HoneyPy & HoneyDB (LASCON 2016)
•
1 like•122 views
Presented on November 4, 2016 at LASCON (https://lascon2016.sched.com/event/8W7h/honeypy-amp-honeydb). This talk will provide a light intro to honeypots and their benefits, and highlight two projects HoneyPy and HoneyDB. Operating honeypot sensors on your internal network is a simple way to make your network “noisy” and can trip up malicious actors that have already penetrated your network. Also, leveraging data from honeypot sensors on the Internet can be a useful source of threat information.
Report
Share
Report
Share
Download to read offline
Recommended
NPTs
BSides Boston and RI 2013
Video (BSides RI: http://www.irongeek.com/i.php?page=videos/bsidesri2013/2-0-booting-the-booters-stressing-the-stressors-allison-nixon-and-brandon-levene)
From OSINT to Phishing presentation
This document describes how the author conducted an OSINT investigation and subsequent phishing campaign. It begins by explaining what OSINT is and some common tools used for open source intelligence gathering like Maltego, Shodan, and Google dorks. Next, it discusses how to use the information found through OSINT to craft a targeted phishing email. The document walks through setting up a phishing site using tools like Modlishka and GoPhish. It then tells a story of a actual phishing campaign the author conducted, changing details to protect privacy. The document concludes by emphasizing the importance of managing one's online presence and digital footprint.
MonkeySpider at Sicherheit 2008
Monkey-Spider is a low-interaction honeyclient crawler that analyzes websites for malicious content. It uses existing open source software like Heritrix for crawling and ClamAV for malware scanning. The tool was created to build a database of internet threats through broad, automated analysis of millions of websites. Preliminary results from Monkey-Spider crawls found that 1% of sites contained malware, with most infections found on pirate and wallpaper sites. Future work may include detecting advanced evasion techniques used by malware and exploiting client programs beyond web browsers.
Backup-File Artifacts - OWASP Khartoum InfoSec Sessions 2016 - Mazin Ahmed
Backup-File Artifacts - OWASP Khartoum InfoSec Sessions 2016 - Mazin Ahmed
Backup-File Artifacts: The Underrated Web-Danger
Testing and Exploiting Backup-File Artifacts with BFAC
BFAC Homepage: https://github.com/mazen160
Blog Post: http://blog.mazinahmed.net/2016/08/backup-file-artifacts.html
The Secret Life of a Bug Bounty Hunter – Frans Rosén @ Security Fest 2016
Frans Rosén has reported hundreds of security issues using his big white hat since 2012. He have recieved the biggest bounty ever paid on HackerOne, and is one of the highest ranked bug bounty researchers of all time. He's been bug bounty hunting with an iPhone in Thailand, in a penthouse suite in Las Vegas and without even being present using automation. He'll share his stories about how to act when a company's CISO is screaming "SH******T F*CK" in a phone call 02:30 a Friday night, what to do when companies are sending him money without any reason and why Doctors without Borders are trying to hunt him down.
Angelo Alviar OSINT 101 Presentation - Forensics and Security Technology
This document discusses using open source intelligence (OSINT) tools and techniques to gather target information for targeted attacks without detection. It describes tools like Shodan, Maltego, Pipl, Google dorking, and LinkedIn that can uncover usernames, passwords, emails, subdomains and personal details on targets. The goal is to passively collect enough information during the OSINT phase to enable further active reconnaissance or targeted attacks without directly interacting with the target's network.
Nmapper theHarvester OSINT Tool explanation
OSINT for Opensource intelligence is a tool used to examine external threats of and organization. At Nmmapper(https://www.nmmapper.com) We have integrated this OSINT tool online for everyone to test it out at https://www.nmmapper.com/kalitools/theharvester/email-harvester-tool/online/
Getting started with using the Dark Web for OSINT investigations
The document discusses how to conduct open-source intelligence (OSINT) investigations using the dark web, providing an overview of the surface web, deep web, and dark web; resources for finding dark web sites like search engines and directories; and tips for investigating cases like finding the location and Wi-Fi network from a photo's metadata. It aims to educate on safely and legally utilizing open-source information on the dark web for investigative purposes.
Recommended
NPTs
BSides Boston and RI 2013
Video (BSides RI: http://www.irongeek.com/i.php?page=videos/bsidesri2013/2-0-booting-the-booters-stressing-the-stressors-allison-nixon-and-brandon-levene)
From OSINT to Phishing presentation
This document describes how the author conducted an OSINT investigation and subsequent phishing campaign. It begins by explaining what OSINT is and some common tools used for open source intelligence gathering like Maltego, Shodan, and Google dorks. Next, it discusses how to use the information found through OSINT to craft a targeted phishing email. The document walks through setting up a phishing site using tools like Modlishka and GoPhish. It then tells a story of a actual phishing campaign the author conducted, changing details to protect privacy. The document concludes by emphasizing the importance of managing one's online presence and digital footprint.
MonkeySpider at Sicherheit 2008
Monkey-Spider is a low-interaction honeyclient crawler that analyzes websites for malicious content. It uses existing open source software like Heritrix for crawling and ClamAV for malware scanning. The tool was created to build a database of internet threats through broad, automated analysis of millions of websites. Preliminary results from Monkey-Spider crawls found that 1% of sites contained malware, with most infections found on pirate and wallpaper sites. Future work may include detecting advanced evasion techniques used by malware and exploiting client programs beyond web browsers.
