skip navigation

honeypots for windows
Honeypots for Windows
by Roger A. Grimes
Apress 2005
progress indicator progress indicatorprogress indicator progress indicator



attracting to your honeypot, 37

defined, 7

hacking activity

redirecting to protect systems, 8

Hacking Disassembly Uncovered (Kris Kaspersky, et al.)

book on disassembling malicious code, 359

hacking prevention

effect of honeypots on, 8–10


Windows OS minimum and hardware requirements, 95–96

hardware solutions

for hiding honeynet monitoring devices, 44–45


website address, 308

Helix bootable forensic distribution

website address, 324

Hex2dec converter

website address, 318

hexidecimal-to-decimal converter

using Sysinternal’s Hex2dec as, 318

HFind tool

for finding hidden files and alternate data streams, 313

hidden files and alternate data streams

looking for in file system, 313

utilities for finding, 313

High Level Assembler (HLA)

created as a learning tool for programmers, 352

high-interaction honeypots

determining need for, 90

function of, 14

Hogle trojan virus

website address, 207


website address, 52

HOME_NET variable

syntax for using in Snort, 258

Homename utility

website address, 311

Honeycomb research tool

website address, 7

Honeyd (honeypot daemon)

creating a default template in, 156

creating a runtime batch file in, 152–154

creator of, 10

default directories, 145

default scripts in Windows version of, 172

downloading script files, 146

emulation of ICMP behavior by, 128

example with multiple templates, 134

features of, 123–136

installation, 121–149

IP stack emulation settings in, 123–124

list of simple port behaviors, 131

logging, 134–136

memory variables useful in scripts, 171

mimicking IP information in, 124

mimicking TCP/IP stack in, 124–126

on-screen logging, 135

OS personalities, 129–130

output fields for on-screen logging, 134

proxy services, 132

reasons for using, 122–123

recommended directories, 148

runtime options, 152

steps for a typical installation, 136

steps for installing, 145

steps for testing your installation, 145–146

subsystems and plug-ins for Unix, 133

TCP/IP port emulation, 131–134

website address, 121, 123

Honeyd configuration, 151–166

using command-line options, 151–152

Honeyd configuration files

adding port instructions to, 158–160

assembling templates in, 161–165

sample code list for, 162–165

setting up, 154–165

setting up virtual honeypots (templates) in, 154

syntax for, 171–172

testing, 165–166

Honeyd emulation service scripts, 132

Honeyd installation

deciding logistics, 137–139

default directories, 145

installing Cygwin, 142–145

installing WinPcap, 140–142

resolving local subnet problems, 138–139

resolving routing problems, 138

steps for, 145

steps for hardening the host, 139

steps for testing, 145–146

Honeyd log files

fields included in default, 135

using the -l parameter to enable, 134–135

Honeyd logging

choices, 134–136

Honeyd OS personalities, 129–130

Honeyd runtime command

example of, 152

Honeyd script files

steps for downloading, 146

Honeyd service scripts, 167–188

available from Honeyd.org, 179–180

basic tasks they can be used for, 167–172

to catch the MBlaster worm, 181

common languages for, 168–170

custom, 180–188

default in Windows version, 172

downloadable from Honeyd web site, 178–180

input/output routines, 170–171

memory variable useful in, 171

for an offensive response to the MBlaster worm, 181–182

using JavaScript for, 170

using Python for writing, 169

using shell command language for, 168

using Visual Basic languages for, 169–170

a worm catcher script, 180–181

Honeyd simple port behaviors

list of, 131

Honeyd templates

adding personality instructions to, 156–157

adding port instructions to, 158–160

adding proxies to, 160

adding service scripts to, 159

blocking certain ports in, 159

code example for creating, 155

configuring, 154–165

contents of, 133–134

creating, 155–156

defining the default port state in, 158

for an Exchange Server 2003 honeypot, 161

naming rules, 155

order for defining necessary parameters, 154–155

personality defined, 156

setting system variables for, 160

Honeyd.bat configuration file

example of with multiple runtime configurations, 153

Honeyd.config file

recommended logical order of templates in, 154


service scripts available at, 179–180

Honeydscan.tar script

website address, 179

Honeyd.tar script

website address, 179

honeynet monitoring devices

hardware solutions for hiding, 44–45

software solutions for hiding, 42–43

Honeynet Project

formed by Lance Spitzner, 21

function of, 3

future generations of honeypot technology, 26

Honeynet Project Scan of the Month

website address, 248

honeynet security console

Activeworx Security Center (ASC) as, 294


defined, 5

example of, 6

example of complex IP address scheme, 54

system network devices for, 41–54

honeypot daemon. See Honeyd (honeypot daemon)

honeypot data analysis.

