HONEYPOTS PRESENTATION
TEAM:
Ankur Sharma
Ashish Agrawal
Elly Bornstein
Santak Bhadra
Srinivas Natarajan
Topics to be covered












Network IDS - Brief Intro
What is a Honeypot ?
Honeypot - in a Network environment
A Three Layered Approach
Types of Honeypot
Honeypot and IDS - Traditional detection problem
Honeypot as detection solution
Honeypot implementation and an example attack
Virtual Honeypot
Advantages and Disadvantages
Demo
References
Network IDS – Brief Intro

An IDS which detects malicious activity such as denial of service
attacks, port scans or even attempts to crack into computers by
monitoring network traffic.

Inspect incoming network traffic and studies the packets.

Reads valuable information about an ongoing intrusion from
outgoing or local traffic as well.

It can co-exist with other systems as well. For example, update
some firewalls' blacklist IP database about computers used by
(suspected) hackers.
What is a Honeypot ?

A trap set to detect, deflect and counteract
attempts at unauthorized use of information
systems.

A security resource whose value lies in being
probed, attacked, or compromised.

A Valuable system that can be used as
surveillance and early-warning tool.
Honeypot in a Network
Environment


In general, it consists of a computer or a
network site that appears to be part of network
but which is actually isolated, unprotected and
monitored.
It can also take other forms, such as files or
data records, or even unused IP address space.
Honeypot in a Network
Environment
A Three Layered Approach
Honeypot can be defined in a three layered
approach:
 Prevention
 Detection
 Response
A Three Layered Approach

Prevention: Honeypots can be used to slow down or stop
automated attacks. It can utilize psychological weapons such
as deception or deterrence to confuse or stop attacks.

Detection: It is used to detect unauthorized activity and capture
unknown attacks. Generate very few alerts, but when they do
you can almost be sure that something malicious has
happened.

Response: Production honeypots can be used to respond to an
attack. Information gathered from the attacked system can be
used to respond to the break-in.
Types of Honeypot

Classified based on two categories:

Deployment
1. Production
2. Research

Levels of interaction
1. Low Interaction
2. High Interaction
Deployment Types

Production Honeypots:
Easy to use, capture only limited information, and
primarily used by companies or corporations. They
are placed along with other production network and
help to mitigate risk in an organization.

Research Honeypots:
Run by a volunteer, non-profit research organization
or an educational institution to gather information
about the motives and tactics of Blackhat community
targeting different networks.
Levels of Involvement


Low Interaction (Honeyd)
Able to simulate big network structures on a single
host. With one single instance of the daemon, many
different hosts running different services can be
simulated.
High Interaction (HoneyNet)
Network of real systems. A stealth inline network
bridge that closely monitors and controls the network
data flow to and from the honeypots in the network.
Honeypot and IDS - Traditional
detection problems






Data overload
False positives
False negatives
Resources
Encryption
IPv6
Honeypot as detection solution






Small data sets
Reduced false positives
Catching false negatives
Minimal resources
Encryption
IPv6
Honeyd


It's designed to be used on Unix-based
operating systems, such as OpenBSD or
Linux; however, it may soon be ported to
Windows.
Since this solution is OpenSource, not only is
it free, but we also have full access to the
source code, which is under the BSD license.
Continue…..
Honeyd



The primary purpose of Honeyd is detection,
specifically to detect unauthorized activity
within your organization.
It does this by monitoring all the unused IPs in
your network.
Any attempted connection to an unused IP
address is assumed to be unauthorized or
malicious activity
Example….
Configuring Honeyd



To implement Honeyd we need to compile and
use two tools: Arpd and Honeyd.
Arpd is used for ARP spoofing
Monitors the unused IP space and directs
attacks to the Honeyd honeypot.
Building honeypot with UML



UML allows to run multiple instances of Linux
on the same system at the same time
The UML kernel receives the system call from
its application and sends/requests them to the
host kernel
UML has many capabilities, among them



It can log all the keystrokes even if the attacker uses
encryption
It reduces the chances of revealing its identity as
honeypot
Makes UML kernel data secure from tampering by its
processes.
Honey Net


Network of Honeypots
Supplemented by firewalls and intrusion
detection system.
Advantages:
 More realistic environment
 Improved possibility to collect data
How Honey net works

A highly controlled
network where
every packet
entering or leaving
is monitored,
captured and
analyzed
Virtual Honeypot



Virtual machines allow different OS to run at
the same time at the same machine
Honeypots are guest on the top of another OS.
We can implement guest OS on host OS in two
ways


Raw disc- actual disc partition
Virtual disc- file on host file system
Most Exploited Vulnerabilities

Top 5 most frequently exploited vulnerabilities
with a rating of "severe."
The Five Most Attacked Ports


X-Axis: Port Number
Y-Axis: Number of attackers with the rating of
“severe” per honeypot in the last week
Advantages




Productive environment: distraction from the
real target
Can peek into guest operating system at
anytime.
Reinstallation of contaminated guest is also
easy.
And it is very easy way.
Disadvantages




Sub-optimal utilization of computational
resources.
Reinstallation of polluted system is very
difficult.
Difficulty in monitoring of such system in a
safe way.
Detecting the honeypot is easy
References
http://www.securityfocus.com
Honeypots: Simple, Cost-Effective Detection
Open Source Honeypots: Learning with Honeyd
Specter: A Commercial Honeypot Solution for Windows
http://www.honeypots.net/
http://en.wikipedia.org/wiki/Honeypot_(computing)
http://www.tracking-hackers.com/
Thank You!
We are happy to answer any questions……