Detecting Targeted Attacks Using Shadow Honeypots Authors: K.G. Anagnostakis, S. Sidiroglou, P. Akritidis, K. Xinidis, E. Markatos, A.D. Keromytis Published: Usenix Security Symposium 2005 Presenter: Brian Shoeman

Topics to Be Covered Why Shadow Honeypots? Why Shadow Honeypots? Shadow Honeypot Architecture Shadow Honeypot Architecture Shadow Honeypot Implementation Shadow Honeypot Implementation Contributions Contributions Weaknesses Weaknesses Future Considerations Future Considerations

Current Detection Mechanisms Intrusion Detection Systems (IDS’s) Intrusion Detection Systems (IDS’s) Limited to protecting against previously known attacks Limited to protecting against previously known attacks Anomaly Detection Systems (ADS’s) Anomaly Detection Systems (ADS’s) Pros: Large Scope (can detect scan based as well as targeted attacks) Pros: Large Scope (can detect scan based as well as targeted attacks) Cons: Low Accuracy (false positives vs. false negatives) Cons: Low Accuracy (false positives vs. false negatives)

Current Detection Mechanisms (Cont.) Honeypots Honeypots Pros: High degree of accuracy Pros: High degree of accuracy Cons: Low degree of scope (most useful against scan based or random attacks) Cons: Low degree of scope (most useful against scan based or random attacks)

Shadow Honeypots: Increasing Accuracy Shadow Honeypot only looks at traffic that is flagged by the ADS Shadow Honeypot only looks at traffic that is flagged by the ADS Shadow Honeypot checks flagged traffic and allows false positives from the ADS to be handled correctly by the application Shadow Honeypot checks flagged traffic and allows false positives from the ADS to be handled correctly by the application Decreasing of false positives through the shadow honeypot allows system designers to increase the sensitivity of the ADS to minimize false negatives Decreasing of false positives through the shadow honeypot allows system designers to increase the sensitivity of the ADS to minimize false negatives

Shadow Honeypots: Increasing Scope Shadow Honeypots can be adapted to both server side and client side applications Shadow Honeypots can be adapted to both server side and client side applications Detects random/scan anomalies as the traffic enters the application Detects random/scan anomalies as the traffic enters the application Detects passive attacks (e.g. one where a user downloads malicious attacks) Detects passive attacks (e.g. one where a user downloads malicious attacks) Detects attacks that target a specific site with a specific internal state Detects attacks that target a specific site with a specific internal state

Shadow Honeypot Architecture

Steps in the Shadow Honeypot Architecture 1. Traffic enters the filter. Known threats are filtered out. 2. Anomaly detection system checks the traffic. Possible threats are forwarded to the shadow honeypot code. 3. Regular traffic is randomly sent to the shadow honeypot to check for false negatives. Otherwise, it is handled normally by the application

Steps in the Shadow Honeypot Code 1. Shadow application accepts the traffic and checks for specific types of failures from malicious code. 2. If traffic is determined to be malicious, the filter is updated to block further attacks, and the state of the application is rolled back to its initial state. 3. If traffic is not malicious, it is handled normally, but at a higher latency.

Steps in the Shadow Honeypot Code (cont.) 4. If the traffic passed the ADS and was randomly sent to the shadow honeypot and is determined to be malicious, the ADS is updated to protect against future false negatives.

Shadow Honeypot Implementation Utilized two anomaly detection heuristics Utilized two anomaly detection heuristics Payload Sifting Payload Sifting Derives fingerprints of worms Derives fingerprints of worms If used outside of a shadow honeypot, many systems would be compromised before a fingerprint is developed. If used outside of a shadow honeypot, many systems would be compromised before a fingerprint is developed. Buffer Overflow Detection via Abstract Payload Execution Buffer Overflow Detection via Abstract Payload Execution Searches for long sequences of valid instructions Searches for long sequences of valid instructions Usage within a shadow honeypot architecture reduces risk of false positives. Usage within a shadow honeypot architecture reduces risk of false positives.

pmalloc( ) Allocates two read-only memory pages around each requested buffer Allocates two read-only memory pages around each requested buffer Protects against buffer overflow Protects against buffer overflow Ptr can be adjusted to protect against buffer overflow. Ptr can be adjusted to protect against buffer overflow.

transaction( ) Called in the main processing loop Called in the main processing loop Indicates to the OS that a new transaction has begun Indicates to the OS that a new transaction has begun Called in the main processing loop after an event has been handled Called in the main processing loop after an event has been handled Indicates successful completion of a non-malicious transaction Indicates successful completion of a non-malicious transaction Called within the signal handler Called within the signal handler Indicates that an attack has been detected. OS restores all original pages. Indicates that an attack has been detected. OS restores all original pages.

Contributions Customizable architecture can be set up to detect specific types of attacks or many types of attacks at the cost of higher latency. Customizable architecture can be set up to detect specific types of attacks or many types of attacks at the cost of higher latency. Can be tightly coupled to a client to protect against passive attacks (e.g. buffer overflow vulnerability in IE JPEG handling). Can be tightly coupled to a client to protect against passive attacks (e.g. buffer overflow vulnerability in IE JPEG handling).

Weaknesses in the Architecture High overhead (found to be up to 50% on Mozilla Firefox with scrolling page load mechanisms) High overhead (found to be up to 50% on Mozilla Firefox with scrolling page load mechanisms) Can be made vulnerable by improper placements of transaction( ) function. Can be made vulnerable by improper placements of transaction( ) function. Potential for high memory overhead Potential for high memory overhead Does not work when the process must communicate with another process not included in the transaction definition while servicing a request. Does not work when the process must communicate with another process not included in the transaction definition while servicing a request.

Weaknesses in the paper Did not discuss any specifics involving updates to the filter and ADS from shadow honeypot results. Did not discuss any specifics involving updates to the filter and ADS from shadow honeypot results. Attempted to explain away weaknesses in the architecture. Attempted to explain away weaknesses in the architecture.

Future Work Experiment with signals to the filter and ADS to reduce latency of the system. Experiment with signals to the filter and ADS to reduce latency of the system. Fine tuning of system to increase performance Fine tuning of system to increase performance Experiment with different design methodologies. Experiment with different design methodologies.