Backup-File Artifacts - OWASP Khartoum InfoSec Sessions 2016 - Mazin Ahmed
Backup-File Artifacts - OWASP Khartoum InfoSec Sessions 2016 - Mazin Ahmed
Backup-File Artifacts: The Underrated Web-Danger
Testing and Exploiting Backup-File Artifacts with BFAC
BFAC Homepage: https://github.com/mazen160
Blog Post: http://blog.mazinahmed.net/2016/08/backup-file-artifacts.html
The Secret Life of a Bug Bounty Hunter – Frans Rosén @ Security Fest 2016
Frans Rosén has reported hundreds of security issues using his big white hat since 2012. He have recieved the biggest bounty ever paid on HackerOne, and is one of the highest ranked bug bounty researchers of all time. He's been bug bounty hunting with an iPhone in Thailand, in a penthouse suite in Las Vegas and without even being present using automation. He'll share his stories about how to act when a company's CISO is screaming "SH******T F*CK" in a phone call 02:30 a Friday night, what to do when companies are sending him money without any reason and why Doctors without Borders are trying to hunt him down.
Angelo Alviar OSINT 101 Presentation - Forensics and Security Technology
This document discusses using open source intelligence (OSINT) tools and techniques to gather target information for targeted attacks without detection. It describes tools like Shodan, Maltego, Pipl, Google dorking, and LinkedIn that can uncover usernames, passwords, emails, subdomains and personal details on targets. The goal is to passively collect enough information during the OSINT phase to enable further active reconnaissance or targeted attacks without directly interacting with the target's network.
Nmapper theHarvester OSINT Tool explanation
OSINT for Opensource intelligence is a tool used to examine external threats of and organization. At Nmmapper(https://www.nmmapper.com) We have integrated this OSINT tool online for everyone to test it out at https://www.nmmapper.com/kalitools/theharvester/email-harvester-tool/online/
Getting started with using the Dark Web for OSINT investigations
The document discusses how to conduct open-source intelligence (OSINT) investigations using the dark web, providing an overview of the surface web, deep web, and dark web; resources for finding dark web sites like search engines and directories; and tips for investigating cases like finding the location and Wi-Fi network from a photo's metadata. It aims to educate on safely and legally utilizing open-source information on the dark web for investigative purposes.
Honeypots, Deception, and Frankenstein
Presented on April 14, 2018 at CarolinaCon (https://www.carolinacon.org). This talk will provide a quick overview honeypots, an explanation of the cyber deception space, and the benefits of implementing deception as part of your cyber defense program. In addition, this talk will highlight the HoneyDB project, which enables anyone to get started with operating deception sensors and start collecting threat information. Finally, this presentation will describe how I built scalable honeypot sensor collection, employing a "Frankenstein Cloud Architecture", for minimal cost.
HoneyPy & HoneyDB (CarolinaCon 13)
Presented on May 21, 2017 at CarolinaCon (https://www.carolinacon.org). This talk will provide a light intro to honeypots and their benefits, and highlight two projects HoneyPy and HoneyDB. Operating honeypot sensors on your internal network is a simple way to make your network “noisy” and can trip up malicious actors that have already penetrated your network. Also, leveraging data from honeypot sensors on the Internet can be a useful source of threat information.
HoneyPy Honeypot (OWASP Triangle Chapter)
Presented on May 19, 2016 at the OWASP Triangle Chapter (https://www.meetup.com/owasptriangle/events/230531768/). Honeypots can be a valuable resource in detecting malicious actors on a network. The discussion will cover a brief intro on honeypots and then turns to HoneyPy, which is an open source honeypot that is extensible and simple to deploy. In addition, the talk will explore HoneyPy's integration with several other tools to increase visibility of malicious hosts on the Internet.
Honeypots, Deception, and Frankenstein
Presented on May 9, 2018 at SOURCE Conference Boston
(https://sourceconference.com/events/bos18/).
This version contains minor updates from previous presentations.
This talk will provide a quick overview honeypots, an explanation of the cyber deception space, and the benefits of implementing deception as part of your cyber defense program. In addition, this talk will highlight the HoneyDB project, which enables anyone to get started with operating deception sensors and start collecting threat information. Finally, this presentation will describe how I built scalable honeypot sensor collection, employing a "Frankenstein Cloud Architecture", for minimal cost.
Introduction to Honeypots
Edgis Sharing Session – Introduction to Honeypots
at Whitehat Society, Singapore Management University
September 2012
at Computing Society, Royal Holloway, University of London
February 2013
GNUCITIZEN Pdp Owasp Day September 2007
The document discusses potential ways that Web 2.0 technologies could be abused by malicious actors, through five fictional stories. It describes how social networks, APIs, cloud services and other Web 2.0 features could enable new types of malware, spam, botnets and data theft. The stories illustrate techniques like using mashups and feeds to distribute malware, exploiting search and social media to spread worms, using bookmarks for ad-jacking and creating botnets, and abusing aggregators and search engines to conduct reconnaissance. The document warns that legitimate Web 2.0 services could enable large-scale abuse if exploited by attackers.
Deception in Cyber Security (League of Women in Cyber Security)
Presented on August 23, 2017 at the League of Women in Cyber Security meetup (https://www.meetup.com/League-of-Women-in-Cybersecurity/events/242071337/). his talk will provide an intro to honeypots and their benefits, an intro to deception in cyber security, and an overview of HoneyPy and HoneyDB.
[CONFidence 2016] Leszek Miś - Honey(pot) flavored hunt for cyber enemy
Jednym z najistotniejszych czynników wspierających ochronę krytycznej infrastruktury sieciowej jest czas reakcji zespołu reagowania na incydenty bezpieczeństwa (Incident Response Team).
Im szybciej, tym lepiej. Rozwiązania wspomagające wczesne wykrywanie ataków oparte o pasywną analizę zapytań DNS, zbiorów danych Netflow czy PCAP warto wesprzeć coraz częściej docenianą i wykorzystywaną produkcyjnie infrastrukturą typu honeynet. Rozsądne osadzenie sond honeypotowych w różnych segmentach sieci pozwoli na wykrycie ataku już w początkowych fazach rekonesansu i enumeracji. Dzięki honeypotom niejednokrotnie uzyskamy także szczegółowe informacje na temat nowej techniki ataku, próby wykorzystania błędu typu 0-day czy bardzo specyficznego użycia znanych od lat narzędzi.
