Slashdot Log In
The BBC's Honeypot PC
Posted by
kdawson
on Mon Oct 09, 2006 11:48 AM
from the hijack-my-pc-please dept.
from the hijack-my-pc-please dept.
Alex Pontin writes, "This article from the BBC shows how vulnerable XP Home really is. Using a highly protected XP Pro machine running VMWare, the BBC hosted an unprotected XP Home system to simulate what an 'average' home PC faces when connected to the internet." From the article: "Seven hours of attacks: 36 warnings that pop-up via Windows Messenger. 11 separate visits by Blaster worm. 3 separate attacks by Slammer worm. 1 attack aimed at Microsoft IIS Server. 2-3 "port scans" seeking weak spots in Windows software." The machine was attacked within seconds of being connected to the Internet, and at no time did more than 15 minutes elapse between attacks.
Related Stories
[+]
Fun Things To Do With Your Honeypot System 136 comments
An anonymous reader writes "Whitedust is running an interesting article on honeypots and their uses. From the article: 'Most papers deal with the potential gains a honeypot can give you, and the proper way to monitor a honeypot. Not very many of them deal with the honeypots themselves... Honeypots can be used to ensnare and beguile potential hackers; entice them to give you more research information, and actively defend your production network."" From the article: "Once an attacker has taken all the trouble to set up shop on your honeypot, he'll probably want to see what else there is to play with. If your honeypot is like most traditional honeypots, there's not much for an attacker to do once he gets in. What you really want if for the attacker to transfer down all the other toys in his arsenal so you can have a copy as well. Giving an attacker additional targets with various operating systems and services can help him decide to give you his toys. The targets can be real, but you'll get almost as much mileage if they're simulated. A good place to start is to put a phantom private network up hung off the back of the honeypot."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Well Duh! (Score:3, Insightful)
Re:Well Duh! (Score:4, Insightful)
It's still a HUGE problem. So, maybe it's a no-brainer for you, but it isn't for the average user.
Parent
Indeed, AC (Score:5, Insightful)
The point is that they are too late - they're perfectly likely to get hit before update can protect them, and perfectly likely to get hit with something as bad as what they had before.
This really is a problem.
Parent
Re: (Score:3, Informative)
Even something as basic as NAT through a cheapie router will buy them all the time they need to connect to windows update.
It won't protect them from malicious connections once infected but because most all routers ignore incoming connection attempts the user is at least protected till patched (assuming the first thing they do is Windows Update, not pr0n surf).
-nB
Re:Indeed, AC (Score:4, Insightful)
Parent
Re: (Score:3, Interesting)
Yet when the same people are handed computer components and manuals that they don't understand, they somehow think that they CAN assemble it themsleves. That is where the problem lies...
"Why can't the average user go into a shop, buy a computer, bring it home and expect it to work -
Re: (Score:3, Funny)
I'm happy to report it was, and only 20% of Windows users used "password" as their password, making it only the third-most-popular password. The two most popular ones were "qwerty" and "12345", in that order. The least popular password, with just one example, was "i heart bill gates" - on Steve "the Chair-man" Balmer's box.
Re:Well Duh! (Score:5, Insightful)
The thing they've tried to do here is to accurately simulate what the average home user will do, and see what the consequences would be.
It's like a 17 year old nude virgin visiting the octoberfest and expecting to come away 'unscathed', I give you that much. But anybody that buys one of those HP internet ready pc's with XP pre-installed that goes home and plugs in his / her machine is doing the exact same thing.
The instructions even tell you to connect all that stuff *before* switching on in simple-to-use IKEA style no words diagrams. Don't be too quick to judge the beeb, they're pretty good at what they do.
Parent
Re: (Score:3, Insightful)
But honestly, I highly doubt many of the buyers of consumer grade hardware h
Re:Well Duh! (Score:5, Informative)
Parent
Re: (Score:3, Informative)
Re: (Score:3, Interesting)
Microsoft should really ship with all IP addresses except update.microsoft.com redirected to localhost, until you complete all critical updates.
It will never happen, but it should.
Re: (Score:3, Insightful)
Re: (Score:3, Funny)
And the moral of the story is. (Score:3, Informative)
Of course, we all knew this already, didn't we? The results weren't suprising to me and I doubt that any of the regular /. crowd would be either. Yes, I mean you.
Re:And the moral of the story is. (Score:4, Insightful)
Parent
Re: (Score:2)
Re: (Score:3, Insightful)
better question... (Score:3, Interesting)
Re: (Score:2)
Re: (Score:2)
pick any two.
