques.

You're a pen tester, but is google.com still your R&D team? Now you can get trustworthy commercial-grade exploits and the latest techniques from a world-class research group.

Visit us at: www.coresecurity.com/promos/sf_ept1 or call 617-399-6980

---

Received on Mon Jun 23 17:06:08 2003