Recipe For Building a Cheap Raspberry Pi Honeypot Network 68
mask.of.sanity (1228908) writes "Honeypots are the perfect bait for corporate IT shops to detect hackers targeting and already within their networks and now a guide has been published to build a dirt cheap battalion of the devices from Raspberry Pis. "By running honeypots on our internal network, we are able to detect anomalous events. We gain awareness and insight into our network when network hosts interact with a Raspberry Pi honeypot sensor," the author explained."
I don't get the hype (Score:5, Insightful)
Re: (Score:1)
Pretty much, you can achieve the same effect by running one or more VMs on some spare piece of metal. This has added benefit that you can pick a guest OS matching the target profile for viral infection yet still retain full monitoring ability of everything going in and out through the host OS's NIC. But that would not newsworthy as it does not involve the Raspberry Pi. In the end this is probably just another slashvertisement.
Re: I don't get the hype (Score:2, Insightful)
That may be true if everything is on a small number of networks but the raspberry pi is nice as I could but them in wiring closets all over. Right now we have net flow data for any traffic between buildings but we don't see all traffic within a building. This could let us have a honeypot in each building to get a heads up about issues.
Right now bringing each network into our data center is impractical. As it is our virtual environment is at the maximum number of vlans it can handle so the best use of resour
Re: (Score:2)
Re: (Score:2)
Its worse than that. The raspberry pi has bad ethernet and is woefully underpowered.
Sure you can make it a honey pot, but it'll drop half the packets heading for it and even a slight flood its going to be overloaded.
Re: (Score:3)
Honeypot. Flood.
You don't get it.
You can put these on isolated segments, VLANs, whatever but importantly: wherever in the system you want to attract the bees.
So long as it can send even one "ouch" packet, it's done its job, saved your ass, and saved you hours looking through even great syslog managers to find symptoms of internal infections.
Do they cost? Not much. Aren't VMs cooler to use? No, because you want them randomly everywhere, not just in your VM farms. Yes, VM honeypots are a great idea. No, you c
Re: (Score:2)
VMs are the way here (Score:4, Insightful)
Why not buy a cheap couple of hundred dollar PC and run as many VMs as could possibly fit. Install a really old Linux distribution (or early Windows) and the resource use is small. Many honey pots with less maintenance....
Hypervisor defect (Score:1)
If there's a defect in the VM software or hypervisor, it might be exploitable to break out of the VM and attack the root OS.
Re: (Score:2)
Entrapment is so much fun is it? (Score:2)
Re: (Score:2)
Oh do at least try to grow up.
Re: (Score:2)
Rubbish analogy that deserved to be mocked (Score:2)
They ARE leaving something out in "public" when the public are the employees of the company - leaving the money out in the hallway and punching whoever picks it up.
Clearly not because the people you are trying to catch are already "in the house" but you just happen to have put something shiny in their sight in the house with a sign "don'
Re-dick-you-lous (Score:1)
That's an awful lack of reason friend. It is well known and established security fact that the vast majority of threats to a network come from within - as in NOT external. As such, and coming from a business owner myself, your assertion that an employee is or should somehow be exempt from not only suspicion, but shouldn't know better than to be intruding where they don't belong - say, an investment, payroll or other sensitive out-of-bounds area is just flat ignorant. I want to know if an employee is going w
Re: (Score:2)
And this is a very stupid way to attempt to deal with the situation. Fabricating ready made crimes to catch the weak willed, deals with low hanging fruit, gives you a false sense of security and can lead to punishment of people who you normally wouldn't have to worry about.
Re: (Score:3)
The article specifically talks about using it on an internal network.
Need to think about why it is being done (Score:2)
The question to ask before deploying such things is to ask yourself (or you boss) what your job actually is. Is it to catch a number of people and meet some sort of "arrest quota" or is it to actually protect things? If it's the former then putting up fragile things to attract the attention of the weak willed may be a go, but if it's the latter you may well just be wasting time while the serious threats are getting into your ser
Re:Need to think about why it is being done (Score:5, Interesting)
The aim of honeypots in this scenario isn't to bait out people but software. The first thing that a targeted piece of malware is likely to do is find other systems to infect and map out the internal network. If a computer in the accounts department is suddenly firing off CIFS requests at your honeypot it is an anomaly that should be investigated. It's much easier to find dodgy traffic if there isn't supposed to be any rather than looking for it in the corporate network as a whole.
If it turns out it was a bored intern browsing the local network then the situation can be explained. If it was an opened dodgy e-mail or other attack vector then the machine can be wiped and connection logs gathered so that a clean-up operation can be attempted.
Re: (Score:2)
real storage, active directory servers get legit t (Score:3)
Let's consider the last piece of malware I dealt with. It searched the network for shared storage and did nasty things on the storage. The REAL storage server is used by thousands of people, so it gets many, many requests per minute. Sorting out legitimate use of the storage vs something suspicious would be nearly impossible. The honeypot storage, on the other hand, gets NO legitimate traffic. Any traffic to the honeypot is worth investigation. That makes it a much more reliable way to find malware or ot
ps My office has been investigated != fired (Score:2)
I should emphasize strange traffic being investigated doesn't mean anyone gets in trouble. The head of security cut off my network port once when he detected something weird. I explained what I was doing. He pointed out a security concern, and we agreed to a compromise configuration we could both live with.
