Catching worms with ghost flash drives

Updated on: 2012-06-15 || Source:

Development of Sebastian Pöplau's Ghost USB Honeypot, originally developed at the University of Bonn, will now be taken up by the Honeynet Project. The software emulates a USB flash drive inserted into a USB port on a Windows system, and functions as malware bait. If a system is infected with a worm such as Conficker, Stuxnet or Flame, the worm will copy itself to the fake flash drive. It will then land in an image file, used by Ghost to spoof a USB flash drive, from where it can be analysed.

The idea is to run the honeypot software in the background on production systems at regular intervals, perhaps when the user is inactive and the screensaver is displayed. If something copies itself to the flash drive within a set time frame, say 30 seconds, it can be assumed that it has caught some malware.

Ghost USB currently runs under Windows XP only, although the project plan includes adding support for Windows 7. The project page contains pre-compiled drivers suitable for conducting initial experiments. A Windows Driver Kit is required to compile the source code, which is open source; the software is licensed under the GPLv3.


Blackphone 2 'privacy' Android handset revamped
Security firm Silent Circle has revamped its smartphone that helps people manage personal data.
Chinese smartphones mount massive web attack
More than 650,000 Chinese smartphones have been unwittingly enrolled in a massive attack that overwhelmed a web
Hilton investigates hack claims
The Hilton hotel group has said it is investigating claims its US shops and gift stores may be the source of
Twitter website 'blocked' in Turkey
Twitter users in Turkey report that the social media site has been blocked in the country.


Sign up to received our free newsletter!
E-mail ID:


Views: 4981 Times
How to Create High Quality Metal 3D Text in Photoshop READ MORE
Views: 2714 Times
Yahoo appoints Google's Marissa Mayer as new CEO READ MORE
Views: 2852 Times
Memristors in silicon promising for dense, fast memory READ MORE
Views: 5926 Times
Burn a CD on Windows XP without using software READ MORE
Views: 7525 Times
Photoshop - Dramatic Broken Glass READ MORE

Home|IT News|Computer Tips|Video Tutorials|Download Softwares|Subjects|Contact Us
Copyright © 2019. Jumbo Education (Information Technology). All rights reserved.
Free counter and web stats

Large Visitor Globe