RE: SV: Honeypot detection and countermeasures

From: Lampe, John W. <JWLAMPE(at)GAPAC.com>
Date: Tue Jun 24 2003 - 12:20:42 EDT

If you lump LaBrea in with these honeypots (and I don't see why you wouldn't), then the check is trivial (in fact, NESSUS can optionally check for the existence of LaBrea prior to launching nmap...that's nice)

some of the pricey honeypots (hi ManTrap) are trivial as well.

And, when youve found some anomalous box on the network, it's always nifty to run a blackbox IP ID scanner against it (i.e. if the machine uses simple incrementing IP IDs, then record the ID every minute for a couple of days, then check back to see when the box traffic peaks...you might not find a honeypot, but you'll find lots of those reverse proxy / vpn thingees)

> -----Original Message-----
> From: dave@immunitysec.com [mailto:dave@immunitysec.com]
> Sent: Tuesday, June 24, 2003 10:45 AM
> To: pen-test@securityfocus.com

---

Latest attack techniques.

You're a pen tester, but is google.com still your R&D team? Now you can get trustworthy commercial-grade exploits and the latest techniques from a world-class research group.

Visit us at: www.coresecurity.com/promos/sf_ept1 or call 617-399-6980

---

Received on Tue Jun 24 13:30:59 2003