Re:Configuring a High Interactivity SSH HoneyPot
by robputt796 on Monday November 28, 2016 @06:05AM
(#13054692)
Not sure if this is a good idea or not, security by obscurity never really fools anyone in my opinion... Anyway I think that the HonSSH logs are not visible to the attacker, they are on the man in the middle node so hence the hacker doesn't get to see them, for the most part it looks very very similar to a legitimate SSH connection.
[ Parent
| on HN ]
Re:Configuring a High Interactivity SSH HoneyPot
by 010001001010 on Monday November 28, 2016 @06:58AM
(#13054851)
I'd agree this probably isn't a great idea,
-- it may attract unnecessary attention which would have not already been there.
If an attack is automated (where it may not consider the hostname at all) it will have no effect.
If it is a targeted attack, the attacker will most likely be well versed in the behaviour of default honeypots. As such if you're machine behaves differently (as it almost always will) the attacker will not be deterred. One example of this includes response time of a failed SSH login -- a HP might reply sub-seconds faster than a real system (especially true in industrial environments).