See also data analysis

investigations, 302–304

honeypot deployment

in Windows, 89–120

honeypot emulation software

function of, 18–20

honeypot farm

defined, 9

honeypot interaction levels, 14–15

honeypot layers

function of, 13–14

honeypot modeling

what you need to know, 63–65

in Windows, 63–88

honeypot monitoring, 269–299

honeypot network system devices

bridges as, 46

Ethernet switches as, 46–47

firewalls as, 51

hubs as, 41–45

summary, 52–54

honeypot placement

location comparison table, 59

honeypot platform

deciding what OS to use as, 89

honeypot system deployment

steps for, 35–36

honeypot system placement

main locations for, 54–59

honeypot systems

defined, 35

modifying and redeploying, 324–325

honeypot traffic

as malicious traffic, 3–4


attracting hackers to, 37, 95

automated vs. manual attacks, 302–303

automating security for, 119–120

availability of OS software support tools for, 93

basic components of, 11–12

blocking certain ports in, 159

choosing real or virtual, 39–40

common reasons for using, 5–11

configuring service accounts to protect, 115–117

creating and storing user accounts on, 94

The Cuckoo’s Egg by Clifford Stoll’s about, 20

data capture, 22–23, 36

data control, 21–22, 36

deciding on research or production, 37–39

deciding to patch or not patch OS on, 93

deciding to run as client or server, 93

deciding which applications to install on, 94

deciding which OS to choose for, 90–93

defined, 3–5

defining goals for, 37–41

deployment in Windows, 89–120

deployment plan, 35–59

deployment steps, 35–36

design tenets, 36

determining need for high interaction, 90

determining the number of collected network packets, 309

disabling unneeded services on, 108–117

documenting configuration settings for, 98

emulated, 18–20

external placement of, 55–56

filtering network traffic on, 105–106

firewall DMZ placement, 57–58

as forensic tools, 10

function of high interaction, 14

function of low interaction, 14

general installation guidelines, 99

guidelines for reducing your legal risk, 33

history of, 20–26

hub network devices, 41–45

identifying the IP addresses and top talkers, 309–310

importance of using complex passwords, 118

improving computer security with, 10

information resources, 33

initial compromise of, 303

installation guidance, 96–100

installation steps to deploy and operate, 97

installation tips, 99–100

installing necessary patches to, 101

internal placement, 56–57

introduction to, 3–34

modifying and redeploying after analysis, 324–325

monitoring, 269–299

monitoring programs for, 277–283

need for licenses for all virtual machines, 18

need for update plan for, 90

new threat detection by, 7

physically securing, 100–101

placement summary, 58–59

potentially dangerous executable files list, 107

preferred by hackers, 94–95

production, 8

of real operating systems, 15–16

recommended hardware requirements for, 96

rejecting default folder locations for software, 103

removing or securing network shares before making live, 104–105

renaming administrator and guest accounts for, 117

research, 8

restricting unauthorized software execution on, 106–117

risks of using, 32–33

a sample deployment of, 11

scenarios for high levels of exploitation, 94–95

summary of other available Windows based, 220

summary of types, 20

system network devices, 41–54

taking baseline measurements for, 98–99

telltale signs of a manual attack on, 303

telltale signs of an automated attack on, 302–303

testing, 97–98

things they can mimic, 13

tools for recovering e-mail messages, 315

tracking the hackers, 311

types of, 13–20

using IPSec as a firewall on, 105–106

using real OS or virtual machine, 90

using Software Restriction Policies with, 107

using Symantec’s Norton Ghost to restore, 16

virtual, 16–20

VM installation guidelines, 99–100

web site addresses for hardening information, 40–41

what happens after initial compromise, 303–304

Windows based, 61–220

Windows OS minimum and hardware requirements, 95–96

Windows-based other than Honeyd, 189–220

“Honeypots: Are They Illegal?” paper (Lance Spitzner)

website address, 33

Honeypots book

by Lance Spitzner, 21


website address for list of honeypots, 219


website address, 219


ensuring early detection of threats with, 7

honeywall. See honeywall gateways

Honeywall Administration menu

for Honeynet Project, 52

honeywall gateways

benefits of, 51–52

for redirecting malicious activity, 9–10

use of in GenII model, 24–26

HoneyWeb-0.4 tgz script

website address, 179

host baseline programs

for documenting current computer settings, 272–275

host documentation tools, 272–275

host enumeration

defined, 77–78

hot fixes, 101

HTTP header

using Netcat to read, 81–82

Http_decode preprocessor

in Snort, 259

hub network device

for honeypots, 41–45

using to create a honeynet, 42

progress indicator progress indicatorprogress indicator progress indicator

Honeypots for Windows
Honeypots for Windows (Books for Professionals by Professionals)
ISBN: 1590593359
EAN: 2147483647
Year: 2006
Pages: 119

Similar book on Amazon
Honeypots: Tracking Hackers
Honeypots: Tracking Hackers
Know Your Enemy: Learning about Security Threats (2nd Edition)
Know Your Enemy: Learning about Security Threats (2nd Edition)
Virtual Honeypots: From Botnet Tracking to Intrusion Detection
Virtual Honeypots: From Botnet Tracking to Intrusion Detection
Malware Analyst's Cookbook and DVD: Tools and Techniques for Fighting Malicious Code
Malware Analyst's Cookbook and DVD: Tools and Techniques for Fighting Malicious Code

flylib.com © 2008-2017.
If you may any questions please contact us: flylib@qtcs.net