"Know your enemy" - to dewiza, którą powinniśmy się kierować w trosce o rozwój defensywnych umiejętności zespołów bezpieczeństwa i honeypotowa sieć zdecydowanie posiada tu dużą wartość.
Podczas prelekcji postaram się przedstawić sposoby wykorzystania jak i możliwości oferowane przez open source'owe rozwiązania typu honeypot. Będziemy mówić o pojedynczych projektach imitujących rzeczywiste usługi (DNS, SMB, SSH, SCP/SFTP, FTP, telnet, HTTP, TFTP, MySQL/MSSQL, RDP i wiele innych), wstrzykiwaniu poprzez reverse proxy honeypotowych zawartości do aplikacji webowych, atakowaniu atakujących;) , kończąc na dedykowanych platformach z wbudowanych stackiem ELK.
Blue team reboot - HackFest
Co Speaker: Cheryl Biswas
Talk Description:
How about this: a blue team talk given by red teamers. But here’s our rationale - your best defence right now is a strategic offence. The rules of the game have changed and we need to get defence up to speed.
We’ll show you what the key elements are in a good defence strategy; what you can and need to be using to full advantage. We’ll talk about the new “buzzwords” and how they apply: visibility; patterns; big data. There’s a whole lotta data to wrangle, and you aren’t seeing the whole picture if you aren’t doing things right. Threat intel is about getting the big picture as it applies to you. You’ll learn the importance of context and prioritization so that you can manipulate intel feeds to do your bidding. And then we’ll take things further and talk about hunting the adversary, using an update on proven methodologies.
We’ll show you how to understand your data, correlate threats and pin point attacks. Attendees will leave with a new understanding of the resources they have on hand, and how to leverage those into an Adaptive Proactive Defense Strategy.
Introduction To ICT Security Audit OWASP Day Malaysia 2011
This document outlines an agenda for an IT audit and assessment event. It discusses identifying risks like outdated patches, weak passwords, open ports, and phishing. It provides resources for monitoring vulnerabilities and cracking passwords. Labs are suggested to practice tasks like patching, password cracking, port scanning, and network monitoring. The objective is to harden systems against common threats by finding vulnerabilities and ensuring regular security reviews are performed. Participants are encouraged to get involved to improve the security of their organization.
Securing Rails
A talk from 2006 about securing Rails applications. Some information is outdated, but the core concepts should still be useful.
A Botnet Detecting Infrastructure Using a Beneficial Botnet
A beneficial botnet, which tries to cope with technology of malicious botnets such as peer to peer (P2P) networking and Domain Generation Algorithm (DGA), is discussed. In order to cope with such botnets’ technology, we are developing a beneficial botnet as an anti-bot measure, using our previous beneficial bot. The beneficial botnet is a group of beneficial bots. The P2P communication of malicious botnet is hard to detect by a single Intrusion Detection System (IDS). Our beneficial botnet has the ability to detect P2P communication, using collaboration of our beneficial bots. The beneficial bot could detect communication of the pseudo botnet which mimics malicious botnet communication. Our beneficial botnet may also detect communication using DGA. Furthermore, our beneficial botnet has ability to cope with new technology of new botnets, because our beneficial botnet has the ability to evolve, as same as malicious botnets.
Honeypots
Honeypots are systems designed to capture unauthorized or illicit activity. They come in two main types: low-interaction honeypots emulate services and have limited interaction, while high-interaction honeypots use real systems and applications and can capture more extensive information but have higher risk. Honeyd is an example of a low-interaction honeypot that monitors unused IP space and emulates services like FTP to detect and log unauthorized activity.
OISF Aniversary: Active Defense - Helping threat actors hack themselves!
These are the slides from my "Active Defense - Helping threat actors hack themselves!" presentation at the Ohio Information Security Forum (OISF) Anniversary Conference on 07/14/2018 in Dayton, Ohio.
Title: Active Defense - Helping threat actors hack themselves!
Abstract:
Have you ever received one of those data breach notification letters in the mail? The short-term amends provided for having your personal data compromised is typically in the form of free short-term credit monitoring services. An entire Information Security industry segment has sprung up around Data Loss Prevention (DLP) aimed at stopping confidential data from being "leaked" out of an organization's boundaries for unauthorized use. What if the data breach perpetrators got a healthy dose of their own medicine instead of your private data? We cannot "hack back" legally today, but perhaps we can lure these malicious threat actors into actually hacking themselves... This presentation covers "Active Defense" techniques designed to frustrate data bandits attempting to steal and ex-filtrate our data.
The focus of this presentation is on actively defending a live public facing website. We begin by covering methods to shield innocent users by protecting them from our active defenses. We take advantage of malicious visitor’s impulse to evade all the rules by setting traps designed to ensnare those attempting to steal our data. The techniques covered involve faking accidental exposure and baiting traps using fictitious files and data too irresistible for cyber thieves to ignore. I then demonstrate deployable techniques used to fight back without launching a single attack.
honeypots-140921060716-phpapp01 (1).pdf
This document discusses honeypots, which are decoy computer systems used to gather intelligence about cyber attacks. It defines honeypots and classifies them based on interaction level, implementation, and purpose. Specific honeypot tools are also outlined, including Honeyd and Honeynet. Honeyd simulates entire networks on a single host using simple functionality. Honeynet involves deploying multiple high-interaction honeypots on a private network. Advantages of honeypots include collecting high value data at low cost while limiting false alarms. Risks and fingerprinting are challenges. Overall, honeypots provide a flexible security tool for monitoring attacks.
Honeypots for Active Defense
InfoSec analysts are all somewhat familiar with Honeypots. When they are given the proper attention, care and feeding, they produce invaluable information and can be a critical asset when it comes to defending the network. This intel has been primarily used by security researchers and organizations with advanced defensive capabilities to study their adversaries and learn from their actions. But what about the rest of us? Honeypots are a lot of work to configure, maintain, and monitor, right? Not exactly; when deployed and monitored properly, Honeypots and Honey Tokens are a simple way to alert on anomalous activity inside the network. But how can an organization that is not focused on research gain valuable threat intelligence using Honeypots and actively defend their network using indicators generated from an internal Honeynet?
