Scribd Logo
Upload

Welcome to Scribd!

  • 237 views

    Honeypot PDF

    Uploaded by

    krishnathefriend
    This document discusses honeypots, which are decoy computer systems used to study hacking behaviors. It outlines the history and technologies of honeypots, including low-interaction network service simulations and high-interaction virtual systems. Common honeypot products like BOF, Sting, and Honeyd are described. The document also provides tips on honeypot deployment and risks, and discusses how intruder activities can be monitored and forensic techniques applied through honeypot data collection and control mechanisms.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    Honeypot PDF

    Uploaded by

    krishnathefriend
    237 views50 pages
    This document discusses honeypots, which are decoy computer systems used to study hacking behaviors. It outlines the history and technologies of honeypots, including low-interaction network service simulations and high-interaction virtual systems. Common honeypot products like BOF, Sting, and Honeyd are described. The document also provides tips on honeypot deployment and risks, and discusses how intruder activities can be monitored and forensic techniques applied through honeypot data collection and control mechanisms.

    Original Title

    honeypot.pdf

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    This document discusses honeypots, which are decoy computer systems used to study hacking behaviors. It outlines the history and technologies of honeypots, including low-interaction network service simulations and high-interaction virtual systems. Common honeypot products like BOF, Sting, and Honeyd are described. The document also provides tips on honeypot deployment and risks, and discusses how intruder activities can be monitored and forensic techniques applied through honeypot data collection and control mechanisms.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    237 views50 pages

    Honeypot PDF

    Uploaded by

    krishnathefriend
    This document discusses honeypots, which are decoy computer systems used to study hacking behaviors. It outlines the history and technologies of honeypots, including low-interaction network service simulations and high-interaction virtual systems. Common honeypot products like BOF, Sting, and Honeyd are described. The document also provides tips on honeypot deployment and risks, and discusses how intruder activities can be monitored and forensic techniques applied through honeypot data collection and control mechanisms.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    of 50

    Honeypot

    Hacker Tracking and Computer


    Forensics
    Manfred Hung
    manfred.hung@pisa.org.hk
    Agenda
    Honeypot History
    Value of Honeypot
    Honeypot Technology
    Common Honypot products/solutions
    Honeypot deployment tips
    Future of Honeypot
    Intruders Motivation
    High speed network/Internet bandwidth
    High speed processors
    Enormous disk storage
    Value of information stored
    Business/Political issues
    Script Kiddies, Worms
    Value of Honeypot
    Research based Honeypot
    Research the threats organization may face
    Detect new threat
    Deploy in University, Government, IT Vendor
    Production based Honeypot
    Secure product environment by detect attack
    Waste intruders time on honeypot system
    Deploy in customers production net
    History of Honeypot
    Real System
    1990 or before
    Network services simulation
    1998
    Virtual System
    1999
    Honeypot Technology
    Real System
    Unprotected network
    Wide open firewall rules
    Insecure system
    Default install, no patch
    Insecure setting
    Honeypot Technology
    Network Service Simulation
    NFR BOF, Sting, Honeyd
    Unable to capture details information
    Easy to deploy
    Low interaction, lower risk, no real OS
    Virtual System
    Honeynet, Decoy Server (ManTrap)
    Able to capture details information
    Complex to deploy
    High interaction, higher risk, virtual OS
    Honeypot Technology

    NFR BOF
    Symantec Decoy Server
    CyberCop Sting
    HoneyNet
    Honeyd

    Lower interaction Higher interaction


    Lower risk Higher risk
    NFR BackOfficer Friendly (BOF)
    Network services simulation
    Slow-interaction honeypot
    NFR BOF Limited Services
    Limited Services
    BO2K, FTP, Telnet, SMTP, HTTP, POP3, IMAP
    NFR BOF Slow Interaction
    Slow Interaction
    HTTP 401 Authorization Failed
    FTP, SMTP, POP3 - 503 Service Unavailable
    CyberCop Sting
    Network Service Simulation
    Low interaction honeypot

    Network device, Windows, Unix


    Limitation - Windows NT only
    Honeyd
    Network Service Simulation
    Low interaction honeypot

    Network device, various OS system


    Resists fingerprinting
    Honeyd Route traffic
    Blackholing
    Route net traffic
    TTL, latency, packet loss
    Honeyd ARP request
    ARP spoofing
    Arpd monitor arp traffic
    Map non-exist IP addr. to honeyd MAC addr.
    ARP proxy
    Static map IP addr. to honeyd MAC addr.
    Honeyd fingerprint
    Nmap, Xprobe
    Database of known OS signature
    Honeyd fingerprint

    ICMP TCP UDP

    ICMP WinSize, DF,


    TTL, TOS,
    Response
    TCP ISN

    Fingerprint
    system
    Honeyd Interactive Response

    stdin

    Service script

    stdout
    Symantec Decoy Server (ManTrap)

    Internet/Intranet

    Cage Cage Cage Cage

    Host system kernel

    DB Host system Console


    Symantec Decoy Server
    Cage
    Content Management Module (CGM)
    Network sniffer
    Kernel process create, File I/O
    Hardware token - iButton
    Decoy Server Data Control
    Intruder unable to
    access host system
    Multiple cage are
    under separate
    network
    Cage shutdown

    File system
    Decoy Server Data Capture
    Kernel level data capture
    Network (sniffer)
    Process (PID, EUID, EGID)
    File I/O
    Device I/O
    Decoy Server Data Capture

