The arguments for the hacker in regards to honeypots are just plain silly. When comparing a honeypot to a naive admin's control of a non-honeypot, exposed system there is little difference, especially if the machine is for test or in the state of being utilized for its intended purpose. If the system has monitoring aspects enabled, which is typically corporate policy in some shape or form, I see little difference between the two. How could a hacker then argue his/her rights were violated when the system is labeled a honeypot as opposed to the other scenario. Then it is just a matter of symantics. The moral of the story is: don't call it a honeypot, just say it was a poorly configured part of your network.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/articles/4004/19523#19523