How to Mock a Bear: Honeypot, Honeynet, Honeywall & Honeytoken: A Survey Paul Lackner Institute of IT Security Research, St. Polten¨ University of Applied Sciences, Austria Keywords: Honeypot, Honeynet, Honeywall, Honeytoken, Survey. Abstract: In a digitized world even critical infrastructure relies on computers controlled via networks. Attacking these sensitive infrastructures is highly attractive for intruders, who are frequently a step ahead of defenders. Honey systems (honeypots, honeynets, honeywalls, and honeytoken) seek to counterbalance this situation. Honey systems trap attackers by generating phoney services, nets, or data, thereby preventing them from doing dam- age to production systems and enable defenders to study attackers without letting intruders initially notice. This paper provides an overview of existing technologies, their use cases, and pitfalls to bear in mind by illustrating various examples. Furthermore, it shows the recent efforts made in the field and examines the challenges that still need to be solved. 1 INTRODUCTION This paper is structured as follows: First, section 2 explains the differences between the honey tools. The Due to continuously improving endpoint protection following sections describe the properties of the dif- and network protection, attacks against computer sys- ferent honey tools and illustrate some use cases as tems are becoming more complex. Various new attack well as implementation considerations. Furthermore, vectors are found continuously and multiple system section 5 describes monitoring, detection and hiding components, hosts, and services in combination are methods followed by a standardised threat informa- necessary to successfully attack a system (Simmons tion exchange approach. Finally, legal aspects are de- et al., 2014) (Papp et al., 2015). Automated attacks scribed and a list of some implementations and hon- based in machine learning are increasing, which re- eypot tools finalises the paper. Further research that veals the need for adjusted defense methods (Bland needs to be done concludes the paper. et al., 2020) (Cui et al., 2020). To learn new tech- niques from attackers, honeypots are one of many tools to implement (Spitzner, 2002), especially in 2 TERMINOLOGY Supervisory Control and Data Acquisition (SCADA) networks, as there is little to no human interaction re- quired to manage the networks (Disso et al., 2013). Honeypots, honeynets, honeywalls, and honeytoken This survey paper offers an introduction to the all serve the same purpose, namely to detect intruders respective purposes of honeypots, honeynets, honey- and analyse their intrusive behaviour. No legitimate walls, and honeytokens and shows the benefits of im- user would ever access a honey system (Petrunic,´ plementing them. These four systems study attackers 2015), even a connection attempt is considered an at- by generating fake networks, hosts, services, and data. tack (Provos, 2003). The motivation to write this survey was to create Invented in the 1990s, a honeypot is the best a new collection of relevant literature and a structured known application of the honey systems (Cheswick, overview to get more insight in this already estab- 1992). It is a single host, network device or dae- lished, but still promising topic. This survey is in- mon (Provos, 2003) luring potential attackers to dis- tended to give a brief introduction into the topic and tract them from valuable network ressources (Pouget to show what has already been done with honey sys- et al., 2013). “A honeypot is a security resource tems to see the variability of them and attract more whose value lies in being probed, attacked, or com- attention to this topic. promised.” (Spitzner, 2002). “A honeypot is a re- 181 Lackner, P. How to Mock a Bear: Honeypot, Honeynet, Honeywall Honeytoken: A Survey. DOI: 10.5220/0010400001810188 In Proceedings of the 23rd International Conference on Enterprise Information Systems (ICEIS 2021) - Volume 2, pages 181-188 ISBN: 978-989-758-509-8 Copyright c 2021 by SCITEPRESS – Science and Technology Publications, Lda. All rights reserved ICEIS 2021 - 23rd International Conference on Enterprise Information Systems Detection System (NIDS) (Dittrich, 2004). It is also not clear whether the term “honeywall” refers to the product name of The Honeynet Project or the basic functioning in honey environments itself. The prod- uct honeywall is based on iptables rules, Snort, and Snort-inline (Dittrich, 2004). Other implementation use similar tools. In this paper, the term honeywall refers to a general implementation. Honeywalls sup- port interception of SSL connections and decide if in- coming traffic is malicious and therefore needs to be redirected to a honeynet, or if it is valid and therefore redirected to the productive system. Unlike honeypots or honeynets, honeytokens are just data in the form of files, entries within files, or special strings (Spitzner, 2003a) (Malin, 2017). The data looks valid even though it is fictional and does not have any production use. The files are monitored Figure 1: A