HoneyPot Workflow
July 29th, 2009
As mentioned in a previous post, our HoneyPots look for exploits with the most common browsers (and plugins).
We generate a pool of URLs refreshed every day, as well as get incoming spam URLs in real time.
An array of machines process those URLs. Every time a malicious URL is found, it gets added to our blacklist.
URLs on the blacklist are verified every hour to make sure the content:
- is the same
- has a different payload
- no longer is there
Jerome Segura
Comments:
|
|