Re: (Score:3, Insightful)
I do believe that the default should be for the MS firewall to be on after installation, that would have saved problems for MANY inexperienced users whose windows boxes ended up getting owned within minutes of them connecting them to the internet. The MS firewall definitely seems to be light, nimble, and does a decent job but for users like me who prefer to use a software firewall that is more customizable (I like Kerio Personal
Re: (Score:3, Insightful)
Sure, the user could turn it off, but-- guess what?-- it's THEIR COMPUTER. You can turn off the firewall on your Linux or OS X machine, also. That said, Windows XP SP2 will make your life a pain in the ass if you do run it with no firewall. There are constant system tray messages reading "your system is at
Impressing (Score:5, Insightful)
I set up a friend's new computer and installed a firewall, before attaching to to internet for the first time and he was stunned how fast the log of probes filled up. He'd never used a firewall before on his old XP machine.
What bugs me is why there doesn't seem to be any decent coordinated effort to track the bots down and shut them down and to go after the perpetrators. Really, it doesn't seem that hard, it just seems like no government is interested in doing anything about it.
Re:It IS hard (Score:4, Interesting)
Subsidize the creation of some decent anti-virus and service companies that can clean your computer remotely (Just don't build one nuke, that should take care of funding it for a few years)
Of course we can't take these steps proactively, humans are too short-sighted, but we WILL do something like this reactively, It's going to happen--just a matter of time.
Parent
Yawn... (Score:4, Informative)
Their 'unprotected'=flawed (Score:4, Informative)
I can attest (I'm sure many can) to how fast an unpatched XP machine gets hit. I have an installation disc from 2002 (sp1). When I use it I install with the ethernet cable unplugged. After install I plug in the ethernet and go straight away to Windows update but still, on the last go, within 5 minutes I got a somewhat obviously (to me) fake and malicious pop-up telling me I'd better click on it to protect my computer.
Re: (Score:3, Insightful)
You're obviously confused by the definition of "average home PC". The "average" home PC us
Re: (Score:3, Insightful)
What part of "The machine was attacked within seconds of being connected to the Internet," did you not understand?
How quickly can you apply the latest service pack and all the patches to your fresh installation of Windows?
Over 2 years ago, I was hearing from several people that experienced exactly that... They were incredibly frustrated that their freshly-installed systems were being compro
Slammer? Blaster? (Score:2)
Many of these attacks were by worms such as SQL.Slammer and MS.Blaster both of which first appeared in 2003.
...
The BBC honeypot was a standard PC running Windows XP Pro that was made as secure as possible.
Wouldn't that include all patches that would specifically protect against Slammer and Blaster? Note, the article says "such as", not "similar to".
Re: (Score:3, Informative)
Sorry but... (Score:3, Insightful)
So okay- a naked machine may have an issue but this is really a non-issue if you spend an extra 20 bucks for an inexpensive router with a built in firewall.
Yes but... (Score:2, Funny)
How vulnerable Windows XP really is? (Score:2, Insightful)
I like to bash MS as much as most people here, but this choice of words really misleading. True, never ever put an unpatched box un the Internet, especially if
Not just Windows (Score:5, Insightful)
The difference is with windows you will probably get hacked, with linux you at least have a fighting chance.
Re:Not just Windows (Score:4, Interesting)
Yes.
I gaurantee you are getting more than 1000 attempted logins per day.
Uh, no. On the occasional day I get a sustained attempt to guess a username/password combo, and such an attempt may well get up to 1,000 attempts, but in the last 4 days' log (all I keep), I don't see any such attempt. There were a couple of attempts on my FTP server, but it looks like the attacker closed the connection as soon as they saw the welcome banner; scanning for a particular server/version in the connection report, I guess.
Parent
A Premium of Paying Vicitms (Score:4, Insightful)
Even if you're a master of Microsoft "anti-ware" solutions and tweaks, what happens when someone who isn't takes a few wrong turns with their OS? It's toast, or worse, enslaved and used as a resource the end-user is paying for.
I stopped using Microsoft operating systems to directly connect to the Internet nearly 10 years ago, when the sophistication of the exploits had developed to the point where it was no longer safe to use any Microsoft OS online. Since then it really hasn't gotten much better, has it?
I think it's a shame that the company with the fattest pockets can't be bothered to get it right yet still demands to be on every PC made.
