9

Just finished reading "Honeypot on home network to help me learn", and the top-voted/selected answer that suggest deploying a honeypot to the cloud, but the answer does not say how to do it; also, read all the other answers too, and none appear to state how to do this.

I'm interested in knowing how to do this, and more importantly the possible legal issues that might arise from using a cloud based deployment.

I can imagine doing a build on a service like linode which allows you to do system builds from a web-based interface, but this sounds to me to present legal issues that might rapidly grow out of control; though this is in part, because I've never thought about deploying a honeypot to the cloud.

I'm able to think of a number of legal issues and methods of operation, but that's just me guessing, and I'd rather see answers to the question.

UPDATE 1: Here's a case study, "Building Cloud Based Honeypots and Intrusion Detection Systems" - though the build based on my reading of it is only using the cloud to store and process results from honeypots that are not in the cloud.

UPDATE 2: Here's one person's view on Honeypots: Are They Illegal? - any additional information, or issues noticed within this some what dated article, are still requested. NOTE: This article originally appeared on SecurityFocus.com and was dated "2003-06-12", though Symantec is redirecting the article to this page which dates the article as "2010-11-02".

DISCLAIMER: If you are looking for definitive legal answers, as always seek the advice of a legal professional, there is no legal advice represented via this question, possible answers, or 3rd party information referenced.

Community
  • 1
blunders
  • 5,052
  • 4
  • 28
  • 45

1 Answers1

3

Design a machine image that is capable of running a virtual server inside of it. Your domain image is there to provide security and monitoring. Primarily, it is needed to keep anything sufficiently ugly from flowing OUT of your honeypot. Also, packet captures!

Stick the honeypot inside it, and you can turn them on and off at your heart's content.

Legal issues? At the base of it, you have taken reasonable steps to prevent your machine from doing damage, but somebody beat you on it. I know of no cases where somebody is found liable for an infected machine before. If you're particularly concerned beyond that, I offer the following two options:

  • Get a lawyer.
  • Get a gift card with cash and use TOR.
Jeff Ferland
  • 38,090
  • 9
  • 93
  • 171