HONEYPOTS PRESENTATION TEAM: TEAM: Ankur Sharma Ashish Agrawal Elly Bornstein Santak Bhadra Srinivas Natarajan

Topics to be covered Network IDS - Brief Intro Network IDS - Brief Intro What is a Honeypot ? What is a Honeypot ? Honeypot - in a Network environment Honeypot - in a Network environment A Three Layered Approach A Three Layered Approach Types of Honeypot Types of Honeypot Honeypot and IDS - Traditional detection problem Honeypot and IDS - Traditional detection problem Honeypot as detection solution Honeypot as detection solution Honeypot implementation and an example attack Honeypot implementation and an example attack Virtual Honeypot Virtual Honeypot Advantages and Disadvantages Advantages and Disadvantages Demo Demo References References

Network IDS – Brief Intro An IDS which detects malicious activity such as denial of service attacks, port scans or even attempts to crack into computers by monitoring network traffic. An IDS which detects malicious activity such as denial of service attacks, port scans or even attempts to crack into computers by monitoring network traffic. Inspect incoming network traffic and studies the packets. Inspect incoming network traffic and studies the packets. Reads valuable information about an ongoing intrusion from outgoing or local traffic as well. Reads valuable information about an ongoing intrusion from outgoing or local traffic as well. It can co-exist with other systems as well. For example, update some firewalls' blacklist IP database about computers used by (suspected) hackers. It can co-exist with other systems as well. For example, update some firewalls' blacklist IP database about computers used by (suspected) hackers.

What is a Honeypot ? A trap set to detect, deflect and counteract attempts at unauthorized use of information systems. A trap set to detect, deflect and counteract attempts at unauthorized use of information systems. A security resource whose value lies in being probed, attacked, or compromised. A security resource whose value lies in being probed, attacked, or compromised. A Valuable system that can be used as surveillance and early-warning tool. A Valuable system that can be used as surveillance and early-warning tool.

Honeypot in a Network Environment In general, it consists of a computer or a network site that appears to be part of network but which is actually isolated, unprotected and monitored. In general, it consists of a computer or a network site that appears to be part of network but which is actually isolated, unprotected and monitored. It can also take other forms, such as files or data records, or even unused IP address space. It can also take other forms, such as files or data records, or even unused IP address space.

Honeypot in a Network Environment

A Three Layered Approach Honeypot can be defined in a three layered approach: Prevention Prevention Detection Detection Response Response

A Three Layered Approach Prevention: Honeypots can be used to slow down or stop automated attacks. It can utilize psychological weapons such as deception or deterrence to confuse or stop attacks. Prevention: Honeypots can be used to slow down or stop automated attacks. It can utilize psychological weapons such as deception or deterrence to confuse or stop attacks. Detection: It is used to detect unauthorized activity and capture unknown attacks. Generate very few alerts, but when they do you can almost be sure that something malicious has happened. Detection: It is used to detect unauthorized activity and capture unknown attacks. Generate very few alerts, but when they do you can almost be sure that something malicious has happened. Response: Production honeypots can be used to respond to an attack. Information gathered from the attacked system can be used to respond to the break-in. Response: Production honeypots can be used to respond to an attack. Information gathered from the attacked system can be used to respond to the break-in.

Types of Honeypot Classified based on two categories: Classified based on two categories: Deployment Deployment 1. Production 1. Production 2. Research 2. Research Levels of interaction Levels of interaction 1. Low Interaction 1. Low Interaction 2. High Interaction 2. High Interaction

Deployment Types Production Honeypots: Production Honeypots: Easy to use, capture only limited information, and primarily used by companies or corporations. They are placed along with other production network and help to mitigate risk in an organization. Easy to use, capture only limited information, and primarily used by companies or corporations. They are placed along with other production network and help to mitigate risk in an organization. Research Honeypots: Research Honeypots: Run by a volunteer, non-profit research organization or an educational institution to gather information about the motives and tactics of Blackhat community targeting different networks. Run by a volunteer, non-profit research organization or an educational institution to gather information about the motives and tactics of Blackhat community targeting different networks.

Levels of Involvement Low Interaction (Honeyd) Low Interaction (Honeyd) Able to simulate big network structures on a single host. With one single instance of the daemon, many different hosts running different services can be simulated. Able to simulate big network structures on a single host. With one single instance of the daemon, many different hosts running different services can be simulated. High Interaction (HoneyNet) High Interaction (HoneyNet) Network of real systems. A stealth inline network bridge that closely monitors and controls the network data flow to and from the honeypots in the network. Network of real systems. A stealth inline network bridge that closely monitors and controls the network data flow to and from the honeypots in the network.

