Honeypot Presentation - Using Honeyd
- 1. HoneyPots for Network Security Using Honeyd
- 2. Botnets One of the biggest threats in network security is botnets . Botnets are a collection of infected computers or bots that have been taken over by Hackers (sometimes known as bot herders) and are used to perform malicious tasks or functions. botnets.png
- 3. Botnets botnets2.jpg This example illustrates how a botnet is created and used to send email spam . A botnet operator sends out viruses or worms, infecting ordinary users' computers, whose payload is a malicious application—the bot . The bot on the infected PC logs into a particular C&C server (often an IRC server, but, in some cases a web server). A spammer purchases the services of the botnet from the operator. The spammer provides the spam messages to the operator, who instructs the compromised machines via the IRC server, causing them to send out spam messages.
- 4. Types of Botnet Attacks Spyware software which sends information to its creators about a user's activities – typically passwords, credit card numbers and other information that can be sold on the black market Adware advertise some commercial entity actively and without the user's permission or awareness Denial of Service multiple systems autonomously access a single Internet system or service in a way that appears legitimate, but much more frequently than normal use and cause the system to become busy botnets3.jpg
- 5. Types of Botnet Attacks botnets4.jpg Fast Flux DNS technique used by botnets to hide phishing and malware delivery sites behind an ever-changing network of compromised hosts acting as proxies Click Fraud user's computer visiting websites without the user's awareness to create false web traffic for the purpose of personal or commercial gain E-mail spam e-mail messages disguised as messages from people, but are either advertising, annoying, or malicious in nature
- 6. Honeypots A server that is configured to detect an intruder by mirroring a real production system. It appears as an ordinary server doing work, but all the data and transactions are phony. Located either in or outside the firewall, the honeypot is used to learn about an intruder's techniques as well as determine vulnerabilities in the real system . Set to detect , deflect, or in some manner counteract attempts at unauthorized use of information systems. honeypot.png
- 7. Types of Honeypots Generally speaking there are two different types of Honeypots : Production Honeypots and Research Honeypots Production Honeypots are used primarily by companies or corporations to improve their overall state of security. Research Honeypots are used primarily by non-profit research organizations or educational institutions to research the threats organizations face and learn how to better protect against those threats. Research Honeypots are used primarily by non-profit research organizations or educational institutions to research the threats organizations face and learn how to better protect against those threats. honeypot2.jpeg
- 8. Honeyd Honeyd is a type of daemon honeypot licensed by GPL that has the ability to simulate a big network while using only a single host. To outsiders, the Honeyd looks like a computer network on a network's unused address space. honeyd.gif
- 9. Primary Applications of Honeyd Distraction Using the software's ability to mimic many different network hosts at once, Honeyd can act as a distraction to potential hackers. If a network only has 3 real servers, but one server is running Honeyd , the network will appear running hundreds of servers to a hacker. The hacker will then have to do more research in order to determine which servers are real, or the hacker may get caught in a honeypot. Either way, the hacker will be slowed down or possibly caught. Honeypot On a network, all normal traffic should be to and from valid servers only. Thus , a network administrator running Honeyd can monitor his/her logs to see if there is any traffic going to the virtual hosts set up by Honeyd . Any traffic going to these virtual servers can be considered highly suspicious. The network administrator can then take preventative action, perhaps by blocking the suspicious IP address or by further monitoring the network for suspicious traffic.
- 10. Honeyd Configuration /etc/honeypot/ Contains honeyd.conf , nmap.assoc , nmap.prints , pf.os , and xprobe2.conf honeyd1.png /etc/honeypot/ Contains honeyd.conf , nmap.assoc , nmap.prints , pf.os , and xprobe2.conf
- 11. Honeyd Configuration /etc/honeypot/ Contains honeyd.conf , nmap.assoc , nmap.prints , pf.os , and xprobe2.conf Honeyd.conf is the main configuration file for setting the “personalities” of the virtual hosts.
- 12. Honeyd Configuration honeyd1.png Honeyd.conf Creates the default actions for the machines creates a personality template called honeypot-template Sets the mac address, OS, uptime, available protocols and open ports Binds the templates to 2 unused IP addresses on the network
- 13. Honeyd Configuration $ iptables -A INPUT -d 192.168.1.201 -j ACCEPT $ iptables -A INPUT -d 192.168.1.202 -j ACCEPT $ iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT Modifies the rules of your firewall to accept packets for the IP Addresses defined in the honeyd's configuration file honeypot1.jpg
- 14. Honeyd Configuration /etc/default/ honeyd Sets the default run behavior of honeyd honeyd2.png
- 15. Honeyd Configuration Another daemon that runs alongside of honeyd is farpd which is the daemon that is forwarding the traffic from the virtual hosts to the main honeyd server. farpd replies to any ARP request for an IP address matching the specified destination net with the hardware MAC address of the specified interface , but only after determining if another host already claims it. Any IP address claimed by farpd is eventually forgotten after a period of inactivity or after a hard timeout, and is relinquished if the real owner shows up. This enables a single host to claim all unassigned addresses on a LAN for network monitoring or simulation.
- 16. Testing H oneyd The network scanner To test if the virtual hosts are responding with the right information nmap.png