Hacker News new | ask | show | jobs
by teruakohatu 2256 days ago
If a honeypot is widely used, won't scammers just detect the honeypot? or even just detect latency from their connection being proxied elsewhere?
4 comments

You are giving these script kiddies far too much credit.

The authors of the tools they use may try to implement honeypot detection, but that's fruitless cat & mouse game, and to what end?

Assuming "honeypot" based on latency is a fool's errand because many legitimate things can induce latency.

Targeted attacks will eventually figure out the honeypot, though may trip over it a bit and create some noise. Hopefully this causes someone to look at the attacker. This can also be useful forensic data to provide to the authorities.

Bots doing initial discovery won't figure it out. I have the same bots trying to log into my SFTP server today that have been trying for years. It's not even a honeypot. I literally create accounts for all the bots with a null password in hopes they one day upload something neat.

I wrote my dissertation using honeypots and in VoIP you can actually act as a real system and pretend you have been hacked by emulating real system behavior, in this case PSTN. Most of the scammers wouldn't dare to check each system as they normally attack ranges of ip addresses
> won't scammers just detect the honeypot

It's fairly difficult to detect a well-made honeypot.

>even just detect latency from their connection being proxied elsewhere

Not if the attacker is legitimately placed far away from you. Also, from my experience these bots have very large timeouts set.