SMTP Honeypots & Honeytokens

["Ian Baker" <ibaker () codecutters org>]

Hi,

            I’ve been in an email conversation with Lance, who suggested
that I might like to post some details on SMTP honeypots. The full text is
available at http://www.codecutters.org/spam/smtphoneypot.html, but I would
assume that most people here would be familiar enough with the terminology
that I’ll be using.



A (brief!) bit of history – I didn’t go out to write a honeypot, but a spam
filtering SMTP server. Following a ramp-up in the amount of time taken to
block incoming spam, I evaluated a variety assorted statistical (aka
Bayesian) scanning techniques. While the worked very well with repeats of
previously-categorised mail, they proved to either generate huge numbers of
false positives, or were lousy at catching new spam.



Now, given the fact that spammers don’t actually sit down and trawl websites
themselves, but use spambots, what I decided to do was to setup a “bogus”
honeypot address – anything received here would be guaranteed to be spam.
The next thing was to publish this honeytoken (as I believe the term is) on
the website and see what happened.



At time of writing, that was 113 hours ago. Since then, 180, messages have
been sent to the honeypot, of which 55 would have passed as legitimate
emails.



Clearly, then, the technique works as an anti-spam measure.



Where it started to get interesting was when we started to talk about
something more generic.



One idea that came up was to combine an SMTP honeypot with Anti-Virus (I
know that GriSoft certainly used to publish an API – I would welcome any
details, or details of other AV vendors with similar APIs).



Think of it as a Worm/Virus tripwire – in addition to feeding fake/AUP
addresses to the spambot, this could be used to detect unclassified worms or
viruses just as they start to spread.



With a full copy of the payload available for counteracting the threat, and
a copy of the connection that sent the original mail.



Thoughts, anyone?



Regards,


Ian Baker
Webmaster, codecutters.org