<story><title>Running a fake power plant on the internet for a month</title><url>https://grimminck.medium.com/running-a-fake-power-plant-on-the-internet-for-a-month-4a624f685aaa</url></story><parent_chain><item><author>waihtis</author><text>I run a honeypot software company, with our customers being mid-large enterprises. While the case presented here is certainly interesting, it&amp;#x27;s actually fairly uncommon for companies to run internet-facing honeypots, mostly due to it being a huge resource sink, and it&amp;#x27;s fairly difficult to learn anything truely useful from observing attacks coming from (mostly) bots.&lt;p&gt;The more interesting use case for most is planting these in your network internals, which gives an added benefit of early, high-fidelity threat detection in addition to the &amp;quot;threat intelligence&amp;quot; bonuses. It&amp;#x27;s not completely trivial to set up, but can be a reasonably quick way to build good detection capability into even very disparate environments.&lt;p&gt;A vast majority of organizations still lack good situational awareness of their infrastructures and this is one way of improving on that.</text></item></parent_chain><comment><author>TazeTSchnitzel</author><text>A fun example of a honeypot was that placed by Cliff Stoll in 1986 on a computer system at Lawrence Berkeley when trying to get a repeated attacker to stay on the line long enough to be traced, as described in &lt;i&gt;The Cuckoo&amp;#x27;s Egg&lt;/i&gt; and portrayed in this PBS NOVA recreation: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.youtube.com&amp;#x2F;watch?v=hTx9h3Sm29I&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.youtube.com&amp;#x2F;watch?v=hTx9h3Sm29I&lt;/a&gt;</text></comment>
<story><title>Running a fake power plant on the internet for a month</title><url>https://grimminck.medium.com/running-a-fake-power-plant-on-the-internet-for-a-month-4a624f685aaa</url></story><parent_chain><item><author>waihtis</author><text>I run a honeypot software company, with our customers being mid-large enterprises. While the case presented here is certainly interesting, it&amp;#x27;s actually fairly uncommon for companies to run internet-facing honeypots, mostly due to it being a huge resource sink, and it&amp;#x27;s fairly difficult to learn anything truely useful from observing attacks coming from (mostly) bots.&lt;p&gt;The more interesting use case for most is planting these in your network internals, which gives an added benefit of early, high-fidelity threat detection in addition to the &amp;quot;threat intelligence&amp;quot; bonuses. It&amp;#x27;s not completely trivial to set up, but can be a reasonably quick way to build good detection capability into even very disparate environments.&lt;p&gt;A vast majority of organizations still lack good situational awareness of their infrastructures and this is one way of improving on that.</text></item></parent_chain><comment><author>wwv25</author><text>Did you plant internally to detect malicious actors from within the organization or as a way to definitively detect external actors who have presumably entered the network through an exploit?</text></comment>