Wanna connect two or more Conpots together to act like they are depending on each other?
Then you need DataBus Remote Procedure Calls (Patent Pending).
A branch has been created.
Basically I am thinking of a small lightweight protocol that enables conpot instances to interact and simulate interconnected deployments. Examples are:
Synchronize Event IDs throughout "paired" instances
Read individual values from DataBus
Write individual values to DataBus
Enable or disable individual protocols (e.g. shutdown or start up HTTP protocol stack)
Restart a whole conpot instance
... the sky is the limit
Unfortunately we have to deal with risks involving intercommunication:
We have to ensure that a certain pairing strategy is used in order to keep attackers from directly talking databus-rpc to our honeypots and mess around with them. Further, an open TCP port would easily uncloak conpot to be a honeypot. Open UDP ports are detectable too, so we definitely need to come up with something here.
Wanna connect two or more Conpots together to act like they are depending on each other?
Then you need DataBus Remote Procedure Calls (Patent Pending). A branch has been created.
Basically I am thinking of a small lightweight protocol that enables conpot instances to interact and simulate interconnected deployments. Examples are:
Unfortunately we have to deal with risks involving intercommunication:
We have to ensure that a certain pairing strategy is used in order to keep attackers from directly talking databus-rpc to our honeypots and mess around with them. Further, an open TCP port would easily uncloak conpot to be a honeypot. Open UDP ports are detectable too, so we definitely need to come up with something here.