Until recently I did not know that honeypots I encounter are based on Cowrie. But it does not change much to be honest. I already seen almost 100 of these while randomly exploring things on the internet. It was first thought that they are honeypots, by pure intuition. You enter a system and run ps to list processes and see broad range of things like:

• ejabberd (erlang)
• nginx worker process
• VBoxService
• mysqld

But on the other hand you are unable to run top command or any other which normally are available on valid systems. Then comes to your mind that there is something wrong with it. How naive it is to think that someone or something will be so dumb not to know that it is fake…

Anyway, I started thinking why on earth would someone deploy Cowrie or any other Honeypot setup. In theory by using honeypots you attract attacker to enter and play around. You can grab passwords, files with malware and commands they try to use. This way you can build your antimalware solutions. But it would require lots of such systems deployed and for sure it is just like that.

Second use case is when such honeypot is deployed on private networks and would be the first choice of person or system entering your perimeter. It will spend time and effort on hacking fake system loosing interest in other things and gives time to identify this threat and properly mitigate it by applying patches and reconfiguring systems.

Further reading:

https://github.com/cowrie/cowrie