Re: Honeytokens and detection

[george chamales <george () overt org>]

> The only way i see about this is running a hacked version of the database,

The way I see it something this useful shouldn't be called a hack, it
should be called a feature.

I agree that implementing it at the dbase level is the most direct and
certainly easiest way to accomplish this.  Another, more difficult way
would be to build it into the host itself.  It wouldn't eliminate the
possibility that the mechanism could be circumvented, but it would raise
the bar.

Linux could easily be hacked (oh yes, it would be a hack) to alert based
on what file/sector is being read/written/modified.  This would work
really well for regular files, i.e. MyCreditCardNumberAndPassword.txt
and adduser, but at the moment I'm stuck as to how it could be used to
key off of entries in a database.

If anyone has any ideas I'd be really eager to her them.

george