Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/599 Thanks!
And I have to make an announcement.
This talk is just a honeypot.
You can organo.
They don't believe me, you see,
OK, who have you has
a honeypots.
One, two, three can have a little bit
more lights on the audience,
please, so I can see some thank you.
A couple
of you have honeypots
running.
And do you think they are secure?
Do you think they can't be used against
you?
Think again,
Dean Sesemann and
it mushier will
now present you how
honeypots can be deceived and
actually be used against you.
A one way accomplice.
OK, hello, everyone.
Unfortunately for us, Gutte
had to miss this talk, so we all make do
without him, even though he's a very
you know, he brings a lot of weight to
every talk.
If he was here, you would realize it's
funny because he's fat.
But everyone.
OK, so
what essentially are we going to talk
about, what we're going
to do is show you how
it's how a honeypot
can be used
for your advantage,
but then how it's been used before
and how we can improve on it
and what disadvantages it brings when
it's being used.
Right.
OK, so just a disclaimer.
This is a technical talk.
We're going to go into a lot of technical
material. But as you will see,
which is the surprising fact, there's
very little knowledge required
in order to,
you know, circumvent a lot of the
honeypots that's very popular
today. So the technology here is going to
be pretty basic and pretty fundamental.
And this is about us.
We all work together at some area,
all pretty, you know,
been doing this for many, many years and
this is a big part of our of our lives
and part of the community, obviously.
Right, so first of all, I just like to
talk about what the hell is a cyber
deception? It's this weird buzz word that
you would, you know, imagine like a
lawyer using and not really understanding
what it means.
What we're talking about is we would like
to be able to
take the attackers behavior and his
methodology and be able to impact
it, because if we're able to impact
that, we're able to
gain detection, mitigation,
you know, prevention.
A lot of very interesting stuff that
the Sipson gives us as soon as we're able
to influence the attackers
decision making process.
Right, so a lot of people have been
advancing this field a lot,
even a lot of German people,
Fred Cohen's deception talker was the
first thing that ever came out that
talked about deception.
Less Spetznaz and
Honeynet Project have been doing a very
amazing work. And they've really advanced
this field a lot over the last few
decades.
But what we will be talking about is how
the perception of what honeypots can
do for us today is very different than
what people usually perceive that they
do.
So what's the difference between an
attack and an attacker?
Right. An attack is a specific piece
of technology that changes very
dynamically and is very hard to capture.
And that's what a lot of the, you know,
intrusion detection tools nowadays
are trying to to figure out
how to detect. And it's very difficult.
Everybody knows about the false positive
problem and everything, but the attackers
usually have a very definitive
method of how they work.
Right. There's the first beachhead which
gets through spearfishing.
Then you do a lateral movement, the
network. You gain domain or have
credentials, and then you do you look for
the intelligence you're looking for.
Right. And this is very hard to change or
very hard to, you know, dynamically
do differently.
And this is sort of how the attacker
feels like when he's inside.
You're not or there's this fog of war
or I've infiltrated a network and
now I want to get to the information I'm
looking for.
But I have no idea what's going on.
And this is one of the only advantages
the defenders have over an attacker, and
that is that they know their network
much, much better than the attacker does.
So why not use that advantage
for your own benefit?
Right.
And if we look at this in a more
strategic way,
in the U.S. Army, in the Air Force,
they came up with this
methodology called the Loop
and other means,
observe, orient, decide
and act. And this is like a strategic
algorithm for, you know, tactical
situations.
And if you can influence the observation
period, then obviously you're able
to to influence the entire behavior
of the attacker. Right.
So so
what we basically want to do is
this. Right. Even though this is a bad
metaphor because the wily coyote usually
loses to the roadrunner.
But this is this is essentially what
deception is and what honeypots
have been trying to implement.
Right.
So this could actually
be a very big change if we're able
to deceive attackers.
Right. Because the civilian attacker
might be something that's very
economically cheap but very expensive
for the attacker, which is something
we don't have today.
And.
When we're talking about what's the
elements of doing cyber deception,
it all comes down to something very
basic, which is the decoy, which is this
one unit of deception
in a digital network.
OK, so one of the advantages
of doing this is that when an attacker
gets to a decoy and attacks it,
by definition, nobody knows about
this decoy. Nobody should be accessing
it. Nobody should be talking to it.
We know that whoever is talking to it on
our network is an attacker
or some some sort of threat that's
looking around and doing stuff he
shouldn't be doing.
And this gives you a very clear cut
knowledge about what's going on in your
network and who's trying to do stuff they
shouldn't be doing. Right.
And specifically, if you get
any new code execution than
being run on that decoy,
you know, for 100 percent
of that new code is an attack.
Right.
