Academia - Honey pots, to collect passwords, is it legal?
by Mountain Computers Inc., Publication Date: Sunday, March 10, 2019
View Count: 1301, Keywords: Honeypots, Passwords, Leets, LUDS, legalities, Hashtags: #Honeypots #Passwords #Leets #LUDS #legalities
are honeypots legal to collect passwords in order to conduct cyber security threat research?
for the longest time, I recall watching Internet logs looking at brute force attacks from various sources across the Internet. The sources were obvious to me, China via Australia, Russia via Amsterdam, and so on and so forth. This history goes back to the late 1990s to the early 2000s from ISP traffic that one had to monitor and deal with ipv4 nefarious activities. In fact, the telemetry in the logs indicated the most coming from China, but no worries, the address was easily identifiable via APCNIC.net and other IP registrars outside the ARIN.net domain.
A Linux server that had a simple fail2ban feature could collect as much as 8 attacks per second, and average 40 per minute from various sources.
So, why are we so such honeypots need to be called that? why not just have a normal server that does not have critical or vital information and a few obvious accounts enabled and look at the brute force or manual attempts.
As a security analyst, what can one determine from the report? Is there security research that is published that violates the law? Academic protections are in place for some things and not for others.
So, with that being said... more to come...
if you found this article helpful, consider contributing $10, 20 an Andrew Jackson or so..to the author. more authors coming soon
FYI we use paypal or patreon, patreon has 3x the transaction fees, so we don't, not yet.
© 2024 myBlog™ v1.1 All rights reserved. We count views as reads, so let's not over think it.
