A honeypot is a computer (or virtual computer) designed to catch all those internet nasties that you’d normally want to avoid - so that people can be educated on what they do and how to avoid them, and to study them and find out which ports they use, what files they’re reading that they shouldn’t be etc.
So, with that settled, I can now announce the Crashed Pips Honeypot Experiment 2007. Over the next 30 days, I shall be making occasional posts updating you on the results of the experiment. I may even prepare a report/conclusion at the end.
What is the machine’s setup?
The machine’s a Virtual PC setup using 128mB of RAM and a 15gB hard disk (more than adequate for this purpose). It will be running an installation of Microsoft Windows XP Professional without any security software installed whatsoever apart from what is built directly into the operating system - in this case, nothing more than a firewall. Windows Update warnings will also be ignored.
How will you hose the machine?
I will visit certain websites, and leave ports open deliberately in an attempt to lure viruses, spyware etc into the honeypot. I also intend to follow spoof virus warnings that lead to spyware, and to install certain software that is known to contain advertising and spyware.
How realistic is this experiment? Could I cite it in a paper?
There is no way that this experiment could be called realistic, because a special effort is being made to infect the machine with as much malware as possible. This will therefore make the test wildly unrealistic and inaccurate. If you’re quoting this in a scientific paper or anything serious, you’re a Cornish sardine.