Re: (Score:3)
If your network is too large to comprehend then apply an engineering solution instead of a basket weaving solution and handle things in managable chunks. Since IT folk like to pretend they are engineers (which was to my benefit when I changed careers from engineering a couple of decades back) why not act like them? Suspicious stuff coming in or out of segments is one way of tracking, does that really compare with hoping something random
Oh yes, Windows Malware swamp - I get it now (Score:2)
I see now - fully trusted hosts, potential malware ridden with no way to keep it off other than hoping the antivirus updates arrive before the malware, and a closed system where you have to guess at the legitimate traffic to boot. I can see now why you grasp at straws such as honeypots and hope the malware is so badly written that they randomly get attacked before your real systems instead of the malware taking a look at what the machine it is on has connected to in the past.
After they do
yep, welcome $large_organization networking (Score:2)
> > active directory
> I see now - fully trusted hosts, potential malware ridden with no way to keep it off other than hoping the antivirus
> updates arrive before the malware, and a closed system where you have to guess at the legitimate traffic to boot.
Yep, welcome to office networking. In a government office, throw in a few DOS terminals and other systems that haven't seen a security update since 1982.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Think of a mall: if you are the owner you can't make each store increase their security. You are probably working on convincing them to and potentially making progress but in the, mean time having a honeypot gives you a heads up about who to watch more closely or what types of attacks people are attempting. It's all about gathering intelligence and honeypot on your network can give you a local perspective.
Also some things we can't harden. They are million dollar instruments not designed to be hardoned. We can't tell the business to go out of business as its too risky. We have to present the risk and potential plans of reducing that risk and let the business decide. If they want to continue an option could be setting up a local perimeter and having honey pots that report to security to reduce the chances of compromise and to better detect compromise.
No.
It's like running a lumber yard and instead of putting fire alarms, smoke detectors, etc. in all of your buildings and monitoring them, you have a big unprotected building full of sawdust and small bits of wood next to your other buildings. Then you put a fire alarm on it so you know when there's a fire. It's fucking retarded.
Nailed it (Score:2)
In other News (news that counts) (Score:2)
Do the other "thing" Raspberry Pis are semi "good" for (minus a slow XBMC system).
Turn your raspberry Pi into a dedicated BitTorrent power house!
Premade optimized image here:
http://fuzon.co.uk/phpbb/viewt... [fuzon.co.uk]
Honeypots, what a waste or an ARM.... ;)
Re: (Score:2)
I've always been somewhat wary about these one-man custom distros or images. Do they contain malware? Probably not. But do they contain schoolboy mistakes which cause breakage or security problems? I think it's possible.
Breakage:
No. Everything works.
I've been running this setup for over 2 years. I finally decided to share my installation with a guide. Not everyone is out to get you and your "security".
Schoolboy mistakes:
Everyone makes mistakes. Even you.
By all means, find a issue and i'll gladly fix it in my free time.
Security Problems:
If you have "security concerns", you shouldnt be using any distro, unless you make it to your own "security" requirements.
These debian images are aimed at home users, who just want a fast P
Re: (Score:3)
Re:We need a Pi category so I can ignore it (Score:4, Funny)
Re: (Score:2)
What are you trying to do, create a buzzword black hole that'll consume civilization as we know it and leave nothing but a post-apocalyptic landscape of marketdroids and PHBs?
Re:We need a Pi category so I can ignore it (Score:5, Insightful)
That, and Elon Musk are the two most masturbatory topics on Slashdot these days.
From what I've seen though, there are a lot of slashdotters who have a deep-seated need to bitch about something.
Must be 75 percent of the posts are crying about "'Nuthre rsby pie rtickle!"
There are options for us:
1. Don't read the article. This works surprisingly well for people not in the Fox news self-validation mode. The title usually let's us know what the subject is.
2. Submit your own stories. You people who know what people really want to read should be able to submit articles that people really want to read
Re: (Score:2)
That, and Elon Musk are the two most masturbatory topics on Slashdot these days.
From what I've seen though, there are a lot of slashdotters who have a deep-seated need to bitch about something.
Must be 75 percent of the posts are crying about "'Nuthre rsby pie rtickle!"
There are options for us:
1. Don't read the article. This works surprisingly well for people not in the Fox news self-validation mode. The title usually let's us know what the subject is.
2. Submit your own stories. You people who know what people really want to read should be able to submit articles that people really want to read
The problem is that we do submit our own stories and they're ignored in favor of stupid shit like this.
Slashdot's firehose and comment moderation are placebos. Dice is in full control. It was their top priority.
Re: (Score:2)
It's so funny to see Fox News bothers people so much they bring it up in contexts like this. MSNBC is a far better example. Keep drinking your kool-aid. Lol.
Otherwise how are we gonna know that Germany is sunnier than the US, and that Jesus was a white Anglo-Saxon male? The lamestream liberal media doesn't tell us about that stuff yaknow.
And the context is that some people become enraged when they see another RBP article. They don't want to see what they don't want to see. Maybe they need to start their own news for nerds site, one that is fair and balanced.
Or (Score:2)
I don't understand all I know about this ... (Score:2)
... which is great because I get to learn something with y'all helping.
This honeypot inside a network intrigues me. If I created a share on a server (or desktop) that was useless, would that serve as a honeypot looking to serve as a trip wire for malware that goes after shares?
In a Windows environment, all I know to do is look at Event logs. I don't know how to get Security events to bark.
I read the article(s) but it was a "whoosh," event.
Thanks.
Re: (Score:2)
Sexconker above put it far better than I could:
Re: (Score:2)
Re: (Score:1)
Throw up new box on the internet. How long is it safe these days?
"They shouldn't try to break into" != (They won't || They can't)
Counter-intelligence deserves a place in a security kit these days.
Not only can it waste their time, you should get logging of who is
knocking on the door.
Of course, denial has always been a great security tool.