Honeypot and IDS - Traditional detection problems Data overload Data overload False positives False positives False negatives False negatives Resources Resources Encryption Encryption IPv6 IPv6

Honeypot as detection solution Small data sets Small data sets Reduced false positives Reduced false positives Catching false negatives Catching false negatives Minimal resources Minimal resources Encryption Encryption IPv6 IPv6

Honeyd It's designed to be used on Unix-based operating systems, such as OpenBSD or Linux; however, it may soon be ported to Windows. It's designed to be used on Unix-based operating systems, such as OpenBSD or Linux; however, it may soon be ported to Windows. Since this solution is OpenSource, not only is it free, but we also have full access to the source code, which is under the BSD license. Since this solution is OpenSource, not only is it free, but we also have full access to the source code, which is under the BSD license.Continue…..

Honeyd The primary purpose of Honeyd is detection, specifically to detect unauthorized activity within your organization. The primary purpose of Honeyd is detection, specifically to detect unauthorized activity within your organization. It does this by monitoring all the unused IPs in your network. It does this by monitoring all the unused IPs in your network. Any attempted connection to an unused IP address is assumed to be unauthorized or malicious activity Any attempted connection to an unused IP address is assumed to be unauthorized or malicious activity

Example….

Configuring Honeyd To implement Honeyd we need to compile and use two tools: Arpd and Honeyd. To implement Honeyd we need to compile and use two tools: Arpd and Honeyd. Arpd is used for ARP spoofing Arpd is used for ARP spoofing Monitors the unused IP space and directs attacks to the Honeyd honeypot. Monitors the unused IP space and directs attacks to the Honeyd honeypot.

Building honeypot with UML UML allows to run multiple instances of Linux on the same system at the same time UML allows to run multiple instances of Linux on the same system at the same time The UML kernel receives the system call from its application and sends/requests them to the host kernel The UML kernel receives the system call from its application and sends/requests them to the host kernel UML has many capabilities, among them UML has many capabilities, among them It can log all the keystrokes even if the attacker uses encryption It can log all the keystrokes even if the attacker uses encryption It reduces the chances of revealing its identity as honeypot It reduces the chances of revealing its identity as honeypot Makes UML kernel data secure from tampering by its processes. Makes UML kernel data secure from tampering by its processes.

Honey Net Network of Honeypots Network of Honeypots Supplemented by firewalls and intrusion detection system. Supplemented by firewalls and intrusion detection system.Advantages: More realistic environment More realistic environment Improved possibility to collect data Improved possibility to collect data

How Honey net works A highly controlled network where every packet entering or leaving is monitored, captured and analyzed A highly controlled network where every packet entering or leaving is monitored, captured and analyzed

Virtual Honeypot Virtual machines allow different OS to run at the same time at the same machine Honeypots are guest on the top of another OS. We can implement guest OS on host OS in two ways Raw disc- actual disc partition Virtual disc- file on host file system

Most Exploited Vulnerabilities Top 5 most frequently exploited vulnerabilities with a rating of "severe." Top 5 most frequently exploited vulnerabilities with a rating of "severe."

The Five Most Attacked Ports X-Axis: Port Number X-Axis: Port Number Y-Axis: Number of attackers with the rating of “severe” per honeypot in the last week Y-Axis: Number of attackers with the rating of “severe” per honeypot in the last week

Advantages Productive environment: distraction from the real target Productive environment: distraction from the real target Can peek into guest operating system at anytime. Can peek into guest operating system at anytime. Reinstallation of contaminated guest is also easy. Reinstallation of contaminated guest is also easy. And it is very easy way. And it is very easy way.

Disadvantages Sub-optimal utilization of computational resources. Sub-optimal utilization of computational resources. Reinstallation of polluted system is very difficult. Reinstallation of polluted system is very difficult. Difficulty in monitoring of such system in a safe way. Difficulty in monitoring of such system in a safe way. Detecting the honeypot is easy Detecting the honeypot is easy

References Honeypots: Simple, Cost-Effective Detection Open Source Honeypots: Learning with Honeyd Specter: A Commercial Honeypot Solution for Windows

Thank You! We are happy to answer any questions……