Honey Potz - BSides SLC 2015
•Download as PPTX, PDF•
0 likes•734 views
This document provides an overview of honey pots and the Kippo honey pot in particular. It discusses why honey pots are used for threat intelligence gathering, types of honey pots including low and high interaction, and how Kippo works as a medium interaction SSH honey pot. Specific findings from a Kippo honey pot are presented, including login attempts, successes when default credentials were leaked, and visualizations of attack data with Kippo-Graph. Resources for downloading and hosting Kippo are also listed.
Recommended
More Related Content
Viewers also liked
Viewers also liked (19)
Similar to Honey Potz - BSides SLC 2015
Similar to Honey Potz - BSides SLC 2015 (20)
Recently uploaded
Recently uploaded (20)
Honey Potz - BSides SLC 2015
- 1. Honey Potz ETHAN DODGE (CHP1N)
- 2. Disclaimer The views expressed herein are solely my views and not the views of my employer, or any other organization with which I am associated. I am responsible for the content of this presentation. Likewise, the research conducted and illustrated herein was performed by me unless otherwise noted.
- 3. Audience lNoobs. lDon't be afraid to ask questions! lThose looking to get into the honey pot/threat intelligence communities. lThose that already have experience honey potting.
- 4. Honey Potz BEWARE OF ADDICTION
- 8. Types of Honey Pots JUSTA MORSELOF HUNNY
- 10. Low Interaction vs. High Interaction •Actual machine •Complete functionality •Can exploit whatever is exploitable •Used to observe targeted attacks •Not easily detectable •Bifrozt •Simulation •Incomplete functionality •Cannot be used to exploit other vulnerabilities •Used to observe behavior •Often easily detectable •Kippo
- 12. “Kippo is a medium interaction SSH honeypot designed to log brute force attacks and, most importantly, the entire shell interaction performed by the attacker.” https://github.com/desaster/kippo
- 13. How KippoWorks
- 16. SimpleWaysTo “Hide” It •Change the hostname •Add a login banner •Edit userdb.txt •Change file system •Edit /etc/passwd & /etc/shadow •Edit script output
- 17. Findings
- 18. Login Attempts vs Successes in the past 30 days - LA Total attempts: 519 Total successes: 10 Total attempts: 3,924 Total successes: 2
- 19. Creds •Default root/123456 (Top Graph) •Leaked 14 character password (Bottom Graph)
- 20. “Leaking” Creds •Leaked 14 character password to honeypot of pastebin •Posted at 1:14AM MST •Any guesses as to how long it took until someone logged in?
- 21. 2 Hours 35 Minutes •First login seen with correct password seen at 3:49 MST. •Romanian IP Address •Malicious intent •Pastebin has over 100 views in 2 minutes (Bots) •Saw 5 logins from 3 distinct IP addresses in 12 hours
- 22. Login Attempts vs Successes in the past 30 days - Canada Total attempts: 255,059 Total successes: 79 Total attempts: 282,263 Total successes: 0 Hosting Problems You get what you pay for. (Cloud At Cost)
- 23. Changed userdb.txt •Rejects most common 100 passwords from the most common 10 usernames (Top Graph) •Therefore accepting multiple passwords •Accepts 7 character password from 5 different usernames •Yet to be cracked •Leaked in a key logger dump this morning at 7:53 MST
- 24. Changed fs.pickle •Spun up an Ubuntu box serving DNS •Used createfs.py to create new fs.pickle •Yet to see better results •I will blog about it
- 25. Login Attempts vs Successes in the past 30 days - Europe Total attempts: 429,661 Total successes: 0
- 26. Most attacked box •In the heart of the EU •Doesn’t get attacked as much as Asian honeypots •8 character password •Logon banner in Spanish
- 27. Typical malicious session •Wget/curl some script or executable •Chmod it •Execute it •Delete it •99% of the time is scripted
- 28. Occasional you’ll get a lot more commands
- 29. Typical Detection •Runs ps –a, ifconfig, or cats a standard file •Sees default Kippo content •Hops out
- 31. Kippo-Graph
- 32. Kippo-Graph
- 33. Kippo-Graph
- 35. DemoTime
- 36. Downloads •Original Kippo: https://github.com/desaster/kippo •Kippo fork I use: https://github.com/micheloosterhof/kippo •Supports SFTP and json logging •Is updated regularly •DownloadTango: https://apps.splunk.com/app/2666/ •Download Honeydrive: http://sourceforge.net/projects/honeydrive/
- 37. Hosting Links •Crissic – crissic.net ($10/year) lLA and Florida •CloudAt Cost – cloudatcost.com ($35/life) lCanada •Time4VPS –Time4VPS (€10/year) lEuropean Union •Lowendstock.com •Lowendtalk.com
- 39. Contact Freenode: chp1n Twitter: @chp1n Blog: utzpin.org
- 40. el fin.
Editor's Notes
- 1
- 2
- 3
- 8
- 9
- 10
- 11
- 12
- 13
- 14
- 15
- 16
- 17
- 18
- 19
- 20
- 21
- 22
- 23
- 24
- 25
- 26
- 27
- 28
- 29
- 30
- 31
- 32
- 33
- 34
- 35
- 36
- 37
- 38
- 39
- 40