1. KFSensor Vs Honeyd Honeypot System Sunil Gurung
[60-475] Security and Privacy on the Internet
KFSensor Vs Honeyd
Honeypot System

2. Agenda
Introduction
Honeypot Technology
KFSensor
Honeyd
Features
Tests
Conclusion

3. Introduction
Good Defence is Good Offence
Network security – Firewall, IDS, antivirus.
Traditional approach – defensive
Today – offensive approach
Honeypot solutions

4. Honeypot Technology
“A honeypot is security resource whose value lies in being probed, attacked, or compromised.” - Lance Spitzner
we want attackers to probe and exploit the virtual system running emulated services.
System no production value, no traffic, most connection probe, attack or compromised.
Complements the traditional security tools.

5. Fig:
The basic setup up of the honeypot system. In the figure two KFSensor are configured production honeypots.
Figure taken from “ User Manual of KFSensor – Help “

6. TYPES of ATTACKERS
Script Kiddies
Amateurs, don’t care about the host
Educate the inadequacy of the security policy
Blackhat
Focus on high value system, more experienced
More dangerous and operate silently

7. Types of Honeypot Low Interaction High Interaction
Interaction: level of activity Honeypot allows with attacker
Low Interaction
Emulated services, easy to deploy and maintain, less risk.
Designed to capture only known attack
High Interaction
Setup real services and provides interaction with OS
More information, no assumption made give full open environments.
Can use the real honeypot to attack others.
Symantec Decoy Server, Honeynet

8. KFSensor
Commercial low interaction honeypot solution
Windows OS
Preconfigured services: ssh, http, ftp etc
Easy configuration and flexible
Components of KFSensor
Scenarios, Sim Server – standard and banner

10. Low interaction, open source Developed by Niels Provos of U of M
Honeyd
Low interaction, open source
Developed by Niels Provos of U of M
Features: service emulation and IP stack of OS
Product Detail
Software: honeyd
Version: honeyd 0.8
License: open source
Download site:
OS: Windows, Linux, Unix – Solaris

11. ARPD, Libraries Dependencies Libevent-0.8a.tar.gz, libpcap0.8.3.tar.gz
Installation
ARPD, Libraries Dependencies
Libevent-0.8a.tar.gz, libpcap0.8.3.tar.gz
Honeyd package
Installation process:
# tar -zvxf libevent-0.8a.tar.gz
Compile the libevent:
# cd libevent-0.8a (Note: pwd is /honeyd_packages/ libevent-0.8a)
#. /configure
# make
# make install

12. Major Differences between the two software
IP address assignment
Listening port
OS emulation
Open source advantage
Financial value

14. How it works Configuration File Nmap.print & Xprobe2
Script for running the services

15. Explanation of Configuration file
# Example of a simple host template and its binding
annotate "AIX " fragment old
create template
set template personality "AIX "
add template tcp port 80 open
add template tcp port 22 open
add template tcp port 23 open
set template default tcp action reset
bind template

16. Nmap.print and Xprobe2
# Contributed by Felix Lindner
Fingerprint AXENT Raptor Firewall running on Windows NT
TSeq(Class=TR)
T1(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T4(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T7(Resp=N)
PU(Resp=N)

17. Test Environment Inside the router 1) University network
2) Home network: putting the honeypot system inside the router [ ]
Various test performed:

18. Testing Honeyd
IP of honeypot:
IP of host running the honeypot:
Running ARPD
#arpd \24
2) Running Honeyd
#honeyd –d –f config.sample –p nmap.print –x xprobe2 –l \”Log File” –I 2

19. Test 1: FTP (KFSensor)

20. Test 2: FTP honeyd

21. Other possible test (Network Topology)
route entry
route link /24
route add net / latency 55ms loss 0.1
route add net / latency 20ms loss 0.1
route link /24
route link /24
create routerone
set routerone personality "Cisco 7206 running IOS 11.1(24)"
set routerone default tcp action reset
add routerone tcp port 23 "scripts/router-telnet.pl"
create netbsd
set netbsd personality "NetBSD running on a Commodore Amiga (68040 processor)"
set netbsd default tcp action reset
add netbsd tcp port 22 proxy $ipsrc:22
add netbsd tcp port 80 "sh scripts/web.sh"
bind routerone
bind netbsd

22. Results – take from the abstract
$ traceroute -n
traceroute to ( ), 64 hops max
ms ms 0.93 ms
ms ms ms
ms ms ms
ms ms ms

23. Conclusion
Both are low interaction
Honey with better feature like IP simulation and OS IP stack simulation
KFSensor better GUI easy configuration
Can not replace the existing system. Work better along with it.