Honeypot Detection

A honeypot is a security mechanism that is deployed to counterattack and trap attackers. Honeypots lure attackers into performing malicious activities, and this attack information provides insights into the level and type of threats a network infrastructure can face. As an attacker, determining whether the target system is a legitimate one or a honeypot is essential to compromise the network without being detected. Identifying and defeating these honeypot establishments stealthily is the fundamental task of a professional hacker. Below are some techniques used to identify, detect, and defeat various honeypot infrastructures:

Detecting the Presence of layer-7 Tar Pits

• Tar pit
• Layer 7 tar pits react slowly to incoming SMTP commands by attackers/spammers.Attackers can identify these tar pits by analyzing the Latency of the response from the service.

Detecting the Presence of Layer 4 Tar Pits

• Layer 4 tar pits manipulate the TCP/IP stack and are effectively employed to slow down the spreading of worms, backdoors, etc.
• These tar pits accept incoming TCP/IP connections and then switch to a zero-window size, blocking the attacker from sending further data. The connection cannot be terminated by the attacker since no data is transferred to the target machine.
• Layer 4 tar pits such as Labrea can be identified by analyzing the TCP - Window Size, where the tar pit continuously acknowledges incoming packets, even though the TCP window size is reduced to zero.

Detecting the Presence of Layer 2 Tar Pits

• Layer 2 tar pits are used to block network penetration when an attacker gains access to the network and to prevent internal threats.
• The attacker can detect the presence of these tar pits by observing the responses with a unique MAC address 00:00:0F:FF:FF:FF, which acts as a black hole. Analyzing ARP responses can also help identify these tar pits.

Detecting Honeypots Running on VMware

• VMware is a virtual machine platform that allows multiple OS instances to run simultaneously.
• Attackers can identify instances running on VMware by analyzing the MAC address and comparing it with the IEEE standards for MAC address ranges assigned to VMware Inc.

Detecting the Presence of Honeyd Honeypot

• Honeyd is a widely used honeypot daemon that creates thousands of honeypots easily.
• Attackers can identify the presence of a Honeyd honeypot by performing time-based TCP fingerprinting methods (SYN proxy behavior).
• A comparison of responses to a SYN request from a normal computer versus a Honeyd honeypot can reveal the presence of a honeypot.

Detecting the Presence of User-Mode Linux (UML) Honeypot

• User-Mode Linux (UML) is open-source software used to create virtual machines and deploy honeypots.
• Attackers can identify UML honeypots by analyzing files like /proc/mounts, /proc/interrupts, and /proc/cmdline, which contain UML-specific information.

Detecting the Presence of Snort_inline Honeypot

• Snort_inline is a modified version of Snort IDS capable of packet manipulation, mainly used in GenII honeynets to block known attacks.
• Attackers can identify Snort_inline honeypots by analyzing the outgoing packets. If a packet is dropped, it might appear like a black hole to the attacker. Modified packets can also be detected by capturing them through another host system.

Detecting the Presence of Fake AP

• Fake access points create fake 802.11b beacon frames with randomly generated ESSID and BSSID (MAC address) assignments.
• Fake APs only send beacon frames but do not produce any fake traffic. Attackers can monitor network traffic to quickly detect the presence of fake APs.

Detecting the Presence of Bait and Switch Honeypots

• Bait and switch honeypots actively participate in security mechanisms, redirecting malicious network traffic to a honeypot after detecting intrusion attempts.
• An attacker can identify the presence of such honeypots by analyzing specific TCP/IP parameters, such as Round-Trip Time (RTT), Time To Live (TTL), and TCP timestamp.

Tools

Attackers use honeypot detection tools such as Send-Safe Honeypot Hunter and SniffingBear to detect honeypots in the target organizational networks.