OK, so now we're going to go into
some descriptions,
the most popular honeypots out there are
what people call a lone erection
honeypots, and we'll go into defining
what that is pretty soon.
But what they're very useful for
is malware, known malware,
automatic exploitation, botnet
scanning and all that sort of stuff.
But they are very limited.
And the reason for that is they do
emulation of stuff on the network.
They don't do the actual stuff.
They just simulated.
And then when an attacker reaches it,
there's a risk for the defender.
And that risk is that if the defender
doesn't deceive the attacker
in, you know, 100 percent, if an attacker
is aware of being deceived,
he can use that against the defender.
Right. If you know where a honeypot is
deployed in a network and you want to
attack that network while you'll be doing
is just, you know, dossing that honeypot
because the alerts from that
will take all the attention of the
defender. And then you can go about it
whichever way you want.
Right.
OK, so what's the difference between
loaner action, nine direction honeypots,
so low an erection is, like we said, is
just a simulation of some network
protocol. Hiner action honeypots are
the actual machine themselves that the
attacker can actually successfully
attack. Right. Because we want him to be
able to do whatever he's doing and feel
like it's a real machine.
And now for like a little
understanding and terminology
as being able to fingerprint a honeypot,
is that a vulnerability?
Well, it's it's an interesting
question because, for example,
TOR has a lot of code execution
vulnerabilities.
These are pretty obviously
vulnerabilities. But in Tor, what we're
actually interested in finding is
the user's original IP.
Right, because that's the objective of
TOR. So, for example, if you could find
the specific IP avatar user, is
that considered a vulnerability?
Well, we feel it is.
But, you know, terminology here
is pretty it's pretty gray
area, right?
OK, so when we're talking
about Lunner honeypots, those are just
simulations of network services,
right, could be Sambi, assumptive
stupidness, all the popular stuff
that hackers are looking for and wanting
to exploit.
It's pretty easy. Just basically what
happens is people write some sort of
script that implements
the protocols behavior and the way it
answers queries and everything.
And then we can see who's talking
to us. And that way we can monitor
what's and Tucker, what's not.
High interaction honeypots are the actual
systems themselves.
So, for example, if I'm trying to show
an S&P server, what I'll be
doing is actually have a real
assumptive server running.
And the difference is that this is much
harder to monitor.
Right. For example, if you put a Windows
machine and try to monitor all the SMB
traffic to it on the network, it's
insanity, right? Because the amount
of noise is incredible.
And then we again go back to
the regular problem of, you know, false
positives and how to differentiate noise
from stuff that isn't noise.
OK, so when we started the thing,
we tried and found out who else
knows how to find honeypots
and networks and Shodan
has this interesting website which
is called Honey Score.
And any score, you give it an IP and then
it tells you if it's your part or not.
And we started playing around with this
and we couldn't get it to say something
as a Hunniford. Right.
So we actually created online
public facing IP with honeypots
and gave it the IP and it couldn't detect
that it's a honeypot.
So we tried to figure out what does it
actually detect?
And then we found out about
something called comput.
Right. So Kampot is a skater
type honeypot.
What it does is it looks like a skater
machine, but it only implements a very
small part of the protocol.
And what happens, one of the showdown
guys did some research
into how it works.
And he found out that every Canepa
implementation out there has the same
name, which is Mouser Factory.
Right. Which is not very deceiving.
But then somebody figured out that that's
the default and people made it
configurable. So you can change it to
whatever you want. Then there was
another guy online called
Sean Murdunna, who found out that they
all have the same serial number.
And this is also not configurable.
So if you go on Shodan online,
you put in this number,
you find a bunch of honeypots deployed
around the world which are right.
And then when we try it and took one of
those ideas into show, then we finally
got it to recognize that it's a honeypot.
Right. So other people have been trying
to attempt this because it gives a lot of
value, but
it doesn't really work for most of the
honeypots out there.
OK.
OK, somebody in the audience asked me to
talk slowly, so I'll try.
Thank you.
OK, so what we will be doing
is going through each
project of.
What we'll be doing is going through
a lot of the popular honeypot projects
from the most simple
implementor ones to the most complex ones
and show how each gives
you another layer of deception,
but how we use
that layer and, you know, circumvent
it or use it to our advantage.
Right. So we start with artillery
or artillery is a pretty cool
project. What it does, it's very popular.
You just run it on a system.
And what happens is it opens
up all the ports that are closed that
look like something that's interesting to
an attacker. Right.
So SMP, DNS,
HTP, whatever.
And whenever somebody is trying to access
one of those ports, what happens?
Is this right?
So it just gives you random
information when you're trying
to access one of the ports that
artillery set up and
then it blocks you away the way it boxes
by putting in a rule in the IP
tables for your IP.
Right. So the thinking is I'm defending
in a network. Right.
And I want to do a honeypot on all my
machines. I run artillery.
