ActiveScout

One product that caught the Reviewmeister’s eye recently is ForeScout Technologies’ ActiveScout. We found ActiveScout to be a kind of honeypot that can be used to efficiently identify and block traffic from the automatic attack tools that most amateur hackers use.

ActiveScout sits in the network on a monitoring port, typically outside the corporate firewall. ActiveScout has no real services and protects no real systems. Instead, it simulates a variety of applications that could be interesting to attackers. The theory is that anyone who connects to one of these simulated applications is up to no good. At that point, ActiveScout uses its monitoring capabilities to attempt to reset any TCP connections from the attacker and reprogram the corporate firewall to block traffic. ActiveScout can take this a step further by feeding back “poison” information to the attacker, such as a particular NETBIOS name. If connection attempts show up from other sources with this poison information in hand, ActiveScout will block traffic from those sources as well.

The benefit to ForeScout’s approach is pretty clear: no false positives. Because you’re not looking for a signature or any other protocol anomaly, you don’t have to worry about misdetecting potential attacks. It’s behavioral: Anyone touching that box must be bad and stopped.

What ForeScout doesn’t advertise is the flip side of no false positives: Lots of false negatives. Only someone who actually does reconnaissance using this model will get caught. If the bad guys already know where the Web server is – maybe they looked it up in the DNS – ActiveScout won’t do anything about the attack, successful or not.

Nevertheless, the great majority of Internet attacks, what we called “background radiation,” use a pattern that is susceptible to the kind of technology ForeScout brings to the table.

For the full report, go to https://www.nwfusion.com/reviews/2004/0216ipshoneypot.html