Presented at DEF CON "the world's largest and most publicized annual gathering of Hackers"
the Honeynet Project A honeypot is a system deliberately left unsecured, usually in order to distract attackers' time
and energy from one's "real" (important) systems; a honeynet is a whole network used for this purpose. The
Honeynet Project's goal is to amass as much data and intelligence on current hacking/intrusion techniques as
possible."
Some Discoveries http://project.honeynet.org/papers/stats/
Used default installations: Solaris Sparc, WinNT, Win98, and Linux Red Hat.
"No attempts were made to broadcast the identity of the Honeynet, nor was any attempt made to
lure attackers. Theoretically this site should see very little activity, as we do not advertise any services
nor the systems. However, attack they do, and frequently."
"we estimate the life expectancy of a default installation of Red Hat 6.2 server to be less
then 72 hours."
"The fastest time ever for a system to be compromised was 15 minutes. This means the system
was scanned, probed, and exploited within 15 minutes of connecting to the Internet."
"In May 2000, the first full month we archived Snort Intrusion Detection alerts, the Honeynet
recorded Snort 157 alerts. "
"In February 2001, the Honeynet recorded 1,398 Snort alerts, representing an increase of over
890%."
"The most popular attack method was an overflow associated with rpc.statd for Intel based
systems."
"The most popular scanning method detected was the SYN-FIN scan to search the entire IP range
for specific ports"