Casting Light on Honeypots

Before rushing to attack the chosen target, experienced hackers would carefully study their potential adversaries. This study consists of reconstruction of the network topology, determining locations where the main forces of their adversaries are concentrated, and trying to detect all honeypots. The main hacker tool at this stage is a port scanner, working through a "dumb" host and, consequently, reliably hiding the attacker's IP address (see Chapter 23 for more details).

As a rule, the hacker would discard servers that are obviously vulnerable, because most likely there would be honeypots among them. Even touching them is dangerous. The only exception can be made for main public servers located in the DMZ, because no one would think about combining them with honeypots. It should be noticed, however, that such servers can run intrusion-detection systems.

The safest method is to attack the workstations of a corporate network located after the firewall (if it is present in the network). In this case, the probability of encountering a honeypot is minimized. However, workstations contain considerably fewer holes than server applications; therefore, they have practically nothing to attack.