The answer is Honeypots for Active Defense. There are currently many open source security tool distributions that come pre-loaded with Honeypots among other useful tools, however the Honeypot software is often not deployed in an effective manner. This session will discuss techniques to leverage Honeypots in ways that will not overburden the security team with massive logs to sift through and focuses efforts on correlating active threat data observed in the Honeypots with the production environment. When deploying Honeypots effectively, this can give security analysts one additional mechanism to tip them off to nefarious activity within their network before they become the next headline.
honeypotss.pptx
This document provides an overview of honeypots, including what they are, how they are classified, examples like Honeyd and Honeynet, advantages and disadvantages. Honeypots are computer resources used to gather threat intelligence by allowing unauthorized access. They can be classified by interaction level, implementation method, and purpose. Examples discussed are Honeyd, an open source low interaction virtual honeypot, and Honeynet, a high interaction architecture using multiple honeypots on a private network. Honeypots provide benefits like collecting small high value data sets and reduced false positives, but have limitations such as a limited view of attacks.
Bootstrapping Using Free Software
why startups should use open source software. presented at startup camp kl 2008, to a lively discussion
Debugging Spark: Scala and Python - Super Happy Fun Times @ Data Day Texas 2018
Apache Spark is one of the most popular big data projects, offering greatly improved performance over traditional MapReduce models. Much of Apache Spark’s power comes from lazy evaluation along with intelligent pipelining, which can make debugging more challenging. Holden Karau and Joey Echeverria explore how to debug Apache Spark applications, the different options for logging in Spark’s variety of supported languages, and some common errors and how to detect them.
Spark’s own internal logging can often be quite verbose. Holden and Joey demonstrate how to effectively search logs from Apache Spark to spot common problems and discuss options for logging from within your program itself. Spark’s accumulators have gotten a bad rap because of how they interact in the event of cache misses or partial recomputes, but Holden and Joey look at how to effectively use Spark’s current accumulators for debugging before gazing into the future to see the data property type accumulators that may be coming to Spark in future versions. And in addition to reading logs and instrumenting your program with accumulators, Spark’s UI can be of great help for quickly detecting certain types of problems. Holden and Joey cover how to quickly use the UI to figure out if certain types of issues are occurring in your job.
The talk will wrap up with Holden trying to get everyone to buy several copies of her new book, High Performance Spark.
Debugging Apache Spark
Apache Spark is one of the most popular big data projects, offering greatly improved performance over traditional MapReduce models. Much of Apache Spark’s power comes from lazy evaluation along with intelligent pipelining, which can make debugging more challenging. Holden Karau and Joey Echeverria explore how to debug Apache Spark applications, the different options for logging in Spark’s variety of supported languages, and some common errors and how to detect them.
Spark’s own internal logging can often be quite verbose. Holden and Joey demonstrate how to effectively search logs from Apache Spark to spot common problems and discuss options for logging from within your program itself. Spark’s accumulators have gotten a bad rap because of how they interact in the event of cache misses or partial recomputes, but Holden and Joey look at how to effectively use Spark’s current accumulators for debugging before gazing into the future to see the data property type accumulators that may be coming to Spark in future versions. And in addition to reading logs and instrumenting your program with accumulators, Spark’s UI can be of great help for quickly detecting certain types of problems. Holden and Joey cover how to quickly use the UI to figure out if certain types of issues are occurring in your job.
The talk will wrap up with Holden trying to get everyone to buy several copies of her new book, High Performance Spark.
The left is not wrong, just not right; It's time to shift right!
In the last few years of AppSec and DevOps, we've heard the calls to shift left. But how far left can we go, and is it really going to help eliminate exploitable bugs or scale your AppSec program? What if we consider a different direction, shifting right! Can a focus on shifting to the right be more effective in mitigating real-world threats and prioritization? In this presentation, I'll explore these questions and propose concepts that show why shifting right is right!
CSA Raleigh application security and deception in the cloud
Phillip Maddux gave a presentation on application security and deception in the cloud. He discussed the modern web landscape of microservices, APIs, and cloud platforms. He noted challenges with legacy security solutions like limited visibility, false positives, and lack of scalability. Maddux advocated for solutions that provide strategic and tactical visibility, dynamic detection without tuning, and leveraging cloud platform security features. He also discussed deception techniques like honeypots, lures, and automation to detect threats and collect intelligence on attackers in cloud environments. The goal is to make networks and clouds dangerous for attackers through deception.
More Related Content
Similar to HoneyPy & HoneyDB (LASCON 2016)
Honeypots, Deception, and Frankenstein
Presented on April 14, 2018 at CarolinaCon (https://www.carolinacon.org). This talk will provide a quick overview honeypots, an explanation of the cyber deception space, and the benefits of implementing deception as part of your cyber defense program. In addition, this talk will highlight the HoneyDB project, which enables anyone to get started with operating deception sensors and start collecting threat information. Finally, this presentation will describe how I built scalable honeypot sensor collection, employing a "Frankenstein Cloud Architecture", for minimal cost.
HoneyPy & HoneyDB (CarolinaCon 13)
Presented on May 21, 2017 at CarolinaCon (https://www.carolinacon.org). This talk will provide a light intro to honeypots and their benefits, and highlight two projects HoneyPy and HoneyDB. Operating honeypot sensors on your internal network is a simple way to make your network “noisy” and can trip up malicious actors that have already penetrated your network. Also, leveraging data from honeypot sensors on the Internet can be a useful source of threat information.
