42. Evading IDS, Firewalls and Honeypots – Detection Games
42.6 Honeypots and Honeynets – Deception, Ethics, Alerts
Honeypot = system (or service) whose only job is to be touched by someone who should not be there. Honeynet = a small fake network. Low-interaction (Cowrie-class SSH/Telnet emulator: fake shell, log passwords tried) vs high-interaction (full VM – more intel, more risk if it becomes a jump host).
Blue win: first Cowrie login attempt = high-confidence hostile. Tune SIEM to page Shahrukh (fictional SOC) immediately. Do not "play" with the attacker or hack-back.
Ethics / law (lakshat theva):
- Own lab / own company net with written policy = OK teaching tool
- Random internet honeypot that stores attacker PII without a privacy plan = messy
- Using a honeypot to attack the scanner = illegal + stupid
- Production: isolate (no route to real Raja-Rani billing DB), gold-image, extra logging, legal review
Cowrie concept (install optional, Ubuntu-friendly; Amazon Linux may need extra packages): listen on lab SSH port other than your real SSH (e.g. real SSH stays 22 on management IP; Cowrie on a dummy NIC / port). Goal = read Cowrie logs, not to fingerprint Cowrie so Red can skip it.
| Red team (attacker) does | Blue team (defender) detects / stops |
|---|---|
| Banner-grabs then skips known honeypot fingerprints | Still alert on the grab; rotate banners; don't publish lab banners |
| Uses honeypot as pivot if high-interaction is sloppy | VLAN isolate; no credentials to real AD; snapshot + revert |
| Brute-forces fake SSH (Cowrie) | Alert on first try; feed IPs to firewalld drop (with review) |
Ravindra Bagale's Tip
Students install Cowrie on a production jumphost "for fun". If a Red actor breaks out, their shell = your LAN. Isolate it or don't deploy it. Interview: "Honeypot is a detection control, not a toy." Now let's move on.
Ravindra Bagale's Tip – मराठी
Students production jumphost वर Cowrie लावून "fun" करतात. Red बाहेर निसटला तर त्याचा shell = your LAN. Isolate करा नाहीतर deploy करू नका. Interview: "Honeypot is a detection control, not a toy." आता पुढे जाऊया.
Ravindra Bagale's Tip – हिंदी
Students production jumphost पर Cowrie लगाकर "fun" करते हैं. Red बाहर निकल गया तो उसका shell = your LAN. Isolate करो या deploy मत करो. Interview: "Honeypot is a detection control, not a toy." अब आगे चलते हैं.
Lab
Design-only (if you skip install): draw Sahyadri Pune lab – real Metasploitable .20, real Blue .40, fake SSH honeypot .50. Write 5 firewalld facts: who can route where. Optional: install Cowrie on a throwaway Ubuntu VM (docs: cowrie.readthedocs.io); from Kali ssh fakeuser@192.168.56.50 once; screenshot Cowrie log line. Revert snapshot.
Extended teaching notes
Why this lesson matters
A SOC turns logs into action. Good juniors triage with playbooks: what fired, which asset, how bad, contain or escalate, write the timeline.
- Prepare: asset list, contacts, runbooks.
- Detect: SIEM/EDR alerts with context.
- Contain: disable account, isolate host, block IOC.
- Eradicate & recover: patch, rebuild, restore.
- Lessons: one improvement ticket per incident.
Indian company (sample)
A 24×7 SOC at a large Indian IT services firm handles phishing and malware for many clients. Tier-1 analysts follow a script; they do not freestyle on production.
Mini case study
Suppose we are on a purple-team exercise for an Indian mid-size company (sample data). Red notes a technique from this lesson against a lab clone. Blue must show the control that stops it, the log that would have fired, and the ticket that hardens production. That is the standard this course trains you for.
Defender's worksheet (do this today)
- Write the lesson title, date and the exact lab target you are allowed to use.
- List three owned systems (VMs, apps, or cloud accounts) where this lesson applies.
- Run one safe check from the lesson on a lab system only. Paste the command and output.
- Write a two-sentence fix you would give a teammate.
- Name one related public advisory (CERT-In, CISA, NVD, or a vendor bulletin) with its date.
Indian workplace (sample data)
Suppose we are a junior analyst at Infosys, TCS, Wipro or a fintech SOC in Bengaluru/Pune. Turn this lesson into one checklist item with an owner, a due date and a place to store evidence (ticket + screenshot).
Global practice
Compare your notes with OWASP, CIS Benchmarks, NIST CSF/IR guidance or a cloud Well-Architected security question. Write five lines on what overlaps.
Everyday analogy
Explain the risk and the fix to a family member without jargon. If they can repeat the warning, you understand it well enough to teach juniors.
Key terms
- Control: a safeguard (patch, config, process, detection).
- Finding: a weakness backed by evidence.
- Remediation: the fix plus how you verified it.
- Scope: systems you have written permission to touch.
- Least privilege: only the access the task needs.
- Defence in depth: several layers so one failure does not end the story.
Common mistakes
- Skipping written permission "just for a quick scan".
- Practising on hostel, office or public targets without authorisation.
- Collecting tool output without writing the fix.
- Copying attack steps onto production to "verify". Defenders verify with versions, configs and patches.
- Publishing screenshots that contain secrets, cookies or internal hostnames.
Recap
- Evidence, fix, owner, date.
- Own lab only.
- Fix > spectacle.