Skip to content
This repository has been archived by the owner on Mar 15, 2019. It is now read-only.

Classify Sessions and Honeybees on beekeeper. #49

Closed
johnnykv opened this issue Apr 27, 2013 · 1 comment
Closed

Classify Sessions and Honeybees on beekeeper. #49

johnnykv opened this issue Apr 27, 2013 · 1 comment
Assignees
Milestone

Comments

@johnnykv
Copy link
Member

Currently Sessions (hive/attackers) and Honeybees (feeder) entities are written to the database without correlation.

All Session which are Honeybees needs to be marked as such, to identify this one would have to compare data from the two entities.

Some notes on classification:

  • Honeybee (which succeeded) and matching Session
    • Everything ok! Delete Session.
  • Honeybee (which succeeded) but no matching Session
    • Potential MiTM attack (attacker mimics server).
  • Session with no Honeybee
    • Potential brute force attack.
  • Session with matching username/password in honeybee.
    • Potential MiTM attack (attacker interceptes and reuse credentials).
@johnnykv
Copy link
Member Author

Added a attribute which will reflect the current classification. (not yet in repo)
http://editor.ponyorm.com/user/jkv/beeswarm_beekeeper

johnnykv added a commit that referenced this issue May 26, 2013
johnnykv added a commit that referenced this issue May 29, 2013
johnnykv added a commit that referenced this issue May 29, 2013
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant