Detecting honeypots and other suspicious environments

Proceedings from the 6th Annual IEEE System, Man and Cybernetics Information Assurance Workshop, SMC 2005

Volumn 2005, Issue , 2005, Pages 29-36

  Holz, Thorsten ^a   Raynal, Frederic ^b,c  

^a RWTH AACHEN UNIVERSITY   (Germany)

^b AIRBUS GROUP INNOVATIONS   (Germany)

^c MISC Magazine   (France)

Author keywords

[No Author keywords available]

Indexed keywords

COMPUTATIONAL METHODS; COMPUTER CRIME; COMPUTER NETWORKS; COMPUTER SIMULATION; CYBERNETICS; INFORMATION TECHNOLOGY; PATTERN RECOGNITION; PROGRAM DEBUGGING; SECURITY SYSTEMS;

ELECTRONIC DECOYS; HONEYPOTS; MALICIOUS ATTACKERS; SECURITY TOOLS;

ELECTRONIC DOCUMENT IDENTIFICATION SYSTEMS;

EID: 33745434223     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/IAW.2005.1495930     Document Type: Conference Paper

References (24)

1. M. Dornseif, F. C. Gärtner, and T. Holz, "Vulnerability assessment using honey pots," Praxis der Informationsverarbeitung und Kommunikation (PIK), vol. 4, no. 27, pp. 195-201, 2004.
2. G. J. Simmons, "The prisoners' problem and the subliminal channel," in Advances in Cryptology, pp. 51-67, 1984.
3. J. Corey, "Local honeypot identification." http://www.phrack. org/unoffical/p62/p62-0x07.txt.
4. J. Corey, "Advanced honey pot identification," http://www.phrack.org/unoffical/p63/p63-0x09.txt.
5. "Sebek." Internet: http://honeynet.org/papers/honeynet/tools/ sebek/, 2004.
6. The Honeynet Project, "Know your Enemy; Sebek," November 2003. http://www.honeynet.org/papers/sebek.pdf.
7. M. Dornseif, T. Holz, and C. Klein, "Nosebreak - attacking honeynets," in Proceedings of 5th Annual IEEE Information Assurance Workshop, 2004.
8. T. C. Keong, "Detecting sebek Win32 client." http://www.security.org.sg/vuln/sebek215.html and http://www.security.org.sg/ vuln/sebek215-2.html.
9. D. Corporation, "Sebek2 client for openbsd." http://honeynet.droids-corp.org/download/sebek-openbsd.pdf.
10. J. S. Robin and C. E. Irvine, "Analysis of the intel pentium's ability to support a secure virtual machine monitor," in Proceedings of 9th USENIX Security Symposium, 2000.
11. J. Rutkowska, "Red pill... or how to detect vmm using (almost) one cpu." http://invisiblethings.org/papers/redpill.html.
12. "Know your enemy: Learning with user-mode linux." http://www.honeynet.org/papers/uml/.
13. "Honeypot proofs." http://user-mode-linux.sourceforge.net/ hppfs.html.
14. "Separate kernel address space & uml." http://user-mode- linux.sourceforge.net/skas.html.
15. "Vmware homepage," Internet: http://www.vmware.com/.
16. K. Kortchinsky, "Patch for vmware." http://honeynet.rstack.org/ tools/vmpatch.c.
17. T. Holz and L. Oudot, "Defeating honeypots: Network issues," http://www.securityfocus.com/infocus/1803 and http://www.securityfocus.com/ infocus/1805.
18. "Ieee standards." Internet: http://standards.ieee.org/regauth/ oui/oui.txt.
19. "Vmware backdoor i/o port." Internet: http://chitchat.at. infoseek.co.jp/vmware/backdoor.html.
20. B. Spengler, "chroot(), sécurité illusoire ou illusion de sécurité?." http://www.miscmag.com/articles/index.php3? page=1008 MISC 9 - Sept./Oct. 2003.
21. J. K. Rutkowski, "Execution path analysis: finding kernel based rootkits." http://www.phrack.org/show.php?p=59&a=10.
22. E. Barbosa, "Avoiding windows rootkit detection," 2004. http://www.rootkit.com/vault/Opc0de/bypassEPA.pdf.
23. G. Delalleau, "Mesure locale des temps d'exécution: application au contrôle d'intégrité et au fingerprinting." SSTIC 2004: http://actes.sstic.org/SSTIC04/ Fingerprinting_integrite_par_timing/.
24. N. Brulez, "Scan of the month 33: Anti reverse engineering uncovered." http://www.honeynet.org/scans/scan33/nico/.