Honeypots & Honeynets

Network Security Workshop

Issue Date: 30 May 2015

Revision: 2.0-draft

1
Contents
1. Objectives
2. Definition of Honeypot & Honeynets
3. Benefits & Risk consideration
4. Example of Honeypot tools
5. The Honeynet Project

Credits: David Watson (Honeynet Project) for the some of the contents of this slide
[email protected]

2
Objectives
1. Understand the the concept of honeypots / honeynets and
how they are deployed

2. Understand the value of honeypots and honeynets to

security teams

3. Familiarize with different types of honeypots

3
Know Your Enemy

How can we defend against an enemy, when we don’t even

know who the enemy is?

(Lance Spitzner 1999)

4
Know Your Enemy (2)

To learn the tools, tactics and motives involved in computer

and network attacks, and share the lessons learned

(Mission Statement, The Honeynet Project)

These days you may be familiar with the term ‘Threat

Intelligence’

5
Honeypots and Honeynets
• A honeypot is an information system resource whose value
lies in the unauthorized or illicit use of that resource
• Honeypot systems have no production value, so any
activity going to or from a honeypot is likely a probe, attack
or compromise
• A honeynet is simply a network of honeypots
• Information gathering and early warning are the primary
benefits to most organisations

6
Honeypot and Honeynet Types
• Low-Interaction (LI)
– Emulates services, applications and OS’s
– Easier to deploy/maintain, low risk, but only limited information

• High-Interaction (HI)
– Real services, applications and OS’s
– Capture extensive information, but higher risk and time intensive to
maintain

7
Honeypot and Honeynet Types
• Server Honeypots
– Listen for incoming network connections
– Analyse attacks targeting host’s users, services and operating
systems

• Client Honeypots
– Reach out and interact with remote potentially malicious resources
– Have to be instructed where to go to find evil
– Analyse attacks targeting clients and users

8
Honeypot and Honeynet Pros / Cons
Pros Cons

• Simple Concept • Potentially complex

• Collect small data sets of high • Need data analysis
value
• Only a microscope
• Few False Positives
• Detection by attackers
• Catch new attacks
• Risk from compromises
• Low False Negatives
• Legal concerns
• Can beat encryption
• False negatives
• Minimal hardware
• Potentially live 24/7
• Real time alerting
• Operationally intensive

9
Implementing Honeypot

10
Recap

Badness
E
v
i Noise
l
n Malware
e
Honeypots:
s Computer resource(s) to be probed and/or
s attacked

11
Why would you want to do this?
• By right, you should not expect any real activity or traffic
to/from/in your honeypot
• Detect anomalous activities in your network or system?
– Infected / Compromised computers
– Misconfiguration

• Learn about attacks in the wild (research)

– Especially if you can scale the deployment
– Attackers and attacker techniques
– Information Sharing opportunities
– Improve overall Security

12
 Generic ‘Network-based Attack’
Pattern
Host 2
Host1

1. Connection
initiated to (Or) 2
Honeypot 1

2. Connect
Back / Call- Honeypot
Home (Target)

13
What can you learn?
• Hosts that are trying to connect / scan you
– Potentially already compromised or infected
– such as IP address

• The payload used after successfully gaining access to the

honeypot system

• Scripts, binaries/executables etc

– remote control scripts
– malware samples

14
Example of Client-based Honeypot

Honeypot 1. Honeypot initiate connection Target

(Client-
Side)

2. Analyse response

15
What you can learn?
• (0-day vulnerability attack) or attacks on the Client
Application (i.e. Web Browser)

• Learn about hosts / computers that are hosting malicious

website contents
– <Iframes>
– Javascript
– Flash
– JAVA applet
– PDF
– malware etc

16
Recap 1
Let us discuss
• What is the difference between IDS and Honeypot?
– Difference between Antivirus vs Honeypot?

• What are some of the Use Cases for deploying a honeypot

or honeynet?

17
Artifacts
• 2010:09:14:07:13:10 < honeypot> 2010-09-14
07:19:27 GMT 184.y.z.144
a05dfd7cca7771a7565a154d65f05ea2
http://domain.lv/inx/fx29id1.txt????

• 2010:09:14:07:13:11 < honeypot> 2010-09-14

07:19:30 GMT 184.y.z.144
8dcad47f3e32e7dc1aee59167e67c601
http://domain.lv/inx/fx29id2.txt?????

