Cybersecurity 101 — What is a Honeypot?
Tags: Programming, Hacking, Cybersecurity, Web Development

In Cyber Security there exist a terminology called Honeypot. A Honeypot is a computer system which act as a trap/decoy for Hackers as it mimics a legitimate computer system with potential vulnerabilities. The purpose of such is to detect and record intrusion attempts to gain information about the attacker and the threats currently present towards a given technology stack. Besides harvesting information about Hackers, a Honeypot can also be used to distract potential attackers from other targets of more value.

This story is also available in video format on the Vinsloev Academy YT channel: https://youtu.be/7Hftbep1xGY

There exist different types of Honeypots which can be used to identify different types of threats and they do all have certain pros and cons based on the needs set by the owner/operator of a Honeypot. In most cases a Honeypot should however not be used as way to address a specific problem but as a way to gather information which can help one understand current threats towards an application or business.

As the threats and behavior of potential attackers gets logged and analyzed, defensive measures can be taken within the business application to mitigate attacks discovered through the Honeypot.

One might say that the information and malicious user activity could also be taken from the real application logs as Hackers will also be trying to intrude every aspect of that system. The key feature about a Honeypot is however that the creator can control what kind of vulnerabilities to include and thereby customize the honeypot to become an attractive target. Besides this the logs of a Honeypot will not contain “real” user activities which could potential cover the behavior of an attacker due to information overload when analysing the traffic going in and out of the system.

Monitoring Traffic

By monitoring Network traffic coming into the Honeypot one can assess the following information among others:

What application layer is of interest?

What data is of interest?

What is the origin of the attacker? (Proxies, VPN and other techniques can be used to hide this so do not always take such information as the abosulte truth)

Which tools is most likely used to perform the attack?

Depending on what kind of information one which to monitor a choice between the following definitions has to be made.

Low-Interacting Honeypots

A Low-interacting honeypot only collect basic information about the type of threats being present. They are easy and quick to set up and uses fewer resources than a High-Interacting Honeypot. A Low-interacting honeypot will therefore in most cases not have attached a database or complex processes which can stimulate a potential attacker to stay for longer and thereby try a wide range of attack approaches.

High-Interacting Honeypots

Compared to a Low-Interacting honeypot this type is far more complex, take more time to set up and uses way more resources. A high-Interacting honeypot should try to mimic a real system as much as possible and should therefore contain the right balance between secure aspects and vulnabilities that will force an attacker to try a wide range of attacks. This will enable the owner/operator to get wider view of the threat environment being present towards the technology stack used within the Honeypot.

As a last note it’s important to mention that the threat environment created by one or more Honeypots do not represent all possible threats towards a given system. The amount of information collected has a direct correlation to the activity directed at the Honeypot. You should therefore never assume that a given threat does not exists, just because it haven't been tried by one or more attackers.