Honeypots mailing list archives
Re: Heisenberg in the honeypot
From: Valdis.Kletnieks () vt edu
Date: Mon, 21 Jun 2004 23:01:44 -0400
On Mon, 21 Jun 2004 09:18:03 PDT, Harlan Carvey said:
Interesting. Are you saying that the HUP is flawed, or the application I'm proposing is flawed?
Your application is flawed. If Heisenberg actually applied in the honeypot environment, then running a program to detect whether or not it was a honeypot would actually potentially change the answer from 'yes' to 'no' or vice versa. And although I'm positive that there have been black hats that ran their honeypot-detection kits, found out that it was a honeypot, and left in a hurry, the box in question didn't actually stop being a honeypot. Nor do I know of any cases where a blackhat ran their detection kit, and as a result of running it, the box suddenly started being a honeypot rather than somebody's desktop machine....
Attachment:
_bin
Description:
Current thread:
- RE: Heisenberg in the honeypot, (continued)
- RE: Heisenberg in the honeypot Harlan Carvey (Jun 22)
- Re: Heisenberg in the honeypot James Riden (Jun 22)
- Re: Heisenberg in the honeypot Harlan Carvey (Jun 22)
- RE: Heisenberg in the honeypot Chuck Fullerton (Jun 22)
- RE: Heisenberg in the honeypot Harlan Carvey (Jun 22)
- Re: Heisenberg in the honeypot Valdis . Kletnieks (Jun 22)
- Re: Heisenberg in the honeypot PCSage Information Services (Jun 22)
- Re: Heisenberg in the honeypot Harlan Carvey (Jun 22)
- Re: Heisenberg in the honeypot Valdis . Kletnieks (Jun 22)
- Re: Heisenberg in the honeypot Valdis . Kletnieks (Jun 22)
- Re: Heisenberg in the honeypot Valdis . Kletnieks (Jun 22)