Deception Technology

Honeypots, honeynets, decoys, and deception-based detection.

Overview

Deception technology lures attackers into traps.

Deception Types

Honeypot Implementation

# Simple SSH honeypot
from twisted.conch import ssh, avatar
from twisted.conch.ssh import factory

class HoneypotSSH(avatar.ConchUser):
    def __init__(self, username):
        avatar.ConchUser.__init__(self)
        self.username = username
        
    def login(self, credentials):
        # Log credentials
        log_attempt(self.username, credentials.password)
        
        # Fake response
        return {"success": True, "shell": FakeShell()}

Honeynet Architecture

┌─────────────────────────────────────┐
│           Honeynet                  │
├─────────────────────────────────────┤
│  Web Server  │  Database  │  Mail   │
│  (honeypot)  │ (honeypot) │(honeypot)│
├─────────────────────────────────────┤
│           Monitoring                │
│  (IDS, logging, alerting)           │
└─────────────────────────────────────┘

Honeytokens

# Create honeytoken
def create_honeytoken():
    return {
        "username": "admin_backup",
        "password": generate_weak_password(),
        "email": "admin_backup@example.com"
    }

# Monitor for use
def monitor_honeytoken(token):
    if check_login_attempt(token.username):
        alert("Honeypot triggered!")
        capture_attacker_info()

Detection Value

Best Practices

1. Realistic decoys — Match environment
2. Strategic placement — High-value locations
3. Comprehensive monitoring — All interactions
4. Quick response — Immediate alerting
5. Regular updates — Keep decoys fresh

Practice

Deploy a honeypot network to detect unauthorized access.