19
Deception -> Detection
Honeytokens

A honeytoken is data or a computing resource

that exists for the purpose of alerting you
when someone accesses it.
Scenario

• Adversary _already_ inside your infrastructure or

valueable target

• Multiple Forms:
o Usernames / Passwords
o URL / Links
o Files
o Web Pages
o Etc

• Adversary use / open tokens and announce their

presence
Use-Case Fileserver
 Scan to get Server Information

https://www.canarytokens.org
Implementation
• Canarytokens
o Canarytokens.org by Thinks
o Opensource Source (on Github)
o https://github.com/thinkst/canarytokens

• Dcept by Secureworks
o Opensource
o ActiveDirectory
o https://github.com/secureworks/dcept

o Commercial Solutions are available

Conclusion

1. Consider honeypots to increase chance of detecting

adversaries or attack

2. Check out Honeynet Project Website for more

information
o Annual Conference in Canberra in November
o Community Information sharing

3. Security Response Community

o https://www.first.org

4. General Cyber Security

o https://academy.apnic.net
Deploying Honeypots with Publically
Available Tools

28
High Interaction Honeypot
• Think about your goals and objectives first

• Possible scenario
– Setup a real system and make give it an IP address (so it is
reachable to something)
– i.e. Install a Windows, Linux, Unix server

• Challenging to control & manage

– What if attacker use system to launch attack to other systems
– Keeping the computer in a usable state

29
Some Examples

• Dionaea (Malware) http://dionaea.carnivore.it/

• Cowrie : https://github.com/cowrie

• Kippo - SSH honeypot https://code.google.com/p/kippo/

• Glastopf – Web Honeypot : http://glastopf.org/

• Ghost – USB Honeypot

– https://code.google.com/p/ghost-usb-honeypot/

• Thug – Client Honeypot

– https://github.com/buffer/thug

30
Dionaea
• 2nd Generation low interaction honeypot
– Python, runs on *NIX
– IPv6 Support

• Goals
– Detect both known and unknown attacks
– Better protocol awareness
– Vulnerability modules in scripting language
– Shell code detection using LibEmu
• Check out http://dionaea.carnivore.it
• Learn about attacks, malware and many more

31
Cowrie
• Emulate SSH server / Telnet Server
– Allow ‘attacker’ to log-in using credentials (username and password)
– Environment allow limited commands – i.e. ping, who, and wget
– Record activities (keylog) of attackers and their activities

32
Glastopf Web Honeypot
• Minimalistic web server written in Python
• Scans incoming HTTP requests strings
• Checks for remote file inclusion (RFI), local file inclusion (LFI)
and SQL injection
• Signatures and dynamic attack detection
• Attempt to download attack payloads
• Search keyword indexing to draw attackers
• MySQL DB plus web console
• Integration with botnet monitoring & sandbox
• Check out Glastopf.org

33
Ghost
• USB Honeypot
• Runs on Windows
• Many malware spread across systems using thumbrive
(and bypass network containment strategies)
– i.e. Stuxnet, Conficker

• Trick malware into thinking that a USB Thumbrive has been

inserted
• Captures malware written on USB
• More: https://code.google.com/p/ghost-usb-honeypot

34
Thug
• Low Interaction Client-based honeypot to emulate web browser
– Browser Personalities (i.e. IE)
– Discovering Exploit Kits, Malicious Websites
• Python vulnerability modules: activeX controls, core browser
functions, browser plugins
• Logging: flat file, MITRE MAEC format, mongoDB, HPFeeds
events + files
• Testing: successfully identifies, emulates and logs IE WinXP
infections and downloads served PDFs, jars, etc from Blackhole
& other attack kits
• More information
– http://www.honeynet.org/node/827

35
Tools and Projects
• Cuckoo Sandbox
• Visualization
• The Honeynet Project
– HPFeed

36
Cuckoo Sandbox
• Automated Malware Analysis System
– Why not just use Anti-Virus?
• Analyze Windows executables, DLL files, PDF documetns,
Office documents, PHP Scripts, Python Scripts and Internet
URLs
• Windows guest VMs in Virtual Box Linux
• Windows hooking / driver plus python modules for
extracting and analysing sample executions

37
Cuckoo Sandbox (2)
• Trace of relevant win32 API calls performed
• Dump network traffic generated (pcap)
• Creation of screenshots taken during analysis
• Dump of files created, deleted and downloaded by the
malware during analysis
• Extract trace of assembly instructions executed by malware
process
• http://www.cuckoosandbox.org/
• http://www.malwr.com

38
Visualization
• Many of the tools do not really have a GUI
• Reporting / Presentation is key
• Many visualization tools
– PicViz
– Afterglow
– Gnuplot
– Splunk
– Plug-ins or front-end for many of the existing tools

39
The Honeynet Project
• The platform for those interested in running, building and
learning from honeypots
– http://www.honeynet.org

• Many Chapters from around the world

• Initiative for information sharing

– HP Feeds
– http://hpfeeds.honeycloud.net

40
Consider!

• Installing and playing with Honeypots to learn about

security
• Deploying it internally to catch malicious activities
• Joining the Honeynet Project
• Sharing your experience and knowledge
• Happy Honeypotting!

41
42
 THANK YOU
www.facebook.com/APNIC

www.twitter.com/apnic

www.youtube.com/apnicmultimedia

www.flickr.com/apnic

www.weibo.com/APNICrir

43