What is JHoney?

JHoney is a honeypot tool for Linux written in Java. A honeypot is a system or service that looks vulnerable to the Internet. The purpose is to trick hackers to attack the honeypot system, and the honeypot could then take countermeasures against the attacker.

How does it work?

JHoney simulates network services by open servers at user specified ports on a network computer. The port/service appeares to be existing and open to an attacker or trojan. Once an attacker connects to the service, his IP address is logged and he could even be denied any access to the computer if the system uses a firewall that supports dynamic blacklisting. JHoney has been developed to work with Shorewall, but should work with any firewall that has the ability to blacklist an IP address using a shell command or adding entries to text files. All attacks against JHoney are logged with time for the attack, attacker IP and attacker hostname.

JHoney has a built-in HTTP server which can be accessed with any webbrowser. From the webinterface you can control the honeypot deamon, view attacks, change configuration or generate attack statistics for a specific day. The server uses login so you can control the honeypot remotely. The webserver has extensive help information to get you started!

2004-12-22

Updated the website. Now I am off for a christmas break.

2004-12-21

Version 1.00 released. Be sure to upgrade since a lot of things has been changed in this version.

2004-12-12

Version 0.42 released

2004-07-18

Version 0.38 released

2004-07-16

Version 0.35 released

2004-07-14

Made some changes to the website

2004-07-12

Version 0.31 released