Faking a Factory: Creating and Operating a Realistic Honeypot
summary
A realistic ICS honeypot is built with Siemens S7-1200 Omron CP1L and MicroLogix 1100s, an HMI and robotics workstation exposed over VNC, taps into a Raspberry Pi collector and Moloch for PCAP analysis. Attacks include an Aries C2 Monero miner, multiple crisis ransomware incidents, a crude renamer encryptor, and weird Symbian emulator installs. Monitoring uses VirtualBox screen recording & VNC captures plus forensic scripts; traffic totals about ≈8,900 unique IPs, 55M packets and tens of GB transferred, showing mostly unskilled intruders.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 0:34Designing the fake factory
- 2:37Adding realism to the honeypot
- 4:40Network setup and exposure
- 6:39Monitoring and data collection
- 8:46Network architecture
- 10:23Initial attack findings
- 13:21Ransomware negotiation
- 15:02Advanced attacker activity
- 17:03Strange attacker behavior
- 19:08Ethical hacker intervention
- 23:13Honeypot statistics
- 26:40Lessons learned and tips
- 30:30Conclusion and Q&A
related talks
15mOn Design and Enhancement of Smart Grid Honeypot System for Practical Collection...
46mAn OT Cyber attack simulation on a chemical plant
31mWeb Application Honeypot Threat Intelligence
32mHey Attacker! I Can See You!
34mWhat Minesweeper Can Teach Us About Security
26mWeb Honeypot Project
29mCritical Infrastructure Network Attacks: Code Red, Alert Network Operators
23mHoneypots 2.0: A New ‘Twist’ on Defending Enterprise Networks