🚀 go-pugleaf

> Since the aim of the product is to let the user store his/her data
on your
> machine,
> set up a poisoned honey-pot.  Let them get access. Let them put
their file
> on
> your disk. You can then inspect their files, collect evidence of
illegal
> entry.

I have been running a "honeypot" for over a year and have captured
some nasty worms for myself to inspect. To access my fake "C" drive
with NetBIOS over TCP/IP, simply go to my dynamic IP web server at
http://zimmermantech.inetcam.com and click on my IP address. Please
note that you must have "Client for Microsoft Networks" installed on
your system and be running Internet Explorer (otherwise Netscape tries
to connect via FTP port 21 instead of TCP port 139).


--

Paul R. Zimmerman
http://zimmermantech.com
paul@zimmermantech.com


"Rostyslaw J. Lewyckyj" <urjlew@bellsouth.net> wrote in message
news:3A9685EA.8B4B5E3E@bellsouth.net...
> Lawrence Baldwin wrote:
>
> > The last thing I want to do is give this guy any press, but
figured I'd
> > send a heads up:
> >
> > http://www.sharesniffer.com/FAQ.html#Q-001
> >
> > Advocates utilizing the open shares for extra disk space
"...because
> > it's there".
> >
> > My biggest concern is that it utilizes a newsgroup repository to
collect
> > and dissemenate IP addresses with known open shares.  Others
(including
> > automated worms) could easily leverage this data, facilitating
system
> > compromises.
> >
> > Expect an increase in Netbios scans over the coming days....sigh.
> >
> > lb.
> > -------------------------
> > Lawrence Baldwin
> > Protocol Scientist
> > 678-624-0924
> > http://www.mynetwatchman.com/about.htm - I'm under attack, now
what?
>
> Spy --- Counterspy   ;)
> Jiujitsu ... and all that  ;)
>
> Suppose that someone takes on the challenge of fighting this      as
> follows:
>
> Since the aim of the product is to let the user store his/her data
on your
> machine,
> set up a poisoned honey-pot.  Let them get access. Let them put
their file
> on
> your disk. You can then inspect their files, collect evidence of
illegal
> entry,
> and also poison their data.
> I don't think that it  will take long for the scuttlebut  about that
to get
> around.
> I think that will kill the product.
>
>