6

I'm trying to figure out whether I should set up a honeypot system with a fake phpMyAdmin (site gets hits all the time with people spidering for insecurities with that app).

My thought was to create a honeypot php script that would mimic a phpMyAdmin login, and then blacklist ips that hit that url (and aren't already whitelisted). I would then add the appropriate urls to the robots.txt so that spiders that actually respect my robots.txt wouldn't be caught by the blacklist.

Are there disadvantages to this approach, do legit robots sometimes not respect robots.txt in certain circumstances, are there any problems with this that I should consider in advance?

Improve this question
2
  • When you put the IPs on the blacklist, is this used by a firewall to block them? I'm not clear how putting them on the blacklist will do anything. BTW your personal website returns a 404.
    – paulmorriss
    May 12, 2011 at 7:51
  • A: I haven't figured out a php to firewall or php to hosts.deny method quite yet, so I'd just be putting them in a database blacklist that would be used by php to redirect to a 403 page. B: Ouch, right you are, it is 404ing, thanks for the heads up.
    – Kzqai
    May 13, 2011 at 14:55

3 Answers 3

Reset to default
2

Are there disadvantages to this approach

Yes. A malicious party could be using a proxy IP. You could end up blacklisting legitimate users with the same IP, and the malicious user may just change their IP if blacklisted.

Improve this answer
3
  • True, but I guess that's a call to run a blacklist for a relatively short time period.
    – Kzqai
    Jun 3, 2011 at 20:22
  • If temporarily blocking legitimate users is something you could live with, then you'd be okay. For me, I place a premium on user experience, so I'm not willing to risk blacklisting my users (even temporarily). I focus on blocking attack surfaces (e.g. XSS, SQL injectio) to increase security.
    – Will Peavy
    Jun 6, 2011 at 20:39
  • 1
    Certainly blacklisting by ip is a final resort, and it could be a blacklist that only extended to not-very-public usage, e.g. the main pages of a site and the contact pages could remain continually unaffected by blacklisting.
    – Kzqai
    Jun 6, 2011 at 21:08
2

Robots.txt is an advisory protocol; no-one has to follow it, and several spiders don't (e.g. those used by Internet archivists like the archive team.)

As such, you might like to consider whitelisting the IP addresses that will be accessing your real phpMyAdmin area and excluding all others, rather than blacklisting all those who hit your honeypot. The simplest way to do this if you have access to the phpMyAdmin directory is by including a .htaccess file with the following rules:

order deny,allow
deny from all
# allow my home IP address
allow from XX.XX.XXX.XXX
# allow my work IP address
allow from XX.XX.XXX.XXX
Improve this answer
1
  • 1
    No, I don't run phpMyAdmin, and considering the constant barrage of crackers looking for the presence of different versions of phpMyAdmin, I've been convinced never to do so (not that your technique isn't a little useful for any kind of simple auth of a restricted area). The phpmyadmin honeypot would only be a honeypot that mimics phpmyadmin, a trap with no actual substance.
    – Kzqai
    May 13, 2011 at 14:58
2

Obvious disadvantage of blacklisting is blocking valid users sharing NAT with machines you want to blacklist (think: big corporations with VPN and only few external IPs or universities with similar setups, maybe even some ISPs).

In particular case of worms, such as the one trying to propagate through bugs in phpMyAdmin, that would mean you blacklist infected machines. They would remain blacklisted even after they have been cleaned up using anti-virus software. That's also not something what you want.

Improve this answer
1
  • 1
    I guess it makes sense to bracklist for a short term only.
    – Kzqai
    Jun 3, 2011 at 20:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.