Slashdot Log In
The BBC's Honeypot PC
Posted by
kdawson
on Mon Oct 09, 2006 12:48 PM
from the hijack-my-pc-please dept.
from the hijack-my-pc-please dept.
Alex Pontin writes, "This article from the BBC shows how vulnerable XP Home really is. Using a highly protected XP Pro machine running VMWare, the BBC hosted an unprotected XP Home system to simulate what an 'average' home PC faces when connected to the internet." From the article: "Seven hours of attacks: 36 warnings that pop-up via Windows Messenger. 11 separate visits by Blaster worm. 3 separate attacks by Slammer worm. 1 attack aimed at Microsoft IIS Server. 2-3 "port scans" seeking weak spots in Windows software." The machine was attacked within seconds of being connected to the Internet, and at no time did more than 15 minutes elapse between attacks.
Related Stories
[+]
Fun Things To Do With Your Honeypot System 136 comments
An anonymous reader writes "Whitedust is running an interesting article on honeypots and their uses. From the article: 'Most papers deal with the potential gains a honeypot can give you, and the proper way to monitor a honeypot. Not very many of them deal with the honeypots themselves... Honeypots can be used to ensnare and beguile potential hackers; entice them to give you more research information, and actively defend your production network."" From the article: "Once an attacker has taken all the trouble to set up shop on your honeypot, he'll probably want to see what else there is to play with. If your honeypot is like most traditional honeypots, there's not much for an attacker to do once he gets in. What you really want if for the attacker to transfer down all the other toys in his arsenal so you can have a copy as well. Giving an attacker additional targets with various operating systems and services can help him decide to give you his toys. The targets can be real, but you'll get almost as much mileage if they're simulated. A good place to start is to put a phantom private network up hung off the back of the honeypot."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Well Duh! (Score:3, Insightful)
Re:Well Duh! (Score:4, Insightful)
It's still a HUGE problem. So, maybe it's a no-brainer for you, but it isn't for the average user.
Parent
Indeed, AC (Score:5, Insightful)
The point is that they are too late - they're perfectly likely to get hit before update can protect them, and perfectly likely to get hit with something as bad as what they had before.
This really is a problem.
Parent
Re:Indeed, AC (Score:4, Insightful)
Parent
Re:Well Duh! (Score:5, Insightful)
The thing they've tried to do here is to accurately simulate what the average home user will do, and see what the consequences would be.
It's like a 17 year old nude virgin visiting the octoberfest and expecting to come away 'unscathed', I give you that much. But anybody that buys one of those HP internet ready pc's with XP pre-installed that goes home and plugs in his / her machine is doing the exact same thing.
The instructions even tell you to connect all that stuff *before* switching on in simple-to-use IKEA style no words diagrams. Don't be too quick to judge the beeb, they're pretty good at what they do.
Parent
Re:Well Duh! (Score:5, Informative)
Parent
And the moral of the story is. (Score:3, Informative)
Of course, we all knew this already, didn't we? The results weren't suprising to me and I doubt that any of the regular /. crowd would be either. Yes, I mean you.
Re:And the moral of the story is. (Score:4, Insightful)
Parent
Re: (Score:3, Insightful)
better question... (Score:3, Interesting)
Re: (Score:3, Insightful)
I do believe that the default should be for the MS firewall to be on after installation, that would have saved problems for MANY inexperienced users whose windows boxes ended up getting owned within minutes of them connecting them to the internet. The MS firewall definitely seems to be light, nimble, and does a decent job but for users like me who prefer to use a software firewall that is more customizable (I like Kerio Personal
Impressing (Score:5, Insightful)
I set up a friend's new computer and installed a firewall, before attaching to to internet for the first time and he was stunned how fast the log of probes filled up. He'd never used a firewall before on his old XP machine.
What bugs me is why there doesn't seem to be any decent coordinated effort to track the bots down and shut them down and to go after the perpetrators. Really, it doesn't seem that hard, it just seems like no government is interested in doing anything about it.
Re:It IS hard (Score:4, Interesting)
Subsidize the creation of some decent anti-virus and service companies that can clean your computer remotely (Just don't build one nuke, that should take care of funding it for a few years)
Of course we can't take these steps proactively, humans are too short-sighted, but we WILL do something like this reactively, It's going to happen--just a matter of time.
Parent
Yawn... (Score:4, Informative)
Their 'unprotected'=flawed (Score:4, Informative)
I can attest (I'm sure many can) to how fast an unpatched XP machine gets hit. I have an installation disc from 2002 (sp1). When I use it I install with the ethernet cable unplugged. After install I plug in the ethernet and go straight away to Windows update but still, on the last go, within 5 minutes I got a somewhat obviously (to me) fake and malicious pop-up telling me I'd better click on it to protect my computer.
Re: (Score:3, Insightful)
You're obviously confused by the definition of "average home PC". The "average" home PC us
Sorry but... (Score:3, Insightful)
So okay- a naked machine may have an issue but this is really a non-issue if you spend an extra 20 bucks for an inexpensive router with a built in firewall.
Not just Windows (Score:5, Insightful)
The difference is with windows you will probably get hacked, with linux you at least have a fighting chance.
Re:Not just Windows (Score:4, Interesting)
Yes.
I gaurantee you are getting more than 1000 attempted logins per day.
Uh, no. On the occasional day I get a sustained attempt to guess a username/password combo, and such an attempt may well get up to 1,000 attempts, but in the last 4 days' log (all I keep), I don't see any such attempt. There were a couple of attempts on my FTP server, but it looks like the attacker closed the connection as soon as they saw the welcome banner; scanning for a particular server/version in the connection report, I guess.
Parent
A Premium of Paying Vicitms (Score:4, Insightful)
Even if you're a master of Microsoft "anti-ware" solutions and tweaks, what happens when someone who isn't takes a few wrong turns with their OS? It's toast, or worse, enslaved and used as a resource the end-user is paying for.
I stopped using Microsoft operating systems to directly connect to the Internet nearly 10 years ago, when the sophistication of the exploits had developed to the point where it was no longer safe to use any Microsoft OS online. Since then it really hasn't gotten much better, has it?
I think it's a shame that the company with the fattest pockets can't be bothered to get it right yet still demands to be on every PC made.
Re: (Score:3, Informative)
I call BS (Score:3, Informative)
I Wished all broadcasting corporations were as 'backwards' as the Beeb.
Re:We have a Love connection. (Score:4, Informative)
So you are simply wrong.
Parent
where are all the attacks coming from .. (Score:5, Insightful)
"we installed an unprotected version of Windows XP Home configured like any domestic PC."
"made apparent by the fact that the system was vulnerable to viruses that came out over 3 years ago", not already in use
But these three year old attacks were still coming from other already infected machines on the Internet. Are all these infected machines running three year old software.
was Re:I have plenty of reasons to dislike Microsoft..
Parent
Re:I have plenty of reasons to dislike Microsoft.. (Score:3, Insightful)