Deception Technology

Honeypots, honeynets, decoys, and deception-based detection.

Overview

Deception technology lures attackers into traps.

Deception Types

Honeypot Implementation

# Simple SSH honeypot
from twisted.conch import ssh, avatar
from twisted.conch.ssh import factory

class HoneypotSSH(avatar.ConchUser):
    def __init__(self, username):
        avatar.ConchUser.__init__(self)
        self.username = username
        
    def login(self, credentials):
        # Log credentials
        log_attempt(self.username, credentials.password)
        
        # Fake response
        return {"success": True, "shell": FakeShell()}

Honeynet Architecture

+-------------------------------------+
|           Honeynet                  |
+-------------------------------------+
|  Web Server  |  Database  |  Mail   |
|  (honeypot)  | (honeypot) |(honeypot)|
+-------------------------------------+
|           Monitoring                |
|  (IDS, logging, alerting)           |
+-------------------------------------+

Honeytokens

# Create honeytoken
def create_honeytoken():
    return {
        "username": "admin_backup",
        "password": generate_weak_password(),
        "email": "admin_backup@example.com"
    }

# Monitor for use
def monitor_honeytoken(token):
    if check_login_attempt(token.username):
        alert("Honeypot triggered!")
        capture_attacker_info()

Detection Value

Best Practices

1. Realistic decoys — Match environment
2. Strategic placement — High-value locations
3. Comprehensive monitoring — All interactions
4. Quick response — Immediate alerting
5. Regular updates — Keep decoys fresh

Practice

Deploy a honeypot network to detect unauthorized access.