And then if somebody is trying to exploit
stuff against, I don't know, assumptive
servers, they'll hit one of my machines
and then they'll get blocked because
the IP tables are all blogsite.
Right.
Obviously, this doesn't look
very deceiving.
Right. If I'm in a network and
I'm trying to talk to some sort of port,
this doesn't look like SMPTE.
And like I said,
what it does, it just gives you random
data.
No real deception being employed, but
it blocks the IP that it sees.
Right. This is very dangerous.
The reason for that is if the network
doesn't have any protection against
network spoofing, you can spoof
any IP you want and artillery
will block it. The reason being is you
can just send it to packets with the
source. IP changed
and it doesn't try and connect back to
the original source and see if they're
true. Right.
So just by sending two packets,
you can make the machine that's running
artillery block any IP one.
And this even works for the gateway.
Right? So you can just
make it drop from the network completely
and not have any network connectivity.
All right, so what can we learn from
artillery's work is that if
there is a port and nobody should be
touching it and
somebody is touching it, then that's an
indicator of attacker activity.
And so how does so now let's
switch our hats and fingers attackers,
now that we know that artillery is out
there. What do we do?
So now we need to consider every
place we're connecting to.
Might be a trap and we need to check
if it's actually real.
Right.
OK, and next,
we go to Bear Trap, so
bear trap actually
implements some of the services
it's broadcasting and tries to make sense
of it.
The biggest one is trying to implement is
exactly right.
And when you talk to Bear Trap on FTP,
you get this banner.
Now, if you know a bear trap
is a honeypot getting the spanners
sort of shooting yourself in
the foot. Right.
It should have just said, hi, this is a
honeypot.
Right.
So this is bad,
but actually the banner is configurable
so you can change it to do anything you
want. But getting
this is the default is already pretty,
you know, not considering how to actually
really deceive an attacker.
So another thing we tried to find
out that isn't configurable and
ultimately the bear trap
is that anything you give is
an FTP protocol.
Command just returns five three
zero. OK,
this makes no sense in the definition of
the protocol. So no
other service in the world should be
acting this way. And this is a clearcut
way of detecting bear trap.
Right.
By definition, the protocol, when you
give it a user command, it has to
it has to return a
specific answer and returning
five three zero doesn't make any sense
because it's not a specific answer that's
expected.
So this detects
Birchgrove very effectively.
Right. And if we look at
other FTP servers like VSV DVD,
which is very popular, what happens
when you ask for certain stuff?
It replies with a certain reply,
right.
Cool, so
Birchip also suffers from the same
problem with WiFi spoofing as
artillery does the exact same thing
as soon as it sees somebody connecting to
it. It asks for the user and password.
As soon as that is is passed on,
it blocks you through an IP tables rule.
And of course, it doesn't check anything.
So if your IP spoof, you can also drop
that machine completely from the network.
All right, so what did we learn from bear
traps work is that if you implement a
service, it's much, much smarter,
much more deceiving to an attacker.
But now if we're looking at this from a
terrorist perspective, I should be
looking for indicators of deception.
Right. So now attackers should be looking
for the stuff that would make it obvious
that this is a honeypot like that
bear trap part and the banner.
Right.
OK, so now we get to honey,
honey, this is probably the most
well-known honeypot,
what it is, actually, it's more, much
more of a platform than an actual
honeypot.
And this is pretty cool because it
makes you able to write different,
different things into honey.
So essentially, you can create different
types of network services and for
each network service you
put in a script that implements that
protocol.
Right. But the problem is that,
honey, this comes with a lot of
default protocol scripts,
which everybody use because you don't
want to be, you know, replicating very
well-known protocols like FTP
or something for DNS or associates
or whatever.
And in these protocols, you can find a
lot of very easy ways to fingerprint on
it. Right.
So first of all, when you use
Honeydews for something that resembles
a NIYA server, there's this
command on the top that
Hundy tries to implement because it's a
way that a lot of automatic online
scanning tools use to try
and find ways of getting
lists from IRS servers.
This was an old vulnerability.
And I guess what happens
is it returns the exact same
reply every time.
And if you look at the modification time
on those files, this is a server
that nobody has been nobody has touched
in over 15 years.
Right. So first of all, this is not
very believable.
And secondly, very easy
to fingerprint in order to to
detect honeybees.
Right. So
if we look at the other sort of
protocols, there's a lot of other
ways to fingerprint.
For example, the FCP doesn't
support the deal eckermann which
lets you delete files.
I'm assuming they did this on purpose
because it's very scary to enable
deletion of files on a honeypot, because
if you have any sort of bug in
that, you're really risking your system.
Secondly, DSH script for some reason
doesn't do anything.
It just opens up the port and doesn't
reply at all.