HoneyPy Honeypot (OWASP Triangle Chapter)
Presented on May 19, 2016 at the OWASP Triangle Chapter (https://www.meetup.com/owasptriangle/events/230531768/). Honeypots can be a valuable resource in detecting malicious actors on a network. The discussion will cover a brief intro on honeypots and then turns to HoneyPy, which is an open source honeypot that is extensible and simple to deploy. In addition, the talk will explore HoneyPy's integration with several other tools to increase visibility of malicious hosts on the Internet.
Honeypots, Deception, and Frankenstein
Presented on May 9, 2018 at SOURCE Conference Boston
(https://sourceconference.com/events/bos18/).
This version contains minor updates from previous presentations.
This talk will provide a quick overview honeypots, an explanation of the cyber deception space, and the benefits of implementing deception as part of your cyber defense program. In addition, this talk will highlight the HoneyDB project, which enables anyone to get started with operating deception sensors and start collecting threat information. Finally, this presentation will describe how I built scalable honeypot sensor collection, employing a "Frankenstein Cloud Architecture", for minimal cost.
Introduction to Honeypots
Edgis Sharing Session – Introduction to Honeypots
at Whitehat Society, Singapore Management University
September 2012
at Computing Society, Royal Holloway, University of London
February 2013
GNUCITIZEN Pdp Owasp Day September 2007
The document discusses potential ways that Web 2.0 technologies could be abused by malicious actors, through five fictional stories. It describes how social networks, APIs, cloud services and other Web 2.0 features could enable new types of malware, spam, botnets and data theft. The stories illustrate techniques like using mashups and feeds to distribute malware, exploiting search and social media to spread worms, using bookmarks for ad-jacking and creating botnets, and abusing aggregators and search engines to conduct reconnaissance. The document warns that legitimate Web 2.0 services could enable large-scale abuse if exploited by attackers.
Deception in Cyber Security (League of Women in Cyber Security)
Presented on August 23, 2017 at the League of Women in Cyber Security meetup (https://www.meetup.com/League-of-Women-in-Cybersecurity/events/242071337/). his talk will provide an intro to honeypots and their benefits, an intro to deception in cyber security, and an overview of HoneyPy and HoneyDB.
[CONFidence 2016] Leszek Miś - Honey(pot) flavored hunt for cyber enemy
Jednym z najistotniejszych czynników wspierających ochronę krytycznej infrastruktury sieciowej jest czas reakcji zespołu reagowania na incydenty bezpieczeństwa (Incident Response Team).
Im szybciej, tym lepiej. Rozwiązania wspomagające wczesne wykrywanie ataków oparte o pasywną analizę zapytań DNS, zbiorów danych Netflow czy PCAP warto wesprzeć coraz częściej docenianą i wykorzystywaną produkcyjnie infrastrukturą typu honeynet. Rozsądne osadzenie sond honeypotowych w różnych segmentach sieci pozwoli na wykrycie ataku już w początkowych fazach rekonesansu i enumeracji. Dzięki honeypotom niejednokrotnie uzyskamy także szczegółowe informacje na temat nowej techniki ataku, próby wykorzystania błędu typu 0-day czy bardzo specyficznego użycia znanych od lat narzędzi.
"Know your enemy" - to dewiza, którą powinniśmy się kierować w trosce o rozwój defensywnych umiejętności zespołów bezpieczeństwa i honeypotowa sieć zdecydowanie posiada tu dużą wartość.
Podczas prelekcji postaram się przedstawić sposoby wykorzystania jak i możliwości oferowane przez open source'owe rozwiązania typu honeypot. Będziemy mówić o pojedynczych projektach imitujących rzeczywiste usługi (DNS, SMB, SSH, SCP/SFTP, FTP, telnet, HTTP, TFTP, MySQL/MSSQL, RDP i wiele innych), wstrzykiwaniu poprzez reverse proxy honeypotowych zawartości do aplikacji webowych, atakowaniu atakujących;) , kończąc na dedykowanych platformach z wbudowanych stackiem ELK.
Blue team reboot - HackFest
Co Speaker: Cheryl Biswas
Talk Description:
How about this: a blue team talk given by red teamers. But here’s our rationale - your best defence right now is a strategic offence. The rules of the game have changed and we need to get defence up to speed.
We’ll show you what the key elements are in a good defence strategy; what you can and need to be using to full advantage. We’ll talk about the new “buzzwords” and how they apply: visibility; patterns; big data. There’s a whole lotta data to wrangle, and you aren’t seeing the whole picture if you aren’t doing things right. Threat intel is about getting the big picture as it applies to you. You’ll learn the importance of context and prioritization so that you can manipulate intel feeds to do your bidding. And then we’ll take things further and talk about hunting the adversary, using an update on proven methodologies.
We’ll show you how to understand your data, correlate threats and pin point attacks. Attendees will leave with a new understanding of the resources they have on hand, and how to leverage those into an Adaptive Proactive Defense Strategy.
Introduction To ICT Security Audit OWASP Day Malaysia 2011
This document outlines an agenda for an IT audit and assessment event. It discusses identifying risks like outdated patches, weak passwords, open ports, and phishing. It provides resources for monitoring vulnerabilities and cracking passwords. Labs are suggested to practice tasks like patching, password cracking, port scanning, and network monitoring. The objective is to harden systems against common threats by finding vulnerabilities and ensuring regular security reviews are performed. Participants are encouraged to get involved to improve the security of their organization.
Securing Rails
A talk from 2006 about securing Rails applications. Some information is outdated, but the core concepts should still be useful.
A Botnet Detecting Infrastructure Using a Beneficial Botnet
A beneficial botnet, which tries to cope with technology of malicious botnets such as peer to peer (P2P) networking and Domain Generation Algorithm (DGA), is discussed. In order to cope with such botnets’ technology, we are developing a beneficial botnet as an anti-bot measure, using our previous beneficial bot. The beneficial botnet is a group of beneficial bots. The P2P communication of malicious botnet is hard to detect by a single Intrusion Detection System (IDS). Our beneficial botnet has the ability to detect P2P communication, using collaboration of our beneficial bots. The beneficial bot could detect communication of the pseudo botnet which mimics malicious botnet communication. Our beneficial botnet may also detect communication using DGA. Furthermore, our beneficial botnet has ability to cope with new technology of new botnets, because our beneficial botnet has the ability to evolve, as same as malicious botnets.
