Ghost, a honeypot for capturing USB malware

The Honeypot project has released first public version of malware Honeypot called as "Ghost".

Ghost is a honeypot for USB malware. It is capable of capturing malware that propagates via USB storage devices without any further knowledge. This is done by emulating a USB thumb drive and tricking malware into infecting the emulated device. Due to the fact that a machine must be infected in order for the virtual device to detect the malware, the honeypot is designed to run on Windows systems, which are mainly targeted by malware at themoment.

Currently, Ghost only supports Windows XP and is in an early development stage, although its concept has been shown to work well, and the code is stable. If Ghost detects an infection, then it will currently only report that the machine is possibly infected, without including any additional information.

The team plans on extending Ghost's reporting capabilities, and to make it run on other versions of Windows. We can expect the complete product on August 31. The source code and binary for this file can be found here.