ddiinn2

There are two main advancements beyond "classic" honeypots:

1. Honeypots are easy to fingerprint (see our blackhat talk, https://www.youtube.com/watch?v=Pjvr25lMKSY )

2. Most honeypots just "sit on the network", waiting to be scanned. By using breadcrumbs (AKA honeytokens) as part of deception stories you're actively hunting the attackers in the network, by influencing their decision process.

Any questions, we'd be happy to answer

The trick is to make the breadcrumbs the type of data that an attacker is interested in, but a regular user will never be aware of.

For example in windows there is a cache of used credentials along with passwords, it is a known infection spreading technique to read that of an infected machine and use t across the network.

A breadcrumb would put a decoy's credentials in that cache. Thereby never doing any side effect to the user and definitively flag attackers by looking at any usage of those credentials.

Like was said before, you have to attack the decoy to recognize it and that enables catching the attack traffic. Also the mere fact that they recount every single action 10 times over before acting is a huge value in and of itself.

On another note I agree that they will try and we will be constantly remembering that fact :)

When you get one alert that you realize isn't false and has the forensic data tied to it, you can use it as a harness against the loads of information from all the other sensors (firewall, endpoints, sandboxes etc) to give you a definitive picture you're certain in.

- What is alerted on (or "attack") is configurable and can range from code being executed (which is the true positive alert) to connecting to ports(which has more noise)

- It needs to look like the machine an attacker will be after when he's looking around on the network and that's much simpler then a whole loaded up environment.

- Yes, the decoys look like an integral part of the network

- It could be within every segment of the network and not in it's own island. But it's true that every security solution depends on it's management interface not being compromised :)

Each decoy is configured to look exactly the way that makes sense for the network it's in. An example is a git server with interesting code or an employees pc that shares files that are crafted to draw attackers to that decoy. The decoys themselves can be placed within the customers network or hosted in the cloud by us.

The real trick is "breadcrumbs" which is specific data/files that you can place on the real machines that directs the attackers towards the decoys.

Hi, dean here (Cymmetria CTO). Two great questions:

1. The concept being that from looking at the machine on the network we don't do anything different then regular machines, so the goal is to prevent fingerprinting.

2. If the attacker actually attacks the decoy then we are able to capture what that attack looks like, send it to threat management while it's happening and mitigate. At that point if the attacker has found out it's too late. When Attackers will have our systems installed in his labs he'll have to find some way of identifying our machines without attacking them and that's what we've been developing to prevent.