Honeypots
Honeypots are systems designed to capture unauthorized or illicit activity. They come in two main types: low-interaction honeypots emulate services and have limited interaction, while high-interaction honeypots use real systems and applications and can capture more extensive information but have higher risk. Honeyd is an example of a low-interaction honeypot that monitors unused IP space and emulates services like FTP to detect and log unauthorized activity.
OISF Aniversary: Active Defense - Helping threat actors hack themselves!
These are the slides from my "Active Defense - Helping threat actors hack themselves!" presentation at the Ohio Information Security Forum (OISF) Anniversary Conference on 07/14/2018 in Dayton, Ohio.
Title: Active Defense - Helping threat actors hack themselves!
Abstract:
Have you ever received one of those data breach notification letters in the mail? The short-term amends provided for having your personal data compromised is typically in the form of free short-term credit monitoring services. An entire Information Security industry segment has sprung up around Data Loss Prevention (DLP) aimed at stopping confidential data from being "leaked" out of an organization's boundaries for unauthorized use. What if the data breach perpetrators got a healthy dose of their own medicine instead of your private data? We cannot "hack back" legally today, but perhaps we can lure these malicious threat actors into actually hacking themselves... This presentation covers "Active Defense" techniques designed to frustrate data bandits attempting to steal and ex-filtrate our data.
The focus of this presentation is on actively defending a live public facing website. We begin by covering methods to shield innocent users by protecting them from our active defenses. We take advantage of malicious visitor’s impulse to evade all the rules by setting traps designed to ensnare those attempting to steal our data. The techniques covered involve faking accidental exposure and baiting traps using fictitious files and data too irresistible for cyber thieves to ignore. I then demonstrate deployable techniques used to fight back without launching a single attack.
honeypots-140921060716-phpapp01 (1).pdf
This document discusses honeypots, which are decoy computer systems used to gather intelligence about cyber attacks. It defines honeypots and classifies them based on interaction level, implementation, and purpose. Specific honeypot tools are also outlined, including Honeyd and Honeynet. Honeyd simulates entire networks on a single host using simple functionality. Honeynet involves deploying multiple high-interaction honeypots on a private network. Advantages of honeypots include collecting high value data at low cost while limiting false alarms. Risks and fingerprinting are challenges. Overall, honeypots provide a flexible security tool for monitoring attacks.
Honeypots for Active Defense
InfoSec analysts are all somewhat familiar with Honeypots. When they are given the proper attention, care and feeding, they produce invaluable information and can be a critical asset when it comes to defending the network. This intel has been primarily used by security researchers and organizations with advanced defensive capabilities to study their adversaries and learn from their actions. But what about the rest of us? Honeypots are a lot of work to configure, maintain, and monitor, right? Not exactly; when deployed and monitored properly, Honeypots and Honey Tokens are a simple way to alert on anomalous activity inside the network. But how can an organization that is not focused on research gain valuable threat intelligence using Honeypots and actively defend their network using indicators generated from an internal Honeynet?
The answer is Honeypots for Active Defense. There are currently many open source security tool distributions that come pre-loaded with Honeypots among other useful tools, however the Honeypot software is often not deployed in an effective manner. This session will discuss techniques to leverage Honeypots in ways that will not overburden the security team with massive logs to sift through and focuses efforts on correlating active threat data observed in the Honeypots with the production environment. When deploying Honeypots effectively, this can give security analysts one additional mechanism to tip them off to nefarious activity within their network before they become the next headline.
honeypotss.pptx
This document provides an overview of honeypots, including what they are, how they are classified, examples like Honeyd and Honeynet, advantages and disadvantages. Honeypots are computer resources used to gather threat intelligence by allowing unauthorized access. They can be classified by interaction level, implementation method, and purpose. Examples discussed are Honeyd, an open source low interaction virtual honeypot, and Honeynet, a high interaction architecture using multiple honeypots on a private network. Honeypots provide benefits like collecting small high value data sets and reduced false positives, but have limitations such as a limited view of attacks.
Bootstrapping Using Free Software
why startups should use open source software. presented at startup camp kl 2008, to a lively discussion
Debugging Spark: Scala and Python - Super Happy Fun Times @ Data Day Texas 2018
Apache Spark is one of the most popular big data projects, offering greatly improved performance over traditional MapReduce models. Much of Apache Spark’s power comes from lazy evaluation along with intelligent pipelining, which can make debugging more challenging. Holden Karau and Joey Echeverria explore how to debug Apache Spark applications, the different options for logging in Spark’s variety of supported languages, and some common errors and how to detect them.
Spark’s own internal logging can often be quite verbose. Holden and Joey demonstrate how to effectively search logs from Apache Spark to spot common problems and discuss options for logging from within your program itself. Spark’s accumulators have gotten a bad rap because of how they interact in the event of cache misses or partial recomputes, but Holden and Joey look at how to effectively use Spark’s current accumulators for debugging before gazing into the future to see the data property type accumulators that may be coming to Spark in future versions. And in addition to reading logs and instrumenting your program with accumulators, Spark’s UI can be of great help for quickly detecting certain types of problems. Holden and Joey cover how to quickly use the UI to figure out if certain types of issues are occurring in your job.
The talk will wrap up with Holden trying to get everyone to buy several copies of her new book, High Performance Spark.
Debugging Apache Spark
Apache Spark is one of the most popular big data projects, offering greatly improved performance over traditional MapReduce models. Much of Apache Spark’s power comes from lazy evaluation along with intelligent pipelining, which can make debugging more challenging. Holden Karau and Joey Echeverria explore how to debug Apache Spark applications, the different options for logging in Spark’s variety of supported languages, and some common errors and how to detect them.
