Image
 
linkedin_logo.png rss_logo.jpg
twitter_logo.png youtube_logo.jpg
Latest Additions
 
EH-Net Login
Welcome Guest.






Lost Password?
No account yet? Register
Who's Online
We have 33 guests online
 
Advertisement

You are here: Home arrow Ethical Hacking Discussions and Related Certificationsarrow Malwarearrow Honeypot on Amazon EC2
EH-Net
May 23, 2013, 10:02:31 PM *
Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
News: Go back to The Ethical Hacker Network Online Magazine Home Page
 
   Home   Help Calendar Login Register  
Pages: [1]   Go Down
  Print  
Author Topic: Honeypot on Amazon EC2  (Read 18275 times)
0 Members and 1 Guest are viewing this topic.
3xban
Hero Member
*****
Offline Offline

Posts: 608


View Profile WWW
« on: August 08, 2011, 08:17:06 PM »

Has anyone tried this and would it be against their TOS?  I would think it would be a grey area.  I would setup one of these outside of my home network rather than in it.  I don't have the ability to segment in the home network... yet... but figure this might be the best solution if it is doable.

Any thoughts or suggestions?
Logged

Certs: GCWN
(@)Dewser
cd1zz
Hero Member
*****
Offline Offline

Posts: 561


View Profile WWW
« Reply #1 on: August 08, 2011, 08:29:32 PM »

I would contact the security group aws-security@amazon.com

Also, here is some useful info: http://aws.amazon.com/security/

However, the email group is actually pretty responsive so I would start there.
Logged

3xban
Hero Member
*****
Offline Offline

Posts: 608


View Profile WWW
« Reply #2 on: August 08, 2011, 09:31:52 PM »

Thanks cd1zz, I will see what they say.  No sense putting energy into it if they will just take it down or tell me to kill it.
Logged

Certs: GCWN
(@)Dewser
3xban
Hero Member
*****
Offline Offline

Posts: 608


View Profile WWW
« Reply #3 on: August 09, 2011, 10:19:59 AM »

Follow-up, yep definitely against the TOS.  Ok plan B I guess capture the neighbor's wifi and...  nevermind.  j/k.  Guess I may have to ramp up some networking at the house and segment.  I could just go shields up on everything but really don't want to risk it.  I already have some entertainment devices that don't seem all that secure and I would like to segment them off anyway.  Time to look for a new switch and possibly a router. 
Logged

Certs: GCWN
(@)Dewser
ajohnson
Recruiters
Hero Member
*
Offline Offline

Posts: 1057


aka dynamik


View Profile WWW
« Reply #4 on: August 31, 2011, 02:28:45 PM »

Have you looked at a VPS (i.e. arpnetworks.com)?

I'm not sure if they'd allow it, but it's worth asking (and costs as low as $10/mo).
Logged

WIP: GCFA | www.infosiege.net | @infosiege

The day you stop learning is the day you start becoming obsolete.
3xban
Hero Member
*****
Offline Offline

Posts: 608


View Profile WWW
« Reply #5 on: September 01, 2011, 08:16:18 AM »

I'll take a look at them.  Though at this time I decided to put the extensive malware analysis on hold a bit.  I will work with what I get in the wild. I am refocusing more on my python skills since the two main goals I have now require me to be a bit stronger with the scripting. 

Overalll it will lead back to malware analysis and maybe even open the doors to some reverse engineering in the future.  Man wish I went CS sometimes.  MIS seems to have been a hinderance since a majority of the skills taught in that major 10+ years ago were not so useful then and even less useful now.  Got a little jealous when I looked at the CS curriculum at my old university.
Logged

Certs: GCWN
(@)Dewser
ethicalhack3r
Full Member
***
Offline Offline

Posts: 139


View Profile WWW
« Reply #6 on: November 09, 2011, 05:10:19 AM »

I was thinking the exact same thing and Google led me here. Smiley

Even though it is against their TOS, how would they know you were hosting a honeypot?

I've never used Amazon EC2 before so I'm not sure how it works.

I guess they do some monitoring on the boxes traffic for malicious activity? Even if they did, with the amount of boxes they are hosting, would they have the time to take any action?

(just thinking out loud and sorry to resurrect an old thread)

Edit---

I was thinking about using something like this;
https://hub.turnkeylinux.org/

Edit---

TurnkeyLinux Hub doesn't allow you to use the free 1 year micro server offered by Amazon and their registration process is ridiculous.
« Last Edit: November 09, 2011, 07:30:03 AM by ethicalhack3r » Logged
3xban
Hero Member
*****
Offline Offline

Posts: 608


View Profile WWW
« Reply #7 on: November 09, 2011, 08:05:11 AM »

I was thinking about that (running it anyway).  I suppose if you are running something like a web server then how would they know you are deliberately running a honeypot behind it?  Their free EC2 instance for linux is a bit hoaky though so navigating it to install apps and hunting down the appropriate log files is a bit more convoluted than what I am used to.  At this time I've put a hold on the little project until I can get some other items done. 
Logged

Certs: GCWN
(@)Dewser
millwalll
Guest
« Reply #8 on: November 10, 2011, 03:44:29 AM »

cool idea however I would not do it epically as you have contacted them and they have told you its against there TOS.
Logged
3xban
Hero Member
*****
Offline Offline

Posts: 608


View Profile WWW
« Reply #9 on: November 10, 2011, 08:41:21 AM »

True Jamie, I can't play dumb now since I did contact them.  No biggy, I have other things filling my time at the moment. 
Logged

Certs: GCWN
(@)Dewser
ethicalhack3r
Full Member
***
Offline Offline

Posts: 139


View Profile WWW
« Reply #10 on: November 10, 2011, 04:43:11 PM »

I set-up a web server over the weekend.

You can choose an official Ubuntu machine, type in the official Ubuntu user ID when doing a search for machines.

The web server is just Apache with a htaccess file that contains modrewrite rules to reply with 200 responses instead of 404s.

I'm just going to monitor the access logs from now and then. It might yield somethign interesting, it may not, hasn't cost anything. Smiley
Logged
Pages: [1]   Go Up
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.18 | SMF © 2013, Simple Machines
Joomla Bridge by JoomlaHacks.com
Valid XHTML 1.0! Valid CSS!
Page created in 0.084 seconds with 22 queries.
 
Exclusive Deal

sansfire13_245x90_cw90.jpg
SANSFIRE 2013
June 15 - 22

5% Off w/ Code: EHN_5

SANS Deals 4 EH-Netters
5% OFF Any SANS Course in Any Format!
Coupon Code: EHN_5 Including SANS Rocky Mountain 2013 & SANS Boston 2013
Polls
Compared to this year, 2013 will be:
 
Recent Forum Topics
EH-Net News Feeds
Latest Additions
 
         
Free Business and Tech Magazines and eBooks

© 2013 The Ethical Hacker Network
Joomla! is Free Software released under the GNU/GPL License.