Acknowledgement

1. Acknowledgement • Some contents on honeypot are from • http://staff.washington.edu/dittrich/talks/aro-honeynets.ppt

2. What Is a Honeypot? • Abstract definition: “A honeypot is an information system resource whose value lies in unauthorized or illicit use of that resource.” (Lance Spitzner) • Concrete definition: “A honeypot is a faked vulnerable system used for the purpose of being attacked, probed, exploited and compromised.”

3. Example of a Simple Honeypot • Install vulnerable OS and software on a machine • Install monitor or IDS software • Connect to the Internet (with global IP) • Wait & monitor being scanned, attacked, compromised • Finish analysis, clean the machine

4. Benefit of Deploying Honeypots • Risk mitigation: • Lure an attacker away from the real production systems (“easy target“). • IDS-like functionality: • Since no legitimate traffic should take place to or from the honeypot, any traffic appearing is evil and can initiate further actions.

5. Benefit of Deploying Honeypots • Attack analysis: • Find out reasons, and strategies why and how you are attacked. • Binary and behavior analysis of capture malicious code • Evidence: • Once the attacker is identified, all data captured may be used in a legal procedure. • Increased knowledge

6. Honeypot Classification • High-interaction honeypots • A full and working OS is provided for being attacked • VMware virtual environment • Several VMware virtual hosts in one physical machine • Low-interaction honeypots • Only emulate specific network services • No real interaction or OS • Honeyd • Honeynet/honeyfarm • A network of honeypots

7. Low-Interaction Honeypots • Pros: • Easy to install (simple program) • No risk (no vulnerable software to be attacked) • One machine supports hundreds of honeypots, covers hundreds of IP addresses • Can distinguish most attacks on the same port • Cons: • No real interaction to be captured • Limited logging/monitor function • Hard to detect unknown attacks; hard to generate filters • Easily detectable by attackers

8. Emulation of Services QUIT* ) echo -e "221 Goodbye.\r" exit 0;; SYST* ) echo -e "215 UNIX Type: L8\r" ;; HELP* ) echo -e "214-The following commands are recognized (* =>'s unimplemented).\r" echo -e " USER PORT STOR MSAM* RNTO NLST MKD CDUP\r" echo -e " PASS PASV APPE MRSQ* ABOR SITE XMKD XCUP\r" echo -e " ACCT* TYPE MLFL* MRCP* DELE SYST RMD STOU\r" echo -e " SMNT* STRU MAIL* ALLO CWD STAT XRMD SIZE\r" echo -e " REIN* MODE MSND* REST XCWD HELP PWD MDTM\r" echo -e " QUIT RETR MSOM* RNFR LIST NOOP XPWD\r" echo -e "214 Direct comments to ftp@$domain.\r" ;; USER* )

9. High-Interaction Honeypots • Pros: • Real OS, capture all attack traffic/actions • Can discover unknown attacks/vulnerabilites • Can capture and anlayze code behavior • Cons: • Time-consuming to build/maintain • Time-consuming to analysis attack • Risk of being used as stepping stone • High computer resource requirement

10. Honeynet • A network of honeypots • High-interaction honeynet • A distributed network composing many honeypots • Low-interaction honeynet • Emulate a virtual network in one physical machine • Example: honeyd

11. Gen II Honeynet

12. Data Control • Prevent a honeypot being used by attackers to attack others (legal/ethnical issues)

13. The Evolution of Malware • Malware, including spyware, adware and viruses want to be hard to detect and/or hard to remove • Rootkits are a fast evolving technology to achieve these goals • Cloaking technology applied to malware • Not malware by itself • Example rootkit-based viruses: W32.Maslan.A@mm, W32.Opasa@mm • Rootkit history • Appeared as stealth viruses • One of the first known PC viruses, Brain, was stealth • First “rootkit” appeared on SunOS in 1994 • Replacement of core system utilities (ls, ps, etc.) to hide malware processes

14. Cloaking • Modern rootkits can cloak: • Processes • Services • TCP/IP ports • Files • Registry keys • User accounts • Several major rootkit technologies • User-mode API filtering • Kernel-mode API filtering • Kernel-mode data structure manipulation • Process hijacking • Visit www.rootkit.com for tools and information

15. Explorer.exe,Winlogon.exe Explorer.exe, Malware.exe, Winlogon.exe User-Mode API Filtering • Attack user-mode system query APIs • Con: can be bypassed by going directly to kernel-mode APIs • Pro: can infect unprivileged user accounts • Examples: HackerDefender, Afx Taskmgr.exe Ntdll.dll Rootkit user mode kernel mode

16. Explorer.exe,Winlogon.exe Explorer.exe,Winlogon.exe Explorer.exe, Malware.exe,Winlogon.exe Kernel-Mode API Filtering Taskmgr.exe Ntdll.dll • Attack kernel-mode system query APIs • Cons: • Requires admin privilege to install • Difficult to write • Pro: very thorough cloak • Example: NT Rootkit • user mode • kernel mode Rootkit

17. Kernel-Mode Data Structure Manipulation • Also called Direct Kernel Object Manipulation (DKOM) • Attacks active process data structure • Query API doesn’t see the process • Kernel still schedules process’ threads • Cons: • Requires admin privilege to install • Can cause crashes • Detection already developed • Pro: more advanced variations possible • Example: FU Explorer.exe Malware.exe Winlogon.exe ActiveProcesses

18. Process Hijacking • Hide inside a legitimate process • Con: doesn’t survive reboot • Pro: extremely hard to detect • Example: Code Red Explorer.exe Malware

19. Detecting Rootkits • All cloaks have holes • Leave some APIs unfiltered • Have detectable side effects • Can’t cloak when OS is offline • Rootkit detection attacks holes • Cat-and-mouse game • Several examples • Microsoft Research Strider/Ghostbuster • RKDetect • Sysinternals RootkitRevealer • F-Secure BlackLight

20. Simple Rootkit Detection • Perform a directory listing online and compare with secure alternate OS boot (see http://research.microsoft.com/rootkit/ ) • Offline OS is Windows PE, ERD Commander, BartPE dir /s /ah * > dirscan.txt windiff dirscanon.txt dirscanoff.txt • This won’t detect non-persistent rootkits that save to disk during shutdown

21. Filtered Windows API omits malware files and keys Malware files and keys are visible in raw scan RootkitRevealer • RootkitRevealer (RKR) runs online • RKR tries to bypass rootkit to uncover cloaked objects • All detectors listed do the same • RKR scans HKLM\Software, HKLM\System and the file system • Performs Windows API scan and compares with raw data structure scan RootkitRevealer Rootkit Windows API Raw file system, Raw Registry hive

22. Demo • HackerDefender • HackerDefender before and after view of file system • Detecting HackerDefender with RootkitRevealer

23. Dealing with Rootkits • Unless you have specific uninstall instructions from an authoritative source: • Don’t rely on “rename” functionality offered by some rootkit detectors • It might not have detected all a rootkit’s components • The rename might not be effective Reformat the system and reinstall Windows!