Honeypots and Honeynets

1. Honeypots and Honeynets Source: The HoneyNet Project http://www.honeynet.org/ Mehedi Masud September 19, 2007 Lecture #12

2. Why HoneyPots A great deal of the security profession and the IT world depend on honeypots. Honeypots • Build anti-virus signatures. • Build SPAM signatures and filters. • ISP’s identify compromised systems. • Assist law-enforcement to track criminals. • Hunt and shutdown botnets. • Malware collection and analysis.

3. What are Honeypots • Honeypots are real or emulated vulnerable systems ready to be attacked. • Primary value of honeypots is to collect information. • This information is used to better identify, understand and protect against threats. • Honeypots add little direct value to protecting your network.

4. Types of HoneyPot • Server: Put the honeypot on the Internet and let the bad guys come to you. • Client: Honeypot initiates and interacts with servers • Other: Proxies

5. Types of HoneyPot • Low-interaction • Emulates services, applications, and OS’s. • Low risk and easy to deploy/maintain, but capture limited information. • High-interaction • Real services, applications, and OS’s • Capture extensive information, but high risk and time intensive to maintain.

6. Examples Of Honeypots • BackOfficer Friendly • KFSensor • Honeyd • Honeynets Low Interaction High Interaction

7. Honeynets • High-interaction honeypot designed to capture in-depth information. • Information has different value to different organizations. • Its an architecture you populate with live systems, not a product or software. • Any traffic entering or leaving is suspect.

8. How It Works • A highly controlled network where every packet entering or leaving is monitored, captured, and analyzed. • Data Control • Data Capture • Data Analysis

9. Honeynet Architecture

10. Data Control • Mitigate risk of honeynet being used to harm non-honeynet systems. • Count outbound connections. • IPS (Snort-Inline) • Bandwidth Throttling

11. No Data Control

12. Data Control

13. Data Capture • Capture all activity at a variety of levels. • Network activity. • Application activity. • System activity.

14. Sebek • Hidden kernel module that captures all host activity • Dumps activity to the network. • Attacker cannot sniff any traffic based on magic number and dst port.

15. Sebek Architecture

16. Honeywall CDROM • Attempt to combine all requirements of a Honeywall onto a single, bootable CDROM. • May, 2003 - Released Eeyore • May, 2005 - Released Roo

17. RooHoneywall CDROM • Based on Fedora Core 3 • Vastly improved hardware and international support. • Automated, headless installation • New Walleye interface for web based administration and data analysis. • Automated system updating.

18. Installation • Just insert CDROM and boot, it installs to local hard drive. • After it reboots for the first time, it runs a hardening script based on NIST and CIS security standards. • Following installation, you get a command prompt and system is ready to configure.

19. Further Information • http://www.honeynet.org/ • http://www.honeynet.org/book