    Network capture
    Kernel level capture
    Session playback
    Decoy Server - Data Collect
    Content Generation Management (CGM)
    Alerts (e-mail, SNMP )
    Collected data integrity protection iButton
    Secure copy (SCP)
    Honeynet Data Control
    Firewall control inbound traffic
    Limited access to pre-defined service
    Firewall control outbound traffic
    Allow outgoing traffic if not excess pre-defined no. of
    connection count
    Firewall manual control
    Allow console or remote control traffic
    Honeynet Data Capture
    Network level
    Firewall
    Network IDS
    System level
    Trojan shell
    System/Application log (ie. Syslog)
    File I/O
    Honeynet Data Collect
    Firewall log
    IDS log (ie ACID)
    Trojan shell
    Syslog
    Honeynet GenI Problem
    Fingerprint
    Connection Limit
    TTL
    Risk
    Low connection limit not equal to safe
    High connection limit not equal to unsafe
    Honeynet GenII - Improvement
    Data Control
    Connection Limitation
    Snort-Inline Drop
    If intrusion occurs, drop
    Snort-Inline Replace
    If intrusion occurs, replace attack action
    Honeynet GenII - Improvement
    Bridge Gateway
    Internet

    production

    Honeynet
    Honeynet GenII - Improvement
    Data Capture
    Trojan shell
    Fingerprint
    Capture at kernel module
    Honeypot Deployment Tips
    Placement
    outside or inside firewall
    Extensive probe
    No. of honeypot system
    Map all unused IP addr., port to honeypot
    Data in the honeypot system
    Network/System traffic, application data
    Honeypot Deployment Tips
    Security Data collected
    Modified activity log, wiping disk
    Syslog/SNMP Trap to other system
    Write-One Media (multi-session write)
    Content management
    Lookup source
    Collected data integrity
    Hash checksum
    Digital signed
    Risk Associated with Honeypot
    Fingerprint
    Fingerprint honeypot system
    Based on OS, services running
    Customization
    Honey environment does not match real system
    Victim standard system does not match honeypot
    Apply similar production system setting
    Match OS
    Realism
    Honeypot dont like real system
    Monitor network/system activity
    Real application and production data
    Risk Associated with Honeypot
    Intruders stepping stone
    Firewall, NIDS, HIDS
    Response action
    Automatically vs Manually
    Honeypot Development
    Auto-build honeypot content
    Simulate real environment
    Operation System
    Application
    Data
    GUI Management Console
    Centralized data collection
    User mode Linux (UML)
    Thank You

    Manfred Hung
    manfred.hung@pisa.org.hk

    Professional Information Security Association


    www.pisa.org.hk
    Honeynet
    A platform for studying Hacker Behaviors
    and Computer Forensics

    Alan S H Lam
    alan.lam@pisa.org.hk
    Outlines
    Objectives of our Honeynet
    Implementation of our Honeynet
    Intruders Activities and Forensics
    Techniques (with live demo)
    Deployment Tips
    Future Development
    Q&A
    Objectives of our Honeynet
    To learn from the hackers
    To give early warning of potential
    attacks
    To collect research material for our
    computer forensic lab
    To improve our skill in security incident
    response
    Existing Honeynet Network
    Infrastructure
    Implementation
    Data Control
    Egress filter rule
    IPtable rule in firewall to drop or cut Honeypot traffic
    when
    NIDS detects any attack originated from Honeypot
    Packet rate higher than R
    After N outbound connections from Honeypot
    After M packets go through the Honeynet
    An alert message will be sent to the system admin
    when the connection is cut
    Implementation (cont)
    Data Capture
    Capture all network packets in/out the Honeynet
    Capture hackers keystroke by a trojaned login shell
    in Honeypot
    Remote syslog
    Dump backup
    Firewall and SNORT NIDS log
    All data captured are stored in the firewall host
    Intruders Activities
    Identify/locate the victim by some scanning tools
    Break-in the victim through system security holes.
    The following vulnerabilities were used by the
    hackers to break-in our Honeynet.
    sshd CRC32 Overflow
    Buffer overflow in openssl
    WU-FTP RNFR ././ attack
    execve/ptrace race condition
    Microsoft's DCOM RPC (W32/BlasterA/D Worm)
    Intruders Activities (cont)
    After break-in, the hackers may
    Install rootkit to setup backdoor, sniffer, IRC
    proxy, or streaming server
    Use victim as a stepping stone to find and attack
    other victims
    Fix the victim vulnerability and undo other hackers
    jobs
    Send back the victim information through e-mail
    Propagate the attack to other victims
    Deface/remove victim web page
    Forensic Tools
    scp, dd, tar, nc
    tcptrace, tcpdump, snort
    ps, netstat, lsof, fuser, kill -STOP, pcat, ltrace,
    strace, /dev/kmem, coreography
    /proc directory
    find, ldd, strings, gbd, od, bvi, icat, elfsh
    Coroners Toolkit (TCT), Chkrootkit
    Deployment Tips
    Do not deploy your Honeynet unless
    you are sure about your data control
    Start with tight data control first
    Capture data at different levels
    Make sure your Honeynet does not
    violate your company policy
    Future Development
    Enhance the Honeynet to include more
    other OS systems
    Honey the Honeypots so as to attract
    different classes of hackers (e.g.
    building a web portal or on-line bank)
    Set up a forensic lab
    Q&A
    Questions
    Comments
    Suggestions

    Thank You
    alan@ie.cuhk.edu.hk

    Professional Information Security Association


    www.pisa.org.hk

    You might also like