BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//pretalx//pretalx.com//bsides-bristol-2026//speaker//BTDZ33
BEGIN:VTIMEZONE
TZID:Europe/London
BEGIN:DAYLIGHT
DTSTART:20250822T000000
TZNAME:BST
TZOFFSETFROM:+0100
TZOFFSETTO:+0100
END:DAYLIGHT
BEGIN:STANDARD
DTSTART:20251026T020000
RDATE:20261025T020000
TZNAME:GMT
TZOFFSETFROM:+0100
TZOFFSETTO:+0000
END:STANDARD
BEGIN:DAYLIGHT
DTSTART:20260329T020000
RDATE:20270328T020000
TZNAME:BST
TZOFFSETFROM:+0000
TZOFFSETTO:+0100
END:DAYLIGHT
END:VTIMEZONE
BEGIN:VEVENT
SUMMARY:Honeypot detection through machine wear and tear - Matilda Moore
DTSTART;TZID=Europe/London:20260822T133000
DTEND;TZID=Europe/London:20260822T135000
DTSTAMP:20260812T225245Z
UID:pretalx-bsides-bristol-2026-HVWMNB@pretalx.com
DESCRIPTION:Honeypots\, which are a high-fidelity intelligence gathering s
 trategy to detect\, delay or study adversarial behaviour by simulating vul
 nerable targets\, face the challenge of irrelevancy if adversaries are abl
 e to detect and therefore avoid them. Previous research has observed that 
 external behaviours of fake headers and unconvincing error responses lead 
 to detection\, but this presentation argues that it is the absent inevitab
 le ageing through day to day use that gives the game away. \n\nThe SANS IS
 C DShield honeypot was deployed in the cloud and systematically tested aga
 inst a taxonomy of “wear and tear” across disk\, registry\, system\, b
 rowser and network artefacts to assess the level of configuration of the h
 oneypot. Logs from a 30-day period were collected and analysed to identify
  if adversaries were employing techniques of examining system usage within
  their attack paths. \n\nIt was observed that when DShield is deployed “
 off the shelf” it has limited configuration of wear and tear artefacts w
 hich reveal the true nature of the machine. 78% of artefacts tested were c
 onfigured to an unsatisfactory level or absent altogether. This presentati
 on highlights how honeypot operators need to further configure honeypots i
 n order to create a more convincing decoy.
LOCATION:Rookie Track
URL:https://pretalx.com/bsides-bristol-2026/talk/HVWMNB/
END:VEVENT
END:VCALENDAR