What is Specter?
Specter is a commercially supported product, developed and sold by the Swiss company Netsec. While SecurityFocus generally does not focus on commercial products, Specter is one of the few honeypot solutions of any kind for Windows environments. Specter is designed for commercial organizations, both small and large enterprise environments. As you will see later, it’s extremely easy to use: multiple honeypots can be remotely managed, and it has extensive alerting mechanisms. Designed for Windows, it will run on NT, Win2000, and XP. This paper is based on Specter version 6.0. Specter is what I classify a low-interaction, production honeypot. Honeypots that are low interaction emulate services: they limit the amount of interaction the bad guy has with the honeypot. This interaction is limited to how sophisticated the services being emulated are. Unlike high-interaction honeypots, there is no true operating system for the bad guys to access. The advantage with low-interaction honeypots is t