Re: (Score:3, Interesting)
Agreed, all old OS's are weak somewhere. But what happens to grandma when her doting son hands her his old boxen with XP with expired "Anti-" ware on it? Grandma entertains keyloggers with insights into the wicked subterfuge of bridge groups, quilting, what happened at the store checkout queue, or just how awful the last family gathering was; and all the while her machine is merrily testing basic-auth at a pornsite somewhere while she wonders why everything s
C'mon, I hate MS but this is FUD (Score:3, Informative)
Of COURSE you get plastered with portscans and worms hammering against the "well known" ports. That's normal. Welcome to real life on the 'net. You think it's different for my *nix Machine? It's not. My firewall-log is getting flooded with kids and worms trying to find some unprotected ports, trying to connect to 21, 22, 23, 80 and so on, just to see if there's anything running they could use. The real question is, how many successful attacks did happen? Saying XP is insecure because a billion people hammered at its doors is FUD. When a million of those make it in, though, it's a different matter.
And yes, an unpatched WinXP is insecure. It simply is. Get a router and you're set against 99% of the external problems you may face. But then you still should not use the machine to access anything on the net, because some of the tools you're using (IE and Office being the two key players today) has known (and party unpatched) security issues that may cause execution of code when you're not really careful and know what you're doing.
In a nutshell, going online with a MS product that's not well firewalled and using anything but alternative software for the access of online resources is grossly negligent IMO.
Nice Fearmongering (Score:3, Informative)
Dude, it's 2003, they want their security holes back.
I'm not going to mince words: This story is BS. Lets take the money quote here:
Really? Once an hour, something that'll remotely own XPSP2, just being leaked out over the Internet?
OK, Windows Messenger service is disabled in XPSP2...Blaster hasn't worked in years, Slammer never even hit XP Home by default (you had to install Visio), IIS isn't even available for XP Home, and port scans aren't too relevant when you have a firewall on by default.
What a completely worthless story. You know, we have enough actual security problems going on (the glacier of cross site scripting exploits, what's going on in the online banking realm) that whinging about long solved problems is not only irresponsible; it's dangerous.
I call BS (Score:3, Informative)
I Wished all broadcasting corporations were as 'backwards' as the Beeb.
Re:We have a Love connection. (Score:4, Informative)
So you are simply wrong.
Parent
where are all the attacks coming from .. (Score:5, Insightful)
"we installed an unprotected version of Windows XP Home configured like any domestic PC."
"made apparent by the fact that the system was vulnerable to viruses that came out over 3 years ago", not already in use
But these three year old attacks were still coming from other already infected machines on the Internet. Are all these infected machines running three year old software.
was Re:I have plenty of reasons to dislike Microsoft..
Parent
Re:I have plenty of reasons to dislike Microsoft.. (Score:3, Insightful)
Re: (Score:3, Interesting)
Strictly, they said one (1) attack was for IIS.
Re: (Score:3, Interesting)
But the attacks would fail for a number of reasons. First and foremost because the attacks are targeted at Windows not Linux or OS X. Secondly OS X has a very capable built in Firewall thats always on. I can't speak for Linux because that will be up to the person who built it. Though my default Ubuntu 6.06 installation had no firewall enabled at install time, nor any option to configure or enable one before you get onto the internet and download the bits with synaptic.
where are all the attacks coming from .. (Score:3, Insightful)
The point is thet the Internet is infested with compromised Windows boxen. Ok, where are all the compromized Linux web servers. Assuming they are running Apache under Linux. According to Netcraft [netcraft.com] Apache usage is at roughly 980,00,000 while IIS is at 490,00,000. Why don't we see an equivalent number of compromised Linux servers.
Yet another mo
Re: (Score:3, Informative)
It's not showing how weak an unpatched XP machine is, they're instead logging the attacks that are still happening on the Internet daily, and then showing the frequency of them. For instance, they logged 11 attempts in 7 hours from the Blaster worm. If, as some people are suggesting, they were just placing an unpatched machine on the Internet, the machine would have restarted from the very first Blaster attack.
Re: (Score:3, Informative)
A lot of Windows machines get zombied pretty fast these days, by fascinating web security vulnerability hacks when the owners go web browsing even for legitimate materials and the hacks are installed on "owned" servers. These zombies then open up a port to designated controller machines on the outside for control by remote entities such as spammers using the machines to send the spam from unblocked netwrks. It's a seri
Re: (Score:3, Informative)