DataBus Remote Procedure Calls

[creolis]

Wanna connect two or more Conpots together to act like they are depending on each other?

Then you need DataBus Remote Procedure Calls (Patent Pending). A branch has been created.

Basically I am thinking of a small lightweight protocol that enables conpot instances to interact and simulate interconnected deployments. Examples are:

• Synchronize Event IDs throughout "paired" instances
• Read individual values from DataBus
• Write individual values to DataBus
• Enable or disable individual protocols (e.g. shutdown or start up HTTP protocol stack)
• Restart a whole conpot instance
• ... the sky is the limit

Unfortunately we have to deal with risks involving intercommunication:

We have to ensure that a certain pairing strategy is used in order to keep attackers from directly talking databus-rpc to our honeypots and mess around with them. Further, an open TCP port would easily uncloak conpot to be a honeypot. Open UDP ports are detectable too, so we definitely need to come up with something here.

[glaslos]

Well you can prevent some of the security issues by having a private master node that all the slaves talk to.

[glaslos]

This might be a good platform: http://jparyani.github.io/pycapnp/