Spark’s own internal logging can often be quite verbose. Holden and Joey demonstrate how to effectively search logs from Apache Spark to spot common problems and discuss options for logging from within your program itself. Spark’s accumulators have gotten a bad rap because of how they interact in the event of cache misses or partial recomputes, but Holden and Joey look at how to effectively use Spark’s current accumulators for debugging before gazing into the future to see the data property type accumulators that may be coming to Spark in future versions. And in addition to reading logs and instrumenting your program with accumulators, Spark’s UI can be of great help for quickly detecting certain types of problems. Holden and Joey cover how to quickly use the UI to figure out if certain types of issues are occurring in your job.
The talk will wrap up with Holden trying to get everyone to buy several copies of her new book, High Performance Spark.
Similar to HoneyPy & HoneyDB (LASCON 2016) (20)
Deception in Cyber Security (League of Women in Cyber Security)
Deception in Cyber Security (League of Women in Cyber Security)
[CONFidence 2016] Leszek Miś - Honey(pot) flavored hunt for cyber enemy
[CONFidence 2016] Leszek Miś - Honey(pot) flavored hunt for cyber enemy
Introduction To ICT Security Audit OWASP Day Malaysia 2011
Introduction To ICT Security Audit OWASP Day Malaysia 2011
A Botnet Detecting Infrastructure Using a Beneficial Botnet
A Botnet Detecting Infrastructure Using a Beneficial Botnet
OISF Aniversary: Active Defense - Helping threat actors hack themselves!
OISF Aniversary: Active Defense - Helping threat actors hack themselves!
Debugging Spark: Scala and Python - Super Happy Fun Times @ Data Day Texas 2018
Debugging Spark: Scala and Python - Super Happy Fun Times @ Data Day Texas 2018
More from Phillip Maddux
The left is not wrong, just not right; It's time to shift right!
In the last few years of AppSec and DevOps, we've heard the calls to shift left. But how far left can we go, and is it really going to help eliminate exploitable bugs or scale your AppSec program? What if we consider a different direction, shifting right! Can a focus on shifting to the right be more effective in mitigating real-world threats and prioritization? In this presentation, I'll explore these questions and propose concepts that show why shifting right is right!
CSA Raleigh application security and deception in the cloud
Phillip Maddux gave a presentation on application security and deception in the cloud. He discussed the modern web landscape of microservices, APIs, and cloud platforms. He noted challenges with legacy security solutions like limited visibility, false positives, and lack of scalability. Maddux advocated for solutions that provide strategic and tactical visibility, dynamic detection without tuning, and leveraging cloud platform security features. He also discussed deception techniques like honeypots, lures, and automation to detect threats and collect intelligence on attackers in cloud environments. The goal is to make networks and clouds dangerous for attackers through deception.
Shift Left. Wait, what? No, Shift Right!!!
Presented on November 7, 2018 at Triangle DevOps (https://www.meetup.com/triangle-devops/).
Recently in the DevSecOps world there has been a call to shift left. However, application security has been shifting left for years already. What we should be doing is shifting application security to the right (production). This can be done by instrumenting applications for security.
SecOps Armageddon: A look into the future of security & operations
Presented on November 7, 2018 at Triangle DevOps (https://www.meetup.com/triangle-devops/).
With the continuing evolution of the shift to the cloud and automation, this talk explores what the future might look like for security and operations. Will security and operations be abstracted away, resulting in only developers having jobs?
Application security for the modern web - ISSA South Texas Houston DevOps
Presented on September 9, 2018 at ISSA South Texas Houston DevOps conference (http://www.southtexasissa.org/).
Over the last several years we’ve witnessed, and experienced, an advance towards new approaches in web technologies and the processes to deploy web applications. In this talk, we’ll explore and describe the “Modern Web”, discuss observations on the evolution of the Secure SDLC, recognize existing challenges in achieving real-time threat visibility once web applications are deployed to production, and finally, walk through the concepts that address the challenges in fast paced “agile” development cycles.
HoneyPy & HoneyDB (TriPython)
This document discusses HoneyPy and HoneyDB, which are tools for running low to medium interaction honeypots. HoneyPy is a Python-based honeypot that uses plugins to emulate different network services. It has options for running in the console or as a daemon. HoneyDB is a PHP-based web application for viewing and accessing honeypot data through an API. It provides activity charts, session details, and integrates with other threat intelligence sources. The document demonstrates HoneyPy and discusses potential extensions, like adding new plugins or integrations. It also covers using HoneyPy on Docker or a Raspberry Pi.
More from Phillip Maddux (6)
The left is not wrong, just not right; It's time to shift right!
The left is not wrong, just not right; It's time to shift right!
CSA Raleigh application security and deception in the cloud
CSA Raleigh application security and deception in the cloud
SecOps Armageddon: A look into the future of security & operations
SecOps Armageddon: A look into the future of security & operations
Application security for the modern web - ISSA South Texas Houston DevOps
Application security for the modern web - ISSA South Texas Houston DevOps
Recently uploaded
Principle of conventional tomography-Bibash Shahi ppt..pptx
before the computed tomography, it had been widely used.
Leveraging the Graph for Clinical Trials and Standards
Katja Glaß
OpenStudyBuilder Community Manager - Katja Glaß Consulting
Marius Conjeaud
Principal Consultant - Neo4j
A Deep Dive into ScyllaDB's Architecture
This talk will cover ScyllaDB Architecture from the cluster-level view and zoom in on data distribution and internal node architecture. In the process, we will learn the secret sauce used to get ScyllaDB's high availability and superior performance. We will also touch on the upcoming changes to ScyllaDB architecture, moving to strongly consistent metadata and tablets.
