Honeypots and Security
0 likes187 views
APNIC has set up a honeypot network using Modern Honeypot Network (MHN) and is looking for more volunteers to participate by running a virtual machine with a public IP address. Passive DNS databases can provide information about past domain name resolutions and relationships between domains and IP addresses that is difficult to obtain through standard DNS queries. Farsight runs a large passive DNS network and the FIRST Passive DNS Exchange SIG is working on a common output format standard. CyberGreen collects risk indicator data on issues like open DNS, NTP, SSDP, and SNMP. The Censys Projects publishes daily snapshots of configuration data on IPv4 hosts, top websites, and X.509 certificates. APNIC conducts biennial surveys to
Honeypots and Security
- 1. Honeypots and Security Data Gathering BoF
- 2. Honeynet • APNIC (adli@apnic.net) has set up a honeynet using Modern Honeypot Network (MHN) • Looking for more volunteers to join – All you need is a VM and a public IP address – The more the merrier! 2
- 3. Honeynet 3
- 4. Honeynet 4
- 5. Honeynet 5
- 6. Passive DNS • Malware and e-crime rely heavily on the DNS, and so- called "fast flux botnets" abuse the DNS with frequent updates and low TTLs. Passive DNS databases can answer questions that are difficult or impossible to answer with the standard DNS protocol, such as: – Where did this domain name point to in the past? – What domain names are hosted by a given nameserver? – What domain names point into a given IP network? – What subdomains exist below a certain domain name? 6
- 7. Passive DNS • Farsight (wwww.farsightsecurity.com) is running a large PDNS network, participants are allowed to view data • FIRST Passive DNS Exchange SIG working on a standard for Common Output Format – https://datatracker.ietf.org/doc/draft-dulaunoy-dnsop-passive-dns-cof/ • What would you do with the data from 200,000 DNS resolutions per second? 7
- 8. CyberGreen • Collects data and provides metrics on risk indicators around DDoS potential – Open DNS – Open NTP – Open SSDP – Open SNMP 8
- 9. CyberGreen 9
- 10. CyberGreen 10
- 11. Censys • The Censys Projects publishes daily snapshots of what we know about each IPv4 host, Alexa Top Million website, and known X.509 certificate. • These datasets contain structured, non-ephemeral JSON records that identify a host's configuration. • https://scans.io/ • https://www.censys.io/ 11
- 12. Censys 12
- 13. Questionnaires • APNIC does a survey every 2 years to shape direction • What about faster surveys for smaller corners of APNIC? • Small optional surveys, anonymous if desired/possible 13
- 14. Questionnaires • Do we need to encourage you to participate? • Maybe offer chocolates or invites to the Whisky BoF for regular contributors? (BYO whiskey ;) ) 14
- 15. Next steps • Should we do more? • How to do more? • What else should we do? 15
- 16. 16