Privia Security was chosen as one of Türkiye's fastest growing companies!
Privia Security was chosen as one of Türkiye's fastest growing companies!
A honeypot is a single security application set up to simulate a server or an entire subnet. In Turkish it means “honey jar”. The concept of a honeypot involves causing a hacker, when they violate the security of a network, to enter a virtually created trap system rather than the real system. The software used can closely monitor everything that happens on that system and may enable the attacker to be tracked and possibly identified. The core idea is to lay bait for a hacker attempting to infiltrate the system and have them compromise a specially prepared virtual network or computer. This way, information can be gathered about the cyber attacker and a great deal of intelligence can be obtained — from the techniques they used to their identity.
The underlying principle of honeypot systems is that any traffic coming to the honeypot machine should be treated as suspicious. Since these systems — which we call honeypots — are not real machines, there is no reason for any legitimate user to connect to them. Access can only be gained through a cyber attack (exploiting vulnerabilities, etc.). For this reason, anyone attempting to connect to this machine is considered a potential intruder. Honeypot systems also contain traps designed to keep the cyber attacker connected long enough to track where they are connecting from.
Spectre is a software-based honeypot solution. Product information can be found on the Specter website. Spectre software has the ability to emulate major internet protocols and services such as HTTP, FTP, POP3, SMTP and others. It can therefore behave exactly like a fully functional server. The software is designed to run on Windows 2000 or XP. While running on Windows, it can of course simulate AIX, Solaris, UNIX, Linux, Mac and Mac OS X.
Spectre works by running a number of services common to network servers. In fact, in addition to simulating multiple operating systems, it also has the ability to simulate the following services:
Although Spectre appears to be running these servers, it is actually monitoring all incoming traffic. Since it is not a real server on your network, no legitimate user should connect to it. Spectre logs all traffic going to the server for analysis. Users can configure it in one of five modes:
In all modes, Spectre logs activity including all information it can derive from incoming packets. It also attempts to leave traces on the attacker’s machine, providing clear evidence for any forensic analysis. A fake password file can be configured for users across all modes. These are particularly useful because most hackers attempt to access a password file to crack passwords. If successful, they can log in as a legitimate user.
Symantec is a popular security company well known for both its antivirus software and firewall solutions. Being such a major vendor, it also provides a honeypot solution. The first Symantec honeypot product was the Decoy Server. It mimicked a real server by simulating many server functions such as incoming and outgoing email traffic.
Since the Decoy Server operates as a honeypot, it also works as an IDS that tracks signs of attack. If an attack is detected, all traffic relating to that attack is logged for use in any investigation, prosecution or similar procedures that may arise.
Decoy Server was designed to be part of a series of enterprise security solutions working in tandem, including enterprise versions of Symantec’s antivirus software, firewall software and anti-spyware software.
You May Be Interested In These
