Deception tactics (2025 Edition)¶
Deception tech has evolved, but the principle remains: The best defence is making attackers regret theirs. Now, go forth and waste someone’s time.
Decoys: The art of wasting attackers’ time¶
Decoys exist to lead cybercriminals on a merry dance away from your actual assets. Honeypots and honeynets—carefully crafted digital facades—serve two purposes:
Annoy attackers by recording their every misstep.
Educate defenders by revealing their tools, techniques, and (lack of) patience.
The right honeypot depends entirely on your environment and—more importantly—how much schadenfreude you want from your logs.
@Home: Honeyclients for the curious¶
A honeyclient pretends to be a tragically outdated browser, eagerly lapping up exploits like a drunk accepting free drinks. Thug remains a delightful weekend project—just don’t blame us when your ISP emails about “suspicious activity.”
Nothing says ‘hobby’ like intentionally infecting a VM for science.
Attribution: Because knowing who to ignore is half the battle¶
Getting attribution is like playing detective, except the suspects leave digital fingerprints everywhere. Useful tools include:
Document beacons (à la Molehunt) – Because nothing says “gotcha” like a Word file that phones home.
BeEF (Browser Exploitation Framework) – Adversaries use it to hijack browsers; defenders use it to turn the tables. “Your JavaScript? Our intelligence.”
HoneyBadger – Not just a meme, but a honeypot with built-in geolocation. Now you can sigh dramatically while pinpointing exactly which country’s cybercafé is bothering you today.
Traps: The digital labyrinth¶
Why stop at one honeypot when you can build an entire maze of misery? Tools like:
Spidertrap – For ensnaring web crawlers in infinite loops of fake pages.
Weblabyrinth – Because watching bots get lost in procedurally generated nonsense never gets old.
Nova – A haystack of decoy hosts so convincing, even the attacker starts questioning reality.
The goal isn’t just to detect—it’s to send them down a rabbit hole with no exit.