honeynet, which consists of honeypots, du- in case of their modification. Data and strings are plicating the production system and being separated by a monitored as well, e.g. via Google Alerts. Google honeywall. The honeywall routes legimite users to the pro- duction network (white hosts) and attackers to the honeynet Alerts, a web service, notifies a user if a string ap- (yellow hosts). pears in Googles search. Therefore, when a user is notified about a published honeytoken, it is likely that source which pretends to be a real target.” (Provos, this honeytoken has been stolen and a successful in- 2003). A honeypot itself is not a security fix but trusion occurred. A paper defines the following hon- helps fixing issues by gaining information about at- eytoken properties (Bowen et al., 2009): tacks. “The main goals are the distraction of an at- • Believable: A honeytoken looks like valid data. tacker and the gain of information about an attack and • Enticing: A honeytoken lures an attacker. the attacker” (Baumann and Plattner, 2002). • Conspicuous: A honeytoken is easily found. A honeynet is a network of multiple honey- pots (Project, 2002; Project, 2001). Analogous to • Detectable: Interacting with a honeytoken gener- honeypots, the entire network is to be attacked. The ates an alert. honeynet is not emulated and therefore can be a copy • Variability: Various honeytoken do not contain of the production system (Spitzner, 2003a). “Hon- the same information that create a connection be- eynets represent the extreme of research honeypots. tween them. They are high interaction honeypots, which allow • Non-interference: A Honeytoken does not inter- learning a great deal; however they also have the high- fere with desired data or system interactions. est level of risk. Their primary value lies in research and gaining information on threats that exist in the • Differentiable: A legitimate user can differentiate Internet community today. Little or no modifications between a honeytoken and actual data while an are made to the honeypots of the honeynet to provide intruder cannot. a plausible copy of the production net. This gives the attackers a full range of systems, applications, and functionality to attack. From this it can be learnt a 3 PROPERTIES OF HONEYPOTS great deal, not only their tools and tactics, but also their methods of communication, group organization, Another survey (Mokube and Adams, 2007) defines and motives” (Project, 2002). Low and high inter- honeypots as devices which distract attackers from action honeypots are further explained in section 3. valuable machines, provide early warnings about at- Figure 1 shows an example of a honeynet. tacks and allow in-depth examination of adversaries As also visualised in Figure 1, a honeywall is during and after the exploitation. To this end, it is the perimeter border between honeynets and pro- in the interest of a defender that an attacker interacts ductive systems, although the term honeywall is not with the honeypot over an extended period of time, clearly defined. Some literature describe it as a gate- while being closely monitored. There are several way (Spitzner, 2003a), some describe it as a layer-2 types (Spitzner, 2002) and several use cases (Mokube or layer-3 filtering bridge firewall/Network Intrusion and Adams, 2007) of honeypots. While each type can 182 How to Mock a Bear: Honeypot, Honeynet, Honeywall Honeytoken: A Survey be used in each use case, there are different advan- which scans public wireless networks. It detects mal- tages and disadvantages for each honeypot configura- ware spreading from devices within the same network tion. and checks the basic security of public networks. It is considered to be a honeypot-to-go. HosTaGe also 3.1 Types supports Industrial control system (ICS) protocols, making it relevant for industrial companies (Vasilo- A low interaction honeypot has a very limited set manolakis et al., 2015). of commands available for an attacker. While there When implementing a honeypot, several problems is not much information one can obtain about at- should be considered (Mokube and Adams, 2007): tackers, the risk of damaged production systems due • Data Types: Data provided should look authentic to a successful attack through that honeypot is also to gain the attention of an attacker but it should not low (Mairh et al., 2011). be possible to harm the company with this data. A high interaction honeypot has the goal to obtain • Uplink Liability: Honeypots can and will get a maximum amount of information about the attacker. compromised, which enables an attacker to attack The honeypot allows itself to be used, tampered with, other systems with it. Considerations about plac- or even be damaged. High interaction honeypots of- ing a honeypot in separate networks, maybe even ten are a clone of a production server. The goal is a different public IP range than the production net- mainly to learn about novel attack techniques (Mairh work of the enterprise have to be made (see more et al., 2011). When deploying a high interaction in section 6).