San Diego-based security vendor Websense has deployed what it calls “HoneyJax” across the Internet that attempt to seek out malware, phishing kits and other threats before they snare Web surfers.
Websense Vice President of Security Research Dan Hubbard will unveil the “HoneyJax” to attendees of this years Defcon convention in Las Vegas. The name is a play on words—a combination of honeypots and AJAX, Hubbard said.
Websense has been building the tools over the last six to eight months to find malware targeting sites using Web 2.0 applications, he added. “HoneyJax” mimic user behavior within Web 2.0 applications to uncover threats before they spread, and are part of the Websense ThreatSeeker technology.
“The basic concept is its kind of the next evolution of tracking Internet activity…[and] is designed to track things like malicious code, phishing fraud, [sexual] predators, and a number of illegal activities that happen in Web 2.0 space,” Hubbard said. “We need all kinds of new tools to evolve with the new types of attacks. There is not a whole lot out there that is designed to actually track some of the new Web 2.0 attacks.”
For example, if a hacker were to launch an attack using a social networking site such as MySpace, ThreatSeeker would detect the threat through its HoneyJax systems. Hubbard said there are three types of HoneyJax tools he labeled as passive, active and passive aggressive.
“The easiest example would be something like a MySpace Web site where you have a profile there that is dormant, sitting and waiting for people and automated routines to come and put data within the profile…those are called passive HoneyJax,” he said. Active HoneyJax actually go out and attempt to add themselves to other peoples networks.”
Passive aggressive or hybrid HoneyJax combine the two techniques, joining social networking sites in an attempt to attract certain types of attackers, Hubbard said.
“This will actually get right in to the actual domain space, right into the networks, and get a lot more data,” the researcher added.
Hubbard will present the technology Sunday at the conference.
Check out eWEEK.coms Security Center for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEKs Security Watch blog.