Sep 17-23 Update

Define project goals -
The goal is to design and implement HONEYNET in the CSUS RVR 2003 lab, to simulate an attack in the honeynet and be able to capture data (potentially an attack signature).
Outline of Methodology:
There are 4 phases in the design of Honeynet -
1) Data control is the containment of activity. There should be a balance between how much freedom an attacker can be given versus how much restriction provided to them.
2) Data capture collects the data about the user activities and motivation.
3) Data encryption & decryption - A large portion of attacker activity happens over encrypted channels such as IPSec, SSH, SSL, etc. Data Capture mechanisms must take encryption into consideration.
4) Data analysis - Read the collected data and analyze the data to know about the hacker’s actions.
Possible Extensions -
1) Automatic isolation of compromised systems https://www.auto.tuwien.ac.at/Workshops/dimva05/materials/riebach.pdf
2) Deceptive honeypots coupled with appropriate intrusion detection systems and firewalls may provide a means for providing much need forward intelligence about attackers and give defenders an increased reaction and countermeasure time window. http://www.infosecwriters.com/text_resources/pdf/Gupta_Honeynets.pdf
Honeynet Basics -
1) A honeypot is a security resource who's value lies in being probed, attacked, or compromised. Unlike firewalls or IDS sensors, honeypots are something you want the bad guys to interact with.
2) A honeypot is a security resource who's value lies in being probed, attacked, or compromised. Unlike firewalls or IDS sensors, honeypots are something you want the bad guys to interact with.
3) Low-Interaction honeypots
emulates operating systems and services.
Easy to install and deploy.
Usually requires simply installing and configuring software on a computer.
Minimal risk, as the emulated services control what attackers can and cannot do.
Captures limited amounts of information, mainly transactional data and some limited interaction.
4) High-Interaction Honeypots
No emulation, real operating systems and services are provided.
Can capture far more information, including new tools, communications, or attacker keystrokes.
Can be complex to install or deploy (commercial versions tend to be much simpler).
Increased risk, as attackers are provided real operating systems to interact
5) One Example of Low-interaction honeypot is Honeyd.
One Example of High-interaction honeypot is Honeynets.
6) Honeynets are entire networks of systems designed to be compromised. Honeynets are the most complex of honeypot solutions and have the greatest risk. However, they can also capture the most information of any honeypot. Honeynets are entire networks or real systems designed to be compromised.
http://tracking-hackers.evilcoder.org/solutions/
7) Honeynets are not a product, they are not a software solution that you install on a computer. Instead, Honeyents are an architecture, an entire network of computers designed to attacked. The idea is to have an architecture that creates a highly controlled network, one where all activity is controlled and captured. Within this network we place our intended victims, real computers running real applications. The bad guys find, attack, and break into these systems on their own initiative. When they do, they do not realize they are within a Honeynet. All of their activity, from encrypted SSH sessions to emails and files uploads, are captured without them knowing it. This is done by inserting kernel modules on the victim systems that capture all of the attacker's actions. At the same time, the Honeynet controls the attacker's activity. Honeynets do this using a Honeywall gateway. This gateway allows inbound traffic to the victim systems, but controls the outbound traffic using intrusion prevention technologies. This gives the attacker the flexibility to interact with the victim systems, but prevents the attacker from harming other non-Honeynet computers.
http://tracking-hackers.evilcoder.org/papers/honeypots.html
Advantages of Honeypots -
Small data sets:
Honeypots collect small amount of data, but almost all of this data is real attacks or unauthorized activity. Instead of dealing with 5,000 alerts and 10GB of logs every day, you may only get 30 alerts with your honeypots and 1MB of logs every day. Since honeypots collect only malicious activity, it makes it much easier to analyze and react to the information they collect.
Reduced false positives:
With most detection technologies (such as IDS sensors) a large percentage of your alerts are false warnings, making it very difficult to figure out what is a real attack. With honepyots, almost everything you detect or capture is an attack or unauthorized activity, vastly reducing false positives.
False negatives:
Unlike most technologies, its very easy for honeypots to detect and records attacks or behavior never seen before in the wild.
Cost effective: Honeypots only interact with malicious activity, you do not need high performance resources. Most honeypots can easily run on an old Pentium computer with 128 MB of Ram.
Simplicity:
Honeypots are very simple, there are no advance algorithims to develop, nor any rulebases to maintain.
http://tracking-hackers.evilcoder.org/misc/faq.html#faq1
Disadvantages of Honeypots -
Limited View:
Honeypots only see activity that interacts with them. They do not see nor capture any attacks directed against existing systems.
Risk:
Anytime you add another resource with an IP stack, you introduce risk. While different honeypots have different levels of risk, this is always an issues you must address.
http://tracking-hackers.evilcoder.org/misc/faq.html#faq1