So that's another way of detecting it.
And in any case, it will be very obvious
to the attacker that this is an idea.
Right.
So how would I go about fixing that,
for example? And I guess I would just
return an empty duelist.
And you have to really realize
that there's a lot of information that
you have to make it believable, both
the timestamps, the byte counts and
the volume serial number, you should
randomize them periodically.
That's the only way to make it look like
it's actually real.
Right.
And what can we learn from honeydews work
is that if we implement the
service, we have to give no obvious
indications.
And as you realize, there's no place in
the reply's of any that.
Right. Hi.
I'm a honeypot like Bartrop, which is
a huge step forward,
but not from an ethical perspective, is
not every service that we're talking to.
We should be looking if it's partially
implemented or actually really
implemented.
Right, so next up is Nova
Nova. It's pretty cool what
it does is just essentially use honey
in a more solution type
perspective. So it takes it gives you
this very cool user interface
where you can create machines and look
at the logs and they have pre
configurations.
You can instead of just running specific
scripts for specific parts, it
actually does a full blown machine so it
can create a Windows machine, a Linux
machine and whatever, and it
looks like actual real machines on the
network.
The problem is when you create a Windows
machine, the default windows config
has no net by US service
script now, not by us is a very
old protocol which exists on every
Windows machine.
And there's a lot of usage in the
networks for Windows machines
using bios for network
discovery.
So what happens is what Nova does
in its basic configurations default
configuration is create an open
port for net bias and allow
connections to it, but it doesn't
implement the service at all.
So there's this open port which you can
talk to, but it never gives
you any answer.
This is a situation that would never
happen on a Windows machine.
The only two options is either would talk
to you or if it's firewalled off,
then the port would seem closed.
Right. So this is something that
clearcuts shows that this is Enova
Windows machine. Right.
A possible fix for this is maybe
including the latest version of
Honeydews, which also has the Nebbiolo
script implemented or just not
opening it. So it looks like it's
firewalled, right?
So what can we learn from Novas work is
that we should implement a service
completely, right?
Not from an attacker's perspective.
We learn that we should look at the
set of services completely.
Right. Make it seem like it's
one whole machine and then realize
if it makes sense.
OK, now for kippot, so keep
it pretty cool, keep it was
a medium interaction
SSA pod, which means is it actually
gives you an associate shell,
which you can use.
But this is only partially implemented,
of course, because it's being monitored.
So there's been a lot of research over
the years and how to detect as S.H.,
one of the ways is that
people have been talking about is
obviously like we've been discussing, a
lot of the commands aren't implemented.
But one of the comments that is
implemented is you get
the reason you get is implemented
is because when an attacker accesses
that SSA honeypot, you want
him to be able to download
his tools, his malware and stuff.
He wants to run the machine.
So they're actually implementing W again.
And this is a pretty big issue because
this could be used for deducting
other machines through the SSA
Chani parts that could be used to scan
other parts of the network.
And basically you're getting your own
relay against the
Web for everything on
HTP that you can use for yourself.
So and this is a big problem,
right? Another thing that people have
done is they look at how kippot does
DSH authentication.
Right. And as it turns out, this
is the part from kippot source code.
This is a fingerprinting
problem that's been fixed already.
What it does is it gives
you when you ask at which protocol do you
want to use it, it just says, I
support everything.
Right. And this this doesn't work in the
way that most or all of the SFH
Kether key, you know, exchange
mechanism works.
Right. So this is very Clear-cut
recognizing Cupo.
And after all those fixes, we were
interested in looking for something that,
even after all that still
identifies kippot.
So we found a few things.
One is that if you run the command,
you name, it gives you the same thing
all the time. The only difference that
it does is it changes the name of the
machine that you chose in your
configuration.
Now, this is pretty cool because it gives
the compile time of the kernel.
This is a pretty unique identifier.
So if you use the string
and look it up on Google,
what you get is a lot of people
who are I.T.
admins who are connecting to stuff on
their network and they're saying, guys,
this is a necessary machine
on my network and it's acting really
weird. I have no idea what this is.
Here's the other name. If you guys can
figure out what's wrong with it,
which is pretty funny.
So a possible fix for this issue
is either give the actual machines,
colonel timestamp, which
kippot is running on or just
randomize it from a logical set.
And what can we learn from people's work
is that now the honeypot
not only gives you indication of
the attackers activity, it also tries
to collect information from him.
And this is pretty cool because the
more information we get from the attacker
that we can say this is the attackers
toolset or the stuff he's doing, we
can create stronger mitigation.
Right. Because if there's an effort
that's attacking us and they put the
sample on that SNH
kippot machine and we block that
sample, now we gain some sort of
mitigation.
And if we look at an attacker's
perspective now, not only are we
in danger of being detected now, we're in
danger of being caught right or
mitigated against that network
we're talking.
