Over the past year since debuting the Honey Bear Honey Pot Hard Hat at Layer One, I’ve been continuing development on the app and trying to make it in to a fullfleged honeypot application.
The goal is to make it a real honeypot, easy and safe to setup and run, and focus on the educational aspects…ya know, since it has a bear face GUI.
A few things that have been added over the last year:
- More realistic ssh application in simulating a filesystem and prompt.
- Allowing one-shot SSH connections commonly used by attackers.
- Customizable filesystem via config.
- A full CTF implementation!
- Improved GUI for the HoneyBear: Better notifications and improved admin interface.
- Vastly improved stats tracking and viewing within the application and full exporting.
- A map of attacker locations.
- Ways to mess with actively connected attackers.
- Configurable rate limiting.
- Options to turn off the silly commands within the honeypot for added realism.
There are now releases on the public github page that generate binaries and document new features. The linux arm64 version is what runs on the hard hat, but we also build it for modern macOS devices. Easy to build as needed for Windows or other architectures as well.
Check it out, give me notes, shoot me questions! This has been a fun project to work on and any ideas or help are completely welcome!