42. Evading IDS, Firewalls and Honeypots – Detection Games
42.6 Honeypots and Honeynets – Deception, Ethics, Alerts
Honeypot = system (or service) whose only job is to be touched by someone who should not be there. Honeynet = a small fake network. Low-interaction (Cowrie-class SSH/Telnet emulator: fake shell, log passwords tried) vs high-interaction (full VM – more intel, more risk if it becomes a jump host).
Blue win: first Cowrie login attempt = high-confidence hostile. Tune SIEM to page Shahrukh (fictional SOC) immediately. Do not "play" with the attacker or hack-back.
Ethics / law (lakshat theva):
- Own lab / own company net with written policy = OK teaching tool
- Random internet honeypot that stores attacker PII without a privacy plan = messy
- Using a honeypot to attack the scanner = illegal + stupid
- Production: isolate (no route to real Raja-Rani billing DB), gold-image, extra logging, legal review
Cowrie concept (install optional, Ubuntu-friendly; Amazon Linux may need extra packages): listen on lab SSH port other than your real SSH (e.g. real SSH stays 22 on management IP; Cowrie on a dummy NIC / port). Goal = read Cowrie logs, not to fingerprint Cowrie so Red can skip it.
| Red team (attacker) does | Blue team (defender) detects / stops |
|---|---|
| Banner-grabs then skips known honeypot fingerprints | Still alert on the grab; rotate banners; don't publish lab banners |
| Uses honeypot as pivot if high-interaction is sloppy | VLAN isolate; no credentials to real AD; snapshot + revert |
| Brute-forces fake SSH (Cowrie) | Alert on first try; feed IPs to firewalld drop (with review) |
Ravindra Bagale's Tip
Students install Cowrie on a production jumphost "for fun". If a Red actor breaks out, their shell = your LAN. Isolate it or don't deploy it. Interview: "Honeypot is a detection control, not a toy." Now let's move on.
Ravindra Bagale's Tip – मराठी
Students production jumphost वर Cowrie लावून "fun" करतात. Red बाहेर निसटला तर त्याचा shell = your LAN. Isolate करा नाहीतर deploy करू नका. Interview: "Honeypot is a detection control, not a toy." आता पुढे जाऊया.
Ravindra Bagale's Tip – हिंदी
Students production jumphost पर Cowrie लगाकर "fun" करते हैं. Red बाहर निकल गया तो उसका shell = your LAN. Isolate करो या deploy मत करो. Interview: "Honeypot is a detection control, not a toy." अब आगे चलते हैं.
Lab
Design-only (if you skip install): draw Sahyadri Pune lab – real Metasploitable .20, real Blue .40, fake SSH honeypot .50. Write 5 firewalld facts: who can route where. Optional: install Cowrie on a throwaway Ubuntu VM (docs: cowrie.readthedocs.io); from Kali ssh fakeuser@192.168.56.50 once; screenshot Cowrie log line. Revert snapshot.