Archive for September 20th, 2005
Home made Homemonkey: HoneySpider

In my quest to find more viruses, trojans, and worms (which I find fastinating)  I started building my own HoneyMonkey server which I call a “HoneySpider.”

What the hell is a HoneyMonkey?

You've heard of HoneyPots, right?  A server that is set up to trick and track potential malicious hackers who think they have found the goods but have in fact been seduced by a decoy.  Brilliant defense however it is very passive as you must wait for the bastard hackers to come to your decoy system.  The HoneyMonkey is active in that it actively locates sites, pages and weblinks that seek to exploit systems.  The Microsoft's Strider HoneyMonkey Exploit Detection system is great evolutionary step for a proactive method of Internet security (something I've been waiting for a while).  It actually crawls the web to locate these evil boxes and maps out there location on the Web.

I thought the concept seems pretty self explanatory:  set up a server that crawls the web specifically looking for offending sites.  This can be down with and old box you happen to have laying around and a web crawler like Zeus.

 

I'm still working on it.  I'll keep you posted.