Broadband Tech > Security > Security > question about honeypots

question about honeypots

I believe you would want to start with the premise of why you want to deploy the honeypot. I could see it being a decent paper. What level of school?

for the University, and it has to be some kind of comparison, i could go with low vs high interaction honeypots but would like to do wired vs wireless. The only thing is if i'll be able to compare it. Could i compare based on deception methods, purpose, installation, configuration, ? will there be enough differences to compare ?

I believe you would start with why the honeypots are being deployed as honeypots in general can be a controversial item with the IA community. What do you wish to gain from it? You don't just deploy a honeypot just to have one.

Then what kind of honeypot are we talking about? A system/device that is providing computing services or just an open access point?

*Edit for spelling.

I am studying Information Security, and need to do a project, the gain would be a comparison paper on wired vs wireless honeypot technology. I've seen a lot of papers about honeypots but nothing on this type of comparison. Then i would like to do some simple tests on those 2 honeypots technologies and how they react to it (in virtual environment) ex. scanning simple attack methods.

I am asking about this cause im not sure if that cold be a successful project. ?

btw Thank u so much for ur reply

Its like comparing oranges and grapefruits.

.. which, of course, is a useful thing to do if you're writing something about citrus crops.

(i.e., I don't think the OP's premise is invalid per se)

reply to peterca
I'm not a honeypot expert, but it seems that some attack vectors and methods would vary from wired infrastructure. For example, attacks against WPA-2, RADIUS, injecting certificates, MITM, etc. when connecting wirelessly would be possibilities.

I recall seeing a honeynet paper on the subject of wireless honeyspots, found it -

»honeynet.org.es/papers/honeyspot···1217.pdf

It may give you some ideas - or raise questions that you might answer in your project.

You might also contact Lance Spitzner at honeynet.org and see what he thinks about doing such a project.

SANS.org's reading room may also be helpful.

reply to dave
Nor do I but to compare an open access point as a honeypot to a specific services running on Honeyd might be more work. Now if you are looking at running Honeyd on a wired network vs behind an open access point that may be different.

Typically when you deploy a honeypot you're looking to watch traffic to tune H/NIDSs or firewalls. To this end I believe a statement to frame the paper on why the honeypot is being deployed (and I believe both would need to be deployed under the same reasons) would be required prior to talking about configuration and such as the configuration would need to be validated against the reason it's there to begin with.

reply to AVD

Thank u all for help

I had a chat with Lance Spitzner and according to him it is a good idea since there is a lot of research being done in field of mobile/wireless honeypots.

If you guys have any good comparison points for me I would really appreciated that

thx again

why can't you put a honeypot on a internet connect WAN with a wireless AP connected to it? then you get the pros on both.