Android相关蜜罐研究
我将为 Android 智能手机实现一个蜜罐作为我论文的研究。我从来没有使用过android、java和蜜罐。这就是我想开始的方式。我想到使用Honeyd的源代码（用C语言编写），Honeyd是Niels Provos先生设计的蜜罐。在这种情况下，我喜欢为 java 开发人员使用 eclipse 3.7 indigo。但问题是，即使我将 Honeyd 的源代码转换为 java，功能是否会像在 Honeyd 中一样工作。另外，我将在 VMware 工作站中运行 androidgingbread（版本 2.3）ISO，并尝试将转换后的 Honeyd 作为 .apk 应用程序安装在其中。之后我将在网络中设置要攻击的虚拟机。另外，我无法设置物理高交互蜜罐，因为它很危险。所以我专注于建立一个虚拟的低交互蜜罐。我脑子里有一些疑问。
1) 将 Honeyd 转换为 java 2) Honeyd 结构适用于 android 平台吗？ 3）由于蜜罐将自己的网络置于防火墙后面，对于Android如何使用此步骤？ 4）如何给出良好的预警机制？
您能否建议我对此有任何帮助。
I'm going to implement a honeypot for Android Smartphones as a research for my dissertation. I have never used android, java and honeypots. This the way i'm thinking to start this. I thought to use the source code (written in C language) of Honeyd which is a honeypot designed by Mr. Niels Provos. In this case I like to use eclipse 3.7 indigo for java developers. But the problem is even if i convert the source code of Honeyd to java, will the features work same as the way they did in Honeyd. Also I'm going to run android gingerbread (version 2.3) ISO in VMware workstation and try to install the converted Honeyd inside of it as a .apk application. after that i'm going to set up the virtual machine in the network to be attacked. Also I can't set up a physical high interaction honeypot as it is dangerous. so i'm concentrating on setting up a virtual low-interaction honeypot. I have some question dwelling in my head.
1) converting the Honeyd to java 2) Will Honeyd structure work for android platform? 3) As honeypots put on its own network behind a firewall, how to use this step regarding Android? 4) How to give a good alerting mechanism?
Could you please suggest me any help regarding this.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
您或许可以使用 NDK 构建现有的 C 代码。
“正确”的方法是将其构建为一个库，并从您的 dalvik（即您在 java 中编写的代码）应用程序进程中调用它。这也使得使用 java ui 组件作为警报机制变得容易（否则你可能有一个 java 应用程序，甚至是主机上的远程东西来监视蜜罐进程的警报）
虽然不受支持，但许多人也成功构建了立场 -使用 ndk 工具链并启动它们的单独命令行可执行文件。由于您正在处理定制的 Android 而不是设备，因此您应该不会遇到太多问题 - 您可以在独立进程上设置 OOM Killer 值，如果您愿意，您甚至不需要运行 Android根本没有框架——你可以在它底层的Linux上运行。尽管有人可能会问这样练习的意义是什么。
本质上，如果您使用的是定制的“设备”（在本例中是虚拟的）并且您实际上不需要任何 UI，那么 android 唯一真正独特的地方就是必须针对仿生 libc 构建 C 代码，而不是更正常的嵌入式Linux一；即使如此，如果静态链接，您也可以使用不同的 libc。
如果您尝试使用 Java 代码来执行此操作，您可能会遇到限制，即没有好的方法来授予对 Java 代码的 root 访问权限，因此您必须修改平台才能更轻松地以 root 身份运行自定义 Java 代码，或者修改底层linux，让非特权代码打开特权端口。
坦率地说，我认为这不是一个非常好的项目想法，因为您正在谈论将特定平台暴露给可能不关注它的威胁。
You can probably build the existing C code using the NDK.
The "proper" way would be to build it as a library and call into it from your dalvik (ie, what you code in java) application process. This also makes it easy to use java ui components for an alerting mechanism (otherwise you could have a java app or even something remote on the host that is monitoring the honeypot process for alerts)
While unsupported, many people have also had success building stand-alone command-line executables using the ndk toolchain and launching these. Since you are dealing with a customized android rather than a device, you shouldn't have too many problems with that - you can set OOM killer values on your stand alone process, and if you want you don't even need to run the android framekwork at all - you could just run on the linux that underlies it. Though one might ask what the point of the exercise would then be.
Essentially, if you are on a customized "device" (in this case virtual) and you don't really need any UI, then the only thing really unique about android is having to build C code against the bionic libc rather than a more normal embedded linux one; and even then, you can use a different libc if you statically link.
If you try to use java code to do it, you will likely run into the limitation that there is no good way to grant root access to java code, so you would have to either modify the platform to more easily run custom java code as root, or modify the underlying linux to let unprivileged code open privileged ports.
Frankly, I don't think this is a very good project idea, as you are talking about exposing a specific platform to a threat that probably isn't focused on it.