Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Breaking Honeypots For Fun And Profit
Newest First  |  Oldest First  |  Threaded View
AlirezaM983
50%
50%
AlirezaM983,
User Rank: Apprentice
9/15/2015 | 11:44:42 PM
Full presentation file
Hello

Do you have this presentation file?

thanls
felixonline
50%
50%
felixonline,
User Rank: Strategist
8/5/2015 | 4:18:19 AM
Not a fan either, but..
Don't disagree with the article and comments from folks. However, I think it is less about the concept and more about its positioning, use-cases and robustness/quality of implementation. Honeypots and their predecessors have been around for a while and have helped improve our knowledge of threats and attacks, methodologies etc. However, relying on these for cyber defence would be getting the balance wrong. I am aware of some innovative use-cases that use honeypots to test the quality of security defences in that provide a vantage point to the attacker but have other layers prevent or resist further proliferation and penetration. Clearly, excellent academic and research value. To summarise, this could be one of the layers however like the others I agree we should invest our time and energy in understanding the real-world problem rather than chase honeypot data !!
GadiE551
50%
50%
GadiE551,
User Rank: Author
8/3/2015 | 7:27:30 PM
Re: Not a fan
That's exactly the point, assuming compromise as we learned to do the past few years we KNOW the attackers are already inside. We don't need to lure them in. What we need is a way to detect them fast with low false positives, and get all the forensics data while we do it. Deception does that.
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
8/3/2015 | 2:35:25 PM
Not a fan
For these reasons I am not a believer in leveraging honeypots/nets. Why poke the bear and piss him off? Rather lets build perimeters so the bear can't get in and catch us sleeping instead of luring it into the secondary perimeter with honey and hoping to God that he doesn't get out.


News
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Commentary
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-21394
PUBLISHED: 2021-04-12
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.28.0 Synapse is missing input validation of some parameters on the endpoints used to confirm third-party identif...
CVE-2021-22497
PUBLISHED: 2021-04-12
Advanced Authentication versions prior to 6.3 SP4 have a potential broken authentication due to improper session management issue.
CVE-2021-3163
PUBLISHED: 2021-04-12
A vulnerability in the HTML editor of Slab Quill 4.8.0 allows an attacker to execute arbitrary JavaScript by storing an XSS payload (a crafted onloadstart attribute of an IMG element) in a text field.
CVE-2019-15059
PUBLISHED: 2021-04-12
In Liberty lisPBX 2.0-4, configuration backup files can be retrieved remotely from /backup/lispbx-CONF-YYYY-MM-DD.tar or /backup/lispbx-CDR-YYYY-MM-DD.tar without authentication or authorization. These configuration files have all PBX information including extension numbers, contacts, and passwords.
CVE-2021-21524
PUBLISHED: 2021-04-12
Dell SRM versions prior to 4.5.0.1 and Dell SMR versions prior to 4.5.0.1 contain an Untrusted Deserialization Vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability, leading to arbitrary privileged code execution on the vulnerable application. The severity is Cr...