RE: Honeypot detection and countermeasures

> -----Original Message-----

I had to comment on this ...

Keep in mind that tools aren't everything as well!

*Anyone* can probably run Nessus or ISS against your host, but can everyone read it's results? Can everyone point possible weaknesses in your security? _Of course not_, and that's why you hire external penetration testers who have experts for those fields.

Regarding honeypots - as Lance said, there are many, many types of honeypots. Some are really easy to get into, while the other aren't.

Regarding this thread, it's obvious that you can't get tools by only watching network traffic, but there are million other possibilities to deploy honeypots, which *can* get tools you need.

I had a honeypot which had 2 network cards. One was connected to the Internet and the other one was connected to something what looked like a hardened server in a special DMZ. Now, after honeypot was compromised, attacker obviously wanted to get to that other server and he had to upload his tools to honeypot.

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek

This is just one example of possible deployment. YMMV.

Best regards,

Bojan Zdrnja

You're a pen tester, but is google.com still your R&D team? Now you can get trustworthy commercial-grade exploits and the latest techniques from a world-class research group.

Visit us at: www.coresecurity.com/promos/sf_ept1 or call 617-399-6980