GraphRAG for LifeSciences Hands-On with the Clinical Knowledge Graph
Tomaz Bratanic
Graph ML and GenAI Expert - Neo4j
Freshworks Rethinks NoSQL for Rapid Scaling & Cost-Efficiency
Freshworks creates AI-boosted business software that helps employees work more efficiently and effectively. Managing data across multiple RDBMS and NoSQL databases was already a challenge at their current scale. To prepare for 10X growth, they knew it was time to rethink their database strategy. Learn how they architected a solution that would simplify scaling while keeping costs under control.
Mutation Testing for Task-Oriented Chatbots
Conversational agents, or chatbots, are increasingly used to access all sorts of services using natural language. While open-domain chatbots - like ChatGPT - can converse on any topic, task-oriented chatbots - the focus of this paper - are designed for specific tasks, like booking a flight, obtaining customer support, or setting an appointment. Like any other software, task-oriented chatbots need to be properly tested, usually by defining and executing test scenarios (i.e., sequences of user-chatbot interactions). However, there is currently a lack of methods to quantify the completeness and strength of such test scenarios, which can lead to low-quality tests, and hence to buggy chatbots.
To fill this gap, we propose adapting mutation testing (MuT) for task-oriented chatbots. To this end, we introduce a set of mutation operators that emulate faults in chatbot designs, an architecture that enables MuT on chatbots built using heterogeneous technologies, and a practical realisation as an Eclipse plugin. Moreover, we evaluate the applicability, effectiveness and efficiency of our approach on open-source chatbots, with promising results.
inQuba Webinar Mastering Customer Journey Management with Dr Graham Hill
HERE IS YOUR WEBINAR CONTENT! 'Mastering Customer Journey Management with Dr. Graham Hill'. We hope you find the webinar recording both insightful and enjoyable.
In this webinar, we explored essential aspects of Customer Journey Management and personalization. Here’s a summary of the key insights and topics discussed:
Key Takeaways:
Understanding the Customer Journey: Dr. Hill emphasized the importance of mapping and understanding the complete customer journey to identify touchpoints and opportunities for improvement.
Personalization Strategies: We discussed how to leverage data and insights to create personalized experiences that resonate with customers.
Technology Integration: Insights were shared on how inQuba’s advanced technology can streamline customer interactions and drive operational efficiency.
Essentials of Automations: Exploring Attributes & Automation Parameters
Building automations in FME Flow can save time, money, and help businesses scale by eliminating data silos and providing data to stakeholders in real-time. One essential component to orchestrating complex automations is the use of attributes & automation parameters (both formerly known as “keys”). In fact, it’s unlikely you’ll ever build an Automation without using these components, but what exactly are they?
Attributes & automation parameters enable the automation author to pass data values from one automation component to the next. During this webinar, our FME Flow Specialists will cover leveraging the three types of these output attributes & parameters in FME Flow: Event, Custom, and Automation. As a bonus, they’ll also be making use of the Split-Merge Block functionality.
You’ll leave this webinar with a better understanding of how to maximize the potential of automations by making use of attributes & automation parameters, with the ultimate goal of setting your enterprise integration workflows up on autopilot.
"NATO Hackathon Winner: AI-Powered Drug Search", Taras Kloba
This is a session that details how PostgreSQL's features and Azure AI Services can be effectively used to significantly enhance the search functionality in any application.
In this session, we'll share insights on how we used PostgreSQL to facilitate precise searches across multiple fields in our mobile application. The techniques include using LIKE and ILIKE operators and integrating a trigram-based search to handle potential misspellings, thereby increasing the search accuracy.
We'll also discuss how the azure_ai extension on PostgreSQL databases in Azure and Azure AI Services were utilized to create vectors from user input, a feature beneficial when users wish to find specific items based on text prompts. While our application's case study involves a drug search, the techniques and principles shared in this session can be adapted to improve search functionality in a wide range of applications. Join us to learn how PostgreSQL and Azure AI can be harnessed to enhance your application's search capability.
ScyllaDB Tablets: Rethinking Replication
ScyllaDB is making a major architecture shift. We’re moving from vNode replication to tablets – fragments of tables that are distributed independently, enabling dynamic data distribution and extreme elasticity. In this keynote, ScyllaDB co-founder and CTO Avi Kivity explains the reason for this shift, provides a look at the implementation and roadmap, and shares how this shift benefits ScyllaDB users.
"Scaling RAG Applications to serve millions of users", Kevin Goedecke
How we managed to grow and scale a RAG application from zero to thousands of users in 7 months. Lessons from technical challenges around managing high load for LLMs, RAGs and Vector databases.
Session 1 - Intro to Robotic Process Automation.pdf
👉 Check out our full 'Africa Series - Automation Student Developers (EN)' page to register for the full program:
https://bit.ly/Automation_Student_Kickstart
In this session, we shall introduce you to the world of automation, the UiPath Platform, and guide you on how to install and setup UiPath Studio on your Windows PC.
📕 Detailed agenda:
What is RPA? Benefits of RPA?
RPA Applications
The UiPath End-to-End Automation Platform
UiPath Studio CE Installation and Setup
💻 Extra training through UiPath Academy:
Introduction to Automation
UiPath Business Automation Platform
Explore automation development with UiPath Studio
👉 Register here for our upcoming Session 2 on June 20: Introduction to UiPath Studio Fundamentals: https://community.uipath.com/events/details/uipath-lagos-presents-session-2-introduction-to-uipath-studio-fundamentals/
From Natural Language to Structured Solr Queries using LLMs
This talk draws on experimentation to enable AI applications with Solr. One important use case is to use AI for better accessibility and discoverability of the data: while User eXperience techniques, lexical search improvements, and data harmonization can take organizations to a good level of accessibility, a structural (or “cognitive” gap) remains between the data user needs and the data producer constraints.
That is where AI – and most importantly, Natural Language Processing and Large Language Model techniques – could make a difference. This natural language, conversational engine could facilitate access and usage of the data leveraging the semantics of any data source.
The