3 ms·
If a honeypot is widely used, won't scammers just detect the honeypot? or even just detect latency from their connection being proxied elsewhere?
by teruakohatu 7y ago
If a honeypot is widely used, won't scammers just detect the honeypot? or even just detect latency from their connection being proxied elsewhere?
- yellow_lead 7y ago> won't scammers just detect the honeypot It's fairly difficult to detect a well-made honeypot. >even just detect latency from their connection being proxied elsewhere Not if the attacker is legitimately placed far away from you. Also, from my experience these bots have very large timeouts set.
- pfundstein 7y agoYou are giving these script kiddies far too much credit. The authors of the tools they use may try to implement honeypot detection, but that's fruitless cat & mouse game, and to what end? Assuming "honeypot" based on latency is a fool's errand because many legitimate things can induce latency.
- spicyramen 7y agoI wrote my dissertation using honeypots and in VoIP you can actually act as a real system and pretend you have been hacked by emulating real system behavior, in this case PSTN. Most of the scammers wouldn't dare to check each system as they normally attack ranges of ip addresses
- LinuxBender 7y agoTargeted attacks will eventually figure out the honeypot, though may trip over it a bit and create some noise. Hopefully this causes someone to look at the attacker. This can also be useful forensic data to provide to the authorities. Bots doing initial discovery won't figure it out. I have the same bots trying to log into my SFTP server today that have been trying for years. It's not even a honeypot. I literally create accounts for all the bots with a null password in hopes they one day upload something neat.