OK, and the next step is now
Deonna is a very impressive project,
if I go ahead and read the description,
the nails intention is to trap malware
exploiting vulnerabilities exposed
by services offered to a network.
The ultimate goal is gaining a copy
of the malware.
And this is exactly what we talked about.
The ultimate goal of of deception
against attackers is gaining their
tools, right? Gaining the malware,
gaining the CMC server, gaining the
exploit the credentials, whatever,
whatever. Right.
And this will
in the end lead to effective
mitigation, which is very,
you know, the holy grail of security.
So there used to be
a very easy way of detecting Donia.
If you would scan the idea with an EMAP,
you would get an obscure server
that says I'm a Adania honeypot
mesoscale server.
Again, this is a problem since it's
obvious and this is not
a very good way of deceiving attackers
if and this
is has been fixed in the past.
It doesn't do that today.
But something very interesting, we
realized when we were researching Denia
and we talked to Marcus, the maintainer
of the project was a very awesome guy and
they're doing a lot of very cool work.
Somebody sent Marcus.
He told them, when
I'm working with Denia, there's a lot of
stuff that doesn't behave like
the usual thing I would think
is behind the honeypot would behave.
Right. There's a lot of stuff that behave
weird and people could detect the
honeypot through that.
And then he says by the end,
which is something interesting.
Well, I'm totally aware of the problems
you point out.
But besides from these three are just the
tip of the iceberg.
There is very little I can do about
it. And this basically means that
all the people maintaining the honeypot
different projects realize that
this never will never be able to
receive an advanced attacker.
Somebody who's aware of
he might be interacting with a honeypot.
We'll always have ways of detecting
lone Aarakshan type honeypots.
Right. So, for example, in India,
something new that we discovered
is that when you run, the troops
serve a service in Dianella,
it's signed by a certificate
and that certificates issuer
is as you, Earl,
which is not very deceiving.
Right.
Secondly, if you use the FCP service,
it allows you to log in using any
username and password combination.
I have yet to see an authentication
mechanism that allows two different
passwords for the same user.
So that's another way of detecting it.
And obviously another way is that
if it doesn't implement the Daehlie
command, just like I do.
Right. So there's a lot of way of
detecting Donia.
What can we learn from that?
And yes, work is that they try and make
their services exploitable
to known exploits.
So, for example, they have a way of
capturing Conficker and Blaster and
all these really popular worms that
exploit different services.
And what they do is as soon as the attack
happens against the service, they capture
whatever code is being executed.
And now this affects an
attacker by realizing if I'm exploiting
a new machine on the network,
my, you know, old
mouse zero eight zero
sixty seven Conficker exploit,
which I'm running and then executing
my own malware through,
might cause me to lose my malware
because they'll be captured by Dounia.
Right, next stop is
off, which is
a Web
app type honeypot, right?
So what Glaslough tries to do is look
like a Web application
for different kinds of languages and
just see whoever is trying to do
web web type attacks against
it. Right.
When you set up Gless stuff and you look
at the default page, this is what it
looks like and
it's actually Glaslough.
It's very configurable and allows you to
load in almost any
type of file system or web application
that you want. But if you were on a
default li, it just gives you a very
weird page that not a
lot of people change.
Right.
And if we look at the bottom of it,
there's this signature which doesn't
change. Most of the text here is just
random from a
list of a dictionary.
But if we look at the bottom, there is
a Futer that says this is
a really great entry.
Right. And this this doesn't change
across pages.
So I just took that string and looked it
up on Google
and I found some some really interesting
websites, which I won't I won't reveal
here.
But one of the top 500 websites
had this in his subdomain.
Right. So assuming it's like a really
popular website, if I go to one
of the subdomains DOT, really
famous website Dotcom,
this is the page you get.
Right.
Which is very interesting because
they're deploying honeypots, but not in a
very smart way. So they're very aware of
security, but they're not aware that
deploying those honeypots just creates
less deception for the attacker, not
more.
So how does blastoff work?
What it does is any sort of
web interaction against it logs it
and for specific stuff, it gives alerts
and you can actually create any sort
of file system within it because
it implements directory traversal
exploit. Right. So if you do,
for example, if you go and type in
the address for the glassed
off and do slash and then
dot, dot, dot, dot, dot, dot, slash,
ATC shadow, it actually gives
a file that you can configure and put
in within its shadow.
Right. And this is the default one.
And I would say this is the way to
fingerprint stuff
because this is configurable.
I don't want to be able to say that.
And I want to try to find a way to
fingerprint dust off without
the user being able to change it.
Right. So
so something that you figure out is that
if this is a Linux machine that gives you
its shadow from the
permissions that you get and how Linux
is built, you should be also
able to access proc.
