Setting up a honeypot

Question

I have a spare computer lying around at my house, so I decided to turn it into a honeypot. So far, I have installed Windows XP (no service pack) on it and have set up rules on my router to forward (some) ports to the honeypot. Since my router doesn't support DMZ, I have to manually create rules. Currently, I forward TCP ports 80, 100-140 and 1000-1500 (I chose those values pretty much randomly). On the honeypot, I use Wireshark to monitor the network traffic.

However, the honeypot doesn't seem to get infected. I only receive very little traffic from the outside.

What am I doing wrong? Do I have to forward other ports? Do I have to somehow advertise my presence on the internet?

Thanks for any input!

P.S.: I do know about the dangers of running a honeypot inside of a home network.

Answer 1

If you just want to get your honeypot machine compromised and part of a botnet, you will need to be running vulnerable services on the machine. The vulnerable services you choose will have to match the ports that you have forwarded to the honeypot machine and will also have to match the services that worms are actively trying to exploit.

For a Windows XP machine, forwarding ports 137, 138, 139 and 445 should get you plenty of attack traffic. These ports are for NetBIOS and Samba and they all receive a constant stream of traffic from the internet.

Forwarding port 80 will only be useful if you are running a web server on the honeypot machine. You can go in two directions with a web server; either run an old version of the HTTP daemon itself that has known vulnerabilities or run a current version and then run a vulnerable web application such as an older version of Wordpress or phpMyAdmin on it.

You can just try running services and hoping that they are vulnerable and that worms are trying to exploit them but it might be more effective to look up the services that specific worms target and run those.

The other direction to solve this problem from is to enable logging on your ingress point and see what traffic is hitting you. I suspect you will see a lot of traffic on the ports I mentioned above but you will probably see traffic on other ports as well. Find out what the ports are used for an run that service on your machine.

There are a few things I would add to this regarding honeypots:

The purpose of a honeypot is to study what the attacker or worm does once it compromises a host. You will want to set up extensive monitoring and logging on the box itself so that you actually gain some useful information out of the exercise. It's also important that you know when you have been compromised. Most honeypots are run inside virtual machines in order to give you an easy way to compare the current state of the machine to a known good copy. It is not adequate to do this from within the honeypot because rootkits can modify the very tools you are using to do the comparison.

You will want to be monitoring all traffic to and from the honeypot machine. By this, I mean full packet captures. The normal way to do this is with a spanning port on your switch but it can probably be done in the hypervisor of the VM if your switch doesn't have that capability. You would normally not do it within the honeypot.

You said that you are aware of the dangers of running your honeypot inside your home network. I presume that means you're also aware of the precautions you will have to take before putting it online. Specifically, configuring your network and firewall so that the honeypot machine can't contact any of the rest of your local network. It's also good practice to be careful about which outbound connections you allow it to initiate to the internet. The first thing it will often try to do is to download a rootkit and the worker programs which you are probably interested in, however the next thing is often to start attacking more targets, and this is not something you would normally want to allow.

There also exist specific tools for creating honeypots. These tools include entire hypervisor and VM stacks that enable all the things I have mentioned above. On the same site you can find tools for logging, monitoring and analysing and also a load of information on how to run a honeypot and who you're likely to see attacking it.

Answer 2

What you created is a high-interaction honeypot, ie a live system waiting to be compromised and later analysed by a foresics investigator (that being you of course). I would start with a linux-based, low-interaction honeypot. It creates a virtual filesystem and fake services that can make attackers (or their automated tool) believe this is a "real" system, while you'll just run a honeypot service. A very easy tool to setup and catch probes is Kippo, a SSH honeypot. I have been developing a visualization tool for it as well that might be of interest to you (and of course you'll get a nice presentation of your data). Another well-known low-interaction honeypot is honeyd, but it's a bit more difficult to set up, depending on what you intend to do of course (honeyd can simulate an entire network architecture with routers, servers, workstations, etc).

Answer 3

While most of those answers are correct, I feel like they are missing some bits of info.

First I'd like to clarify that it depend on the type of Honeypot you are installing, then it decides if you want to install extensive monitoring or not as with Low-Interaction Honeypot, you don't want to do any extensive configuration in general. but if you are using High-Interaction or Physical Honeypot with its own IP which is mostly used in Research category.

This means that whatever you designate as a honeypot, it is your expectation and goal to have the system probed, attacked, and potentially exploited, Honeybot works by opening over 1000 UDP and TCP listening sockets on your computer and these sockets are designed to mimic vulnerable services. Also its a detection and response tool, rather than prevention which it has a little value in.

Depend on the software you are using most of them are with email and notification alerts. like honyed, mantrap, honeynets. Which is all better deployed over firewalls.

One more thing to keep in mind, Honeypots are worthless if they are not attacked, if you are as mentioned will or want to capture Full packets, this means you are as well giving a skilled attacker opportunity to hijack your honeypot. And if If an attacker manages to compromise one of your honeypots, he could try to attack other systems that are not under your control. These systems can be located anywhere in the Internet, and the attacker could use your honeypot as a stepping stone to attack sensitive systems.