3 ms·
In this case, I think the engineering effort required to proxy a real one to make it look like a poorly-configured honeypot would be greater than actually imple
by gherkin0 11y ago
In this case, I think the engineering effort required to proxy a real one to make it look like a poorly-configured honeypot would be greater than actually implementing some proper security measures, like a firewall plus a VPN for any needed external access.
- n-exploit 11y agoYou're probably right.
- ilyanep 11y agoI had the same thought as GP as well. Could you not implement some of the "disguise-as-honeypot" features (such as setting the name to "HoneyTrap" or "Error: rand...") in addition to the normal security features?
- gherkin0 11y agoIn this case we're talking about embedded industrial control systems, I doubt they're easy to modify in that way.
- Pharaoh2 11y agoThere was an article somewhere, which recommended installing vmware tools on a non-vm OS, just because virus/malicious payloads will detect it, think it's a honeypot vm and shred itself so as not to get discovered. It's a nice way to protect yourself from payloads that may otherwise have executed and be invisible in honeypots. It better for everyone if honeypots and normal systems looks as similar as possible.