Firewall Wizards mailing list archives

DTK


From: Fred Cohen <fc () all net>
Date: Fri, 15 May 1998 06:17:46 -0700 (PDT)

-------------------- begin forwarded message --------------------
Message-Id: <3.0.3.32.19980513145428.0070ed84@localhost>
X-Sender: jepstein@localhost
X-Mailer: QUALCOMM Windows Eudora Pro Version 3.0.3 (32)
Date: Wed, 13 May 1998 14:54:28 -0400
To: firewall-wizards () nfr net
From: Jeremy Epstein <jepstein () tis com>
Subject: Comments on Fred Cohen's "Deception Toolkit"

A couple of months ago Fred Cohen announced the availablility of his
"deception toolkit" (details are available at http://all.net/dtk).  It's
basically a set of tools that you can put on your system to simulate a
"honeypot", that do lots of logging.  For example, you put his "telnet" out
there and find people rattling doorknobs (rather than just having nothing
to respond, in which case you're less likely to know that someone was
trying).  My initial inclination is that it's a pretty lame excuse for an
intrusion detection system, but am looking for more knowledgable opinions!

Anyway, I've looked around the net (including searching archives of this
list), and have found very little discussion of his "product".  Any
opinions out there?

Thanks for your input!
--Jeremy

HUMOR ON

I just got wind of this lame advertisement for DTK, and I think it's
disgusting that someone from a company with the fine reputation of TIS would
so blatantly advertise the all.net Web site in an intellectual forum such as
this. How much did they pay you to get people to visit this site?

HUMOR OFF

--
FC
                                Have a great day!!!



Current thread: