APNIC Senior Security Specialist Adli Wahid gives a presentation on the threats the APNIC honeynet project has observed and how these were mitigated or remediated at CommunicAsia 2021, held online from 14 to 16 July 2021.

1. 2
What is Hitting My Honeypots?
Adli Wahid
adli@apnic.net
APNIC

2. 3
Introduction
1. Observations from APNIC
Community Honeynet Project
2. Detection and Remediation
3. Lessons Learned
Let’s Connect!
o Adli Wahid
o @adliwahid

3. 4
4
APNIC Community Honeynet Project
• Learning & Information Sharing
– DASH https://dash.apnic.net for APNIC members
– Security Community / CERTs/CSIRTs
– Collaboration & Sharing with partners
• Highlights
– Telnet / SSH honeypots
– Port 23 / 22 Exposed on the Internet
– Emulate Telnet/SSH services + interaction
– Linux-based systems/IoTs & Linux Malware

4. 5
So What?
• Honeypots have no production value,
any traffic is suspect
– Useful for internal network
monitoring / detection
• Malware spreads via Telnet/SSH
– telnet/ssh enabled by default by
many systems and devices
– Exposed on the Internet
• Exploit weak authentication or default
authentication
• What happens after a ‘successful login’
provides a bigger picture.
Activities in the last 24 hours

5. 6
Highlights
DDOS Agents / Stressers
• Drops script that downloads ELF binaries
– Different architectures available (x86,
x86_64, mips, sparc, etc)
– Mirai variant
• Perl scripts / bots
• Connects to mothership (command and
control)
• Waits for further instruction to ddos
• End goal – part of ddos
botnet/stresser/booter service, $$
– https://www.imperva.com/learn/ddos/booters-
stressers-ddosers/
Coin Miners (Monero/XMR)
• Drops script that download ELF binaries
(i.e. xmrig) or some other scripts
• Starts mining
• Sends results to mining pool
• End goal - part of mining botnet, $$
– https://www.zdnet.com/article/cyber-attackers-
are-cashing-in-on-cryptocurrency-mining-but-
heres-why-theyre-avoiding-bitcoin/

6. 7
7
vol.py --plugins=. -f mem01.raw --profile=LinuxDebian-4_19_0-16-686x86 linux_yarascan –y
malware_rules.yar
Task: pty pid 7978 rule LinuxTsunami addr 0x8055d84
0x08055d84 4e 4f 54 49 43 45 20 25 73 20 3a 49 27 6d 20 68 NOTICE.%s.:I'm.h
0x08055d94 61 76 69 6e 67 20 61 20 70 72 6f 62 6c 65 6d 20 aving.a.problem.
0x08055da4 72 65 73 6f 6c 76 69 6e 67 20 6d 79 20 68 6f 73 resolving.my.hos
0x08055db4 74 2c 20 73 6f 6d 65 6f 6e 65 20 77 69 6c 6c 20 t,.someone.will.
0x08055dc4 68 61 76 65 20 74 6f 20 53 50 4f 4f 46 53 20 6d have.to.SPOOFS.m
0x08055dd4 65 20 6d 61 6e 75 61 6c 6c 79 2e 0a 00 00 00 00 e.manually......
0x08055de4 4e 4f 54 49 43 45 20 25 73 20 3a 6b 74 68 72 2e NOTICE.%s.:kthr.
0x08055df4 73 73 68 20 7c 20 02 44 44 4f 53 02 20 6d 65 74 ssh.|..DDOS..met
0x08055e04 68 6f 64 73 0a 00 00 00 4e 4f 54 49 43 45 20 25 hods....NOTICE.%
0x08055e14 73 20 3a 02 58 4d 41 53 20 3c 74 61 72 67 65 74 s.:.XMAS.<target
0x08055e24 3e 20 3c 70 6f 72 74 3e 20 3c 73 65 63 73 3e 20 >.<port>.<secs>.
0x08055e34 3c 63 77 72 2c 65 63 65 2c 75 72 67 2c 61 63 6b <cwr,ece,urg,ack
0x08055e44 2c 70 73 68 2c 72 73 74 2c 66 69 6e 2c 73 79 6e ,psh,rst,fin,syn
0x08055e54 20 6f 72 20 6e 75 6c 6c 3e 20 3c 72 61 6e 64 6f .or.null>.<rando
0x08055e64 6d 2f 6e 6f 74 3e 02 20 3d 3d 3d 3e 20 6d 65 73 m/not>..===>.mes
0x08055e74 73 79 20 70 61 63 6b 65 74 20 67 65 6e 65 72 61 sy.packet.genera

7. 8
8
Ddos agents

8. 9
9
Miners

9. 10
10
Spreading to others

10. 11
11
Detection & Remediation
• Detection is quite straight forward*
– Spreading via telnet/ssh bruteforce
– Monitor activities on hosts / outbound activities
– OSINT information abound for context (virustotal,dshield, etc)
• Remediation
– Types of devices already infected
– Capabilities in removing malicious codes & hardening
– Patch not available
– Work-arounds*
• Remediation II
– Actors’ infrastructure (dns, hosts, network) serving malware
and providing command and control

11. 12
12
Lessons Learned
• Lack of visibility, no monitoring, not monitoring things that
matter*
– All levels
– Threat sharing platform / OSINT / free feeds (i.e Shadowserver) can
provide context
• Lack of awareness*
– We deal with APT / ”Big Ddos Attacks” only
– Attackers build their infrastructure to carry out the “big attacks”
– ”It doesn’t affect us” syndrome
– Security specialization
• Lack of resources
– Responsive mode
– No remediation & proactive security (including reviewing security
policy)
– No able to track (CGNAT) and follow up with customers or clients
One of the recent Linux backdoor/trojan
campaigns – spread over time

12. 13
13
Conclusion
• Snap-shot, there’s more!
– Malware spreads via other means
– Different payloads i.e. Windows Systems spreading malware over
SMB
• Proactive monitoring & detection
– Policies, procedures, people
• Collaboration – with clear goals
– Capability and capacity
• APNIC Community Honeynet Project
– MISP feeds, Analysis, Let’s Chat

13. 14
14
Thank You
Let’s Connect!
o adli@apnic.net
o Adli Wahid
o @adliwahid