Right. And if you're able to access
proc, this is something that's very hard
to simulate
for the people who are configuring
that cluster of implementation.
Right. Because first of all, you have to
put something in the file system.
The glass stuff will give as
an answer for proc.
And secondly, once people have realized
that this gives the actual
answer, it has to fit
the actual process, running less stuff
because that process is within
proc. Right. So, for example,
if I would go ahead and look at all
flesh proc and all this lipids
and flesh as maps, I could find
glass stuffs, own
memory statistics.
Right. And I could use this to see if
this is actually correlating to
what I'm seeing on the website by
doing more HTTP requests
and stuff like that.
So no matter what, I'm able
to realize this is not a real server
unless there's an actual real server
behind us.
So this is a way to always detect
stuff without
doing any any, you know, configurable
stuff.
And the way I would fix this is
just return permission denied on.
But this this, again, doesn't make
sense in a Linux sort of way, so
it's not an actual real fix.
And what can we learn from Glaslough
work is that Glaslough is the first one
that lets you actually load the file
system for that machine.
So it's not only giving you network
type services to deceive the
attacker, also the actual machine's
content. Right.
And for an attacker, this
risks you an attribution.
Right, because you have an online
connection against the machine and you're
putting in stuff into the file system,
which you are interested in.
So, for example, the vendor could put
different types of files and see which
files are being taken and where
they are taken to.
Right. And the last one is calf senseor
now calf sensor is interesting because
it's a it's an actual product.
It's a honeypot for Windows.
It's not open source.
It actually costs money.
It's been around for I don't know, I
think like more than 10 years.
If you go to its website, it's it looks
like AOL in the year 2000.
But actually a lot
of people are actually buying and
using it and it works
somewhat well and gives you this
very large
graphical interface, which you can
use and configure
almost every single type of service on
a Windows machine that you'll want.
But it's pretty weird for for a lot
of reasons.
When you do the default configuration,
it gives you alerts on broadcast
requests.
So this is pretty bad because
essentially what it means is you'll be
getting alerts all the time automatically
as soon as you put it into the network.
And the default configuration for
the software also makes
this siren sound as soon
as there's an alert.
So whenever we were working
with it in our research,
you would just set it up and
you would just hear this
all the time going on.
So they gave us the last. Awful, awful.
It was horrible.
Yeah.
So give us a lot of humorous moments
during our research.
So how do you identify the
sensor?
So if you set up the HTP service,
it gives you this default website,
which you can just again Google up online
for the social code and then you find a
lot of different of sensor
deployments because this is the default
website that nobody else has
when enabling https.
The port is open, but it doesn't
implement the service at all.
This is similar to what happened in some
of the other examples we've said,
and it also has a configurable amount of
concurrent connections before it blocks
somebody and then it's vulnerable
to what we talked about.
That bear trap and artillery are
vulnerable for that.
If the network doesn't protect from IP,
spoofing just allows you
to drop machines from the network
as much as you want.
OK, so what can we learn from Kev, since
his work is that even outside the open
source ecosystem,
the issues are still the same.
So this is not something that just comes
from being open source projects.
This is from any type of Huntelaar
interaction. Honeypots is trying to be
implemented.
Cool, so now after we had
all these types of ways of figuring
out deployment and how to detect
honeypots, we said let's just look
everywhere in the world at honeypots are
deployed. Maybe it'll be interesting.
And what we did was we used
the Zema project, which is
a way of scanning all the Internet
very quickly, and we took one of their
scans, daily scans for HTTPS
certificate information, and
we did it for one day.
This was for the Fourth of July
in 2015.
And we looked at who would have
the Dionna certificate,
which is the remember, a dionysiac.
That carnivore done it.
Right. And every Web site that has that
as HTP is by definition Adania
honeypots.
Right.
So this is the results,
not very high resolution.
It's very obvious to see that the most
honeypots in the world for that day
that are Dianella is Taiyuan second
place, the United States and then all
the other countries are pretty,
you know, much
less significant.
This is the complete country,
no deployment
the way we figured out which
country belongs to which IP through
regular geolocation IP
methods. So this hinges on the
validity of those methods.
And there's a few interesting stuff here.
For example, you can see a lot of
countries you wouldn't expect to have
honeypots like Tanzania or
Zambia, which actually
have more than 90 percent in Russia, for
example, other countries,
which you would think are here, are not
like Israel, my own country, which does a
lot of cybersecurity
and some interesting countries like Iran,
for example, which we will go into
shortly. So
then we try and figure out which
organizations are hosting
these honeypots.
The biggest one was there is one
Taiwanese ISP that hosted
a huge amount of honeypots.
I'm thinking just the guy there really
loves Diana. He's like, oh my God, every
every spare IP I have.
I'll just forward to a digna
machine.
