HoneyThing
A honeypot that emulates vulnerable TR-069 (CWMP) devices to detect and analyze attacks targeting IoT modems/routers.
What is HoneyThing?
HoneyThing is a honeypot that emulates IoT devices using the TR-069 (CWMP) protocol, commonly found in modems and routers. It simulates vulnerabilities like Misfortune Cookie and Rom-0 to attract attackers, log their activities, and help security researchers analyze threats targeting embedded systems.
Security researchers, IoT security professionals, and network administrators focused on detecting and studying attacks against TR-069-enabled devices.
It provides a specialized, open-source honeypot for TR-069 devices with realistic protocol emulation and vulnerability simulation, filling a gap in IoT threat detection tools.
Overview
TR-069 Honeypot
Use Cases
Best For
- Detecting and analyzing attacks targeting TR-069 (CWMP) devices
- Studying exploitation attempts against RomPager vulnerabilities
- Security research on IoT modem/router threats
- Deploying decoy systems in network security monitoring
- Logging and parsing attacker interactions with simulated IoT devices
- Academic or research projects on honeypot technologies
Not Ideal For
- Production environments needing real TR-069 device functionality for operational purposes
- Security teams requiring a multi-protocol honeypot for broad threat detection
- Systems without Python 2.7 or PycURL support, due to installation dependencies
- Users seeking out-of-the-box deployment with stable, pre-built packages
Pros & Cons
Pros
Implements common TR-069 commands like GetRPCMethods and SetParameterValues, providing realistic simulation of modem/router devices to bait attackers effectively.
Emulates known RomPager vulnerabilities such as Misfortune Cookie and Rom-0, specifically attracting exploit attempts against IoT devices.
Includes a modem-like web interface to increase interaction with attackers, enhancing logging opportunities for security analysis.
Logs all HTTP and CWMP communications in text formats, making it easy to analyze attacker activities and patterns for research.
Cons
Requires Python 2.7, which is end-of-life and unsupported, posing security risks and compatibility issues for modern systems.
Pre-built Debian and RPM packages are noted as 'will be available soon' in the README, indicating unreliable or manual installation processes.
The primary academic paper is in Turkish, reducing accessibility and support for non-Turkish speaking security researchers.
Frequently Asked Questions
Related Projects
T-Pot🍯 T-Pot - The All In One Multi Honeypot Platform 🐝
EndlesshSSH tarpit that slowly sends an endless banner
CowrieCowrie SSH/Telnet Honeypot https://docs.cowrie.org/
AndroguardReverse engineering and pentesting for Android applications
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.