Tracking Down Hi-Tech Crime

Honeypots are forensic tools that have become indispensable to computer security experts monitoring online crime. They are used to gather statistics about popular attacks, to grab copies of malicious programs that carry out the attacks and to get a detailed understanding of how these attacks work. To the malicious programs scouring the web these honeypots look like any other PC. But in the background the machines use a variety of forensic tools to log what happens to them. Perhaps one indicator of how useful these tools have become is seen in the fact that the most sophisticated attackers make their malicious programs able to recognise when they have trespassed on a honeypot. The BBC honeypot was a standard PC running Windows XP Pro that was made as secure as possible. This ran a software program called VMWare which allows it to host another "virtual" PC inside the host. Via VMWare we installed an unprotected version of Windows XP Home configured like any domestic PC. VMWare is useful as it makes it easy to pause the "virtual" PC or roll it back to an earlier configuration. This proved essential when recovering from an infection. SEVEN HOURS OF ATTACKS 36 warnings that pop-up via Windows Messenger 11 separate visits by Blaster worm 3 separate attacks by Slammer worm 1 attack aimed at Microsoft IIS Server 2-3 "port scans" seeking weak spots in Windows software This guest machine, once armed with some forensic software, became the honeypot. When we put this machine online it was, on average, hit by a potential security assault every 15 minutes. None of these attacks were solicited, merely putting the machine online was enough to attract them. The fastest an attack struck was mere seconds and it was never longer than 15 minutes before the honeypot logged an attempt to subvert it. The majority of these incidents were merely nuisances. Many were announcements for fake security products that use vulnerabilities in Windows Messenger to make their messages pop-up. Others were made to look like security warnings to trick people into downloading the bogus file. However, at least once an hour, on average, the BBC honeypot was hit by an attack that could leave an unprotected machine unusable or turn it into a platform for attacking other PCs. Story from BBC NEWS: http://news.bbc.co.uk/go/pr/fr/-/2/hi/technology/5414502.stm [Editor's note - this is a little beyond our usual schtick, but it is valuable information for the average 'net user today. Do not use the web without oodles of 'protection'! - Dr C] [Proofreader's note: this article was edited for spelling and typos on October 11, 2006]

Note: http://news.bbc.co.uk/g...