I think there's another guy just like him
in the United States and one of the
universities I'd love
to get those two guys to meet.
That would be an interesting meeting.
Another one in Taiwan, another
university there.
And one of the more interesting ones is
that there is one of the top cloud
providers had
80 honeypots in his network.
But what's interesting is they publish
what IP ranges
the cloud is then.
And there's the other IP ranges, which
are part of the organization that aren't
part of the cloud. And some of the APIs
we saw for honeypots were not in
the cloud range. So it's either hiding
what's the real cloud rangers' of it
or it's just honeypots within its
corporate network.
Right.
Some specific interesting organizations
which we've anonymized,
there's a ministry of defense here on the
European countries, an international
economic organization, one of the U.S.
municipal authorities, and a South
African financial services company,
which is a pretty random list.
I have no idea why, but it's
interesting to see some more
organizations, Taiwanese
government authority and the computer
manufacturer, a Japanese infrastructure
project, another Cambodian
government authority.
And there's actually a malware research
blog.
And this is an interesting story.
I go into the blog and it
hosts Emax Zero
Dot, the name of the blog as
Dianella, so it to look like one
of its mail servers as Dahaneh.
And then when I went into the blog
itself, the guy was talking about
how he was capturing malware samples,
using honeypots he was deploying.
So it's pretty funny. I
thought about doing something and then
seeing if I'll blog about it again, but
then I decided it's a little too much
into the blackhead territory.
And one of the the only organization
that we will reveal,
the Iranian oil company,
does deployment for Dounia,
it's actually one of the subdomains for
oil that I IRR.
So I guess the guy
running the Iranian National
Oil Company really likes cybersecurity
and he has Ninia
deployed in one of its subdomains.
So when I saw that oil
that our website has
Digna, I said, let's go into a
site that it also serves not only
tips. And then I, I was interested
in seeing what I'll get when I'll
log into it and guess what I got.
So this is the default website for
GLAST Off, and I said it has
on next steps and it has left off
and HTP maybe there
some sort of something that packages
a lot of honeypots together.
And then I came across something called
the modern Honi Network.
So the modern Honi Network is open source
project at a company called Threat
Stream. Does basically does is just
packages a lot of different honeypots
and scripts into one machine,
which you can just run, you know,
deploy honeypots and then you gain a lot
of the default type configurations
of a bunch of honeypots.
So lessons learned.
Right, so these flaws are really easy,
really simple to find
they are by design, so no low interaction
part can avoid having these type of
flaws.
And what we're realizing is if
an attacker is aware of deception and
he's looking for deception, specifically
loan rection honeypots will be able to
find them and detect them and use them
against the offender.
Right. So
what can we do to
do this better?
Right. What would a good way of doing
deception would look like?
So let's just go through
every single layer that we did and see
what was the cause of of
the problem. Right. So first
of all, we need to supply the service
itself.
Then we need to supply the
whole service. So implement the entire
protocol.
Then we need to make the set of services
make sense as a complete machine.
Then we need to make that service
exploitable for non exploits,
so the attacker will actually succeed and
will gain his his malware that's being
installed, then
hopefully what we would want to do is
make those services exploitable to
unknown exploits like days.
And the problem with that is that if you
don't know how the old works, how
do you simulate the way
of being exploitable to it?
Right.
And the future fantasy is that the
machine is an actual real machine in
every way and form for the attacker.
Right.
But this causes the problem of how do we
monitor the attacker going into
it and how do we avoid all the noise that
a real machine has.
And I made a pyramid of what
it looks like, all the stuff
of Relayer you need to implement in order
to have that, you know, optimistically,
best type of honeypot or deception
or decoy against an attacker.
We'll be releasing called when
responsible disclosure is concluded
and all the projects can fix all the
different issues,
and we really just want to thank
all the different people who have been
advancing honeypots over the years
because you gain a lot of value
from running those projects.
And they took a lot of work.
And what this talk was about is bringing
that view
that it helps against the low level
type of attacks.
But the high level type of empty
threats will not
only not be deceived by it, but can you
use it against the offender?
And that's what our talk was generally
about.
All these people helped us
in our research and we thank them a
lot. I won't read all the names because
it's just a huge list
and that's it.
So for any question,
please come in front of the microphones,
are you already did?
That's nice.
OK, let's start with the microphone one.
Yes, so hello, thank you.
Following your talk, there is a very
simple idea I had directly in my mind.
What I would do is I would copy
some of the mistakes of the honeypots in
my real system that is completely nice.
And I would fix some of the problems
you have discovered in the honeypots and
this mix I will present to the attacker.
I think this will be fun.
OK.
But I think the one thing that is worth
noting is that some of the honeypots
projects actually had a decent
they provided decent deception
tactics.
