The H.A.C.K.E.R. Project

If you accidentally leave a pot of honey outside, you’ll likely find that bugs and other wildlife have helped themselves to this sweet treat when you return. But what if you left it outside on purpose to attract wildlife? In cybersecurity, a honeypot is a “mechanism that uses a manufactured attack target to lure cybercriminals away from legitimate targets” (Vaideeswaran). Honeypot devices, servers, or networks purposefully have exposed vulnerabilities that a would-be attacker can exploit.

What is a Honeypot?

Honeypots are “decoy servers or systems that are deployed next to systems your organization actually uses for production” (Fortinet). In order to make the honeypot enticing to attackers, they are “purposefully designed to look like a legitimate target” but often include security vulnerabilities that attackers can exploit (Vaideeswaran). Simply setting up a dummy server with vulnerabilities but with no information on it whatsoever is a clear sign to an attacker that the device is either a honeypot or not worth their time. To make the honeypot useful, it has to look like it is a device actually in-use. For example, if it is modeled after a production system server, it “must run the same processes your actual production system would run. It should also contain decoy files the attacker will see as appropriate for the targeted processes” (Fortinet). The more believable the processes and files on the honeypot, the more likely attackers are to fall for it. While some processes and files can be faked, Palo Alto recommends “faking only what’s necessary while avoiding traps that give away the ruse. The goal has shifted from visibility to active misdirection” (Palo Alto).

Additionally, honeypots “often contain deliberate but not necessarily obvious security vulnerabilities” (Vaideeswaran). While it may seem like a good idea to have the honeypot be as secure as possible to mimic real systems, it may be worthwhile to purposefully leave open some vulnerabilities. For example, honeypots “may have ports that are vulnerable to a port scan, which is a technique for figuring out which ports are open on a network. A port left open may entice an attacker, allowing the security team to observe how they approach their attack” (Fortinet). Honeypots are not just meant to attract outside attackers, either. They “can also lure inside actors who are attempting to access the organization’s data, IP or other sensitive information” (Vaideeswaran). An insider threat or inside actor is someone who is internal to an organization that can potentially carry out an attack against the organization (either knowingly or, in some cases, unknowingly). For example, a disgruntled employee who wants to try and steal information to sell to a competitor is an insider threat.

Once the hacker has gained access to the system, security teams can collect data from the honeypot on how the attacker performs their attack and what data they may try to go after. Security teams can then use this data to refine existing security measures or implement new ones. Because a honeypot should not be used for legitimate business purposes, “any interaction with it is a confirmed security threat” and can be investigated as such (Sophos). This is why Palo Alto states that honeypots are “classified as a counterintelligence asset rather than a direct mitigation or vulnerability”; they are a means of data gathering and research and should not be an actual vulnerability in the system (Palo Alto). Additionally, a honeypot is not a security solution. Simply having a honeypot is not enough to deter attackers from targeting legitimate systems. However, it is important to note that honeypots can “disrupt the kill chain by enticing attackers to invest their time going after the useless information in the honeypot instead of actual, sensitive targets of value” (Fortinet). A honeypot does, however, give “organizations an opportunity to change their security protocols to match the needs of the landscape” as researchers continue to observe and investigate the activity on the honeypot (Vaideeswaran).

Sophos outlines a general, five-step process for creating a honeypot:

1. Deploy the decoy: Administrators set up a fake resource that mirrors a real network component but contains no genuine operational value.
2. Expose vulnerabilities: The team intentionally leaves realistic security gaps, like weak passwords or unpatched ports, to catch an attacker’s attention.
3. Monitor interactions: Silent logging tools record every command, exploit script, and lateral movement attempt executed by the intruder inside the decoy.
4. Analyze the tactics: Security analysts review the logs to identify the attacker’s origin, tools, and specific objectives in real time.
5. Harden real defenses: The IT team uses the gathered intelligence to update firewalls and endpoint filters across the actual business network.

Sophos

Disadvantages of Honeypots

While honeypots are a great intelligence tool, they can become a detriment if they are misconfigured. For example, “[a] misconfigured honeypot may offer lateral movement opportunities. If network isolation isn’t enforced, attackers can leverage the decoy as a pivot point” (Palo Alto). Ideally, honeypots should be isolated- or, in other words, in a separate section of a company’s network- so that attackers cannot use the honeypot as a doorway into the wider company network.

Additionally, if an attacker realizes that they are working with a honeypot and not a legitimate system, they can “manipulate decoys to stage false flags, poison threat intelligence, or escalate privileges through forgotten debug channels. A mismanaged honeypot blurs visibility lines and can trigger false conclusions about threat activity, cloud misconfiguration, or lateral movement” (Palo Alto). If a hacker discovers that they are in a honeypot, they can purposefully perform certain types of attacks against it in order to mislead researchers. They can also utilize the honeypot as a distraction tactic. Hackers can “flood the honeypot with intrusion attempts in an effort to draw attention away from real attacks on the legitimate system. Finally, hackers can also deliberately provide misinformation to the honeypot”, which can lead investigators and security teams down the wrong trail as they review the logs gathered (Vaideeswaran).

Resources & Further Reading

Fortinet. “What Is a Honeypot? Meaning, Types, Benefits, and More.” Fortinet, Fortinet, Inc., 2023, www.fortinet.com/resources/cyberglossary/what-is-honeypot.

Palo Alto. “What Is a Honeypot?” Palo Alto Networks, Palo Alto Networks, 2015, www.paloaltonetworks.com/cyberpedia/honeypots.

Sophos. “Honeypots Explained | How Does a Honeypot Work?” SOPHOS, SOPHOS Ltd, www.sophos.com/en-us/cybersecurity-explained/honeypots.

Vaideeswaran, Narendran. “What Is a Honeypot in Cybersecurity? | CrowdStrike.” Crowdstrike.com, Crowdstrike, 16 Jan. 2025, www.crowdstrike.com/en-us/cybersecurity-101/exposure-management/honeypots/.