But if you just
deploy the default configuration
without thinking about it and just
thinking I'm secured, then this is
not the good thing to do.
So you just need to really
think about the consequences of what
you're doing when you're deploying and
how to put to a question
from the Internet.
Yeah. So it's more of a remark.
So using
a default configuration is not exactly
the software flaw.
So if you are too lazy to change or the
the better text and are
too lazy to change the file system and
kippot, for example, and just take the
default of everything, then yeah,
people identify you.
But changing these default configurations
would individualize
your honeypots. So
the fingerprinting probably wouldn't
work, right.
Yeah. So this is this is true.
Remarque for every project that we've
researched, we have a way of
detecting it, no matter which
configuration it has.
The reason we mentioned the default
configuration problems is that like
we saw, there's a huge amount
of people who deploy the default
configuration. So optimally,
you would want to default configuration
to not be that easily detectable.
But it's true that you should never count
on the default configuration being used
or, you know, change it to individualize
that. That's a very true Remarque.
Microphone two, please.
Wouldn't it be a good idea to use an
actual years of DVD and write
Amodeo for it to emulate the fire
system of something like that?
Yeah. So basically, this is this
is like a trade off, right?
If you do an emulation, you're exposing
yourself to the risk of being identified.
Like we said, by definition, when you're
doing emulation, for example, zero
day vulnerabilities will not work.
So there's always a way to identify you.
If you do the actual real machine,
then the problem is how do you
differentiate the noise and the
regular stuff going on from
what an attacker will do?
Or, for example, how do you even see
the attackers interaction if you don't
monitor every part of the protocol?
Right. So, for example, and kippot during
DSH key exchange,
you wouldn't be able to figure out what
he was doing or something malicious,
because it's something that you don't
know is an attacker's
interaction versus just, I don't know,
like something that's scanning the
network or something like that.
Right.
Microphone four, please.
OK, so what if I turn it around?
What if I make my real services
look like honeypots and like
make them give up before trying?
That's a very cool idea.
There's actually a friend of ours who
does a startup who does exactly that.
He makes the real machines look like
honeypots and that way he tries
to make it work or not attacked them.
Yeah, well, I do.
Microphone one, please.
Well, I didn't quite understood
how I got the attacker to attack
my honeypot on my real website.
Yeah, so you're talking
about what Wah
Honeypots is trying to solve is if an
attacker attacks a machine, you control,
how now you can detect him and,
you know, realize that he's an attacker.
But you're talking about a problem that's
underlying and it's very big.
But we didn't discuss it.
And that is how do we get the attacker to
actually attack that honeypot?
So you have to make it look like
something interesting.
One of the examples we gave, for
example, that malware researchers blog,
what he did was gave it an interesting
subdomain under his
domain to make it look like a mail
server, DMX zero of
his domain, which is the default name for
male servers.
But this is a whole other issue
that you have to solve when you're doing
deception, which is very true.
The question from the Internet, please,
so have you actually broken any
honeypots in your research?
So we weren't trying to look
for code execution
type vulnerabilities,
firstly, because it doesn't give you any
sort of any sort of value.
What we're trying to do more is more like
a methodological
type of conclusions.
So we didn't try.
And so we don't know if there are or
aren't.
Microphone number one, please
just answer to the question the other
gentleman asked and you said, how do you
tell if it's an attack?
One method I'm using is I
you say actual secure shell,
but use a pump module that
watches for standard, you know,
the top 10000 standard passwords
that people try when they're trying to
brute force.
OK, it doesn't you don't get to steal
the malware or anything.
But if you have that within your network
and you see someone trying to log onto
your S.H.
with those passwords, you know, you're
going to have a bad day, you know,
someone in your network.
So that's one method of you would know
that was an attack because it's
not someone mistyping their password.
It's an actual well known brute force
password.
Yeah, this is true.
This is one of the basic methods of doing
the interaction honeypots
which are actually real and believable.
No call.
And any more questions?
Yes, the Internet has some more
questions.
Just one short one.
So would it be a good configuration
to take one default
honeypot and then several individualized
ones to make the taker
believe that the individualized ones
are, you know, more real?
Well, the interesting thing
about deception is there's so many ways
to do it and there's so many ways of,
you know, thinking
about what's the perception of the
attacker and using it against them.
So, yeah, there's a lot of stuff you
could do.
And one of the basic things that you need
to take into account when you're talking
about deception, there is different
levels of deception.
If, for example, what you're trying
to dealing with is mainly script kiddies,
then you don't need to deploy interaction
any parts and real machines, which is
pretty costly. You can just deploy
the honeypot that we discussed about,
just not with the default
configuration that is obviously broken.
You have another question from the
Internet. No, any other questions
from the room?
No, I closed the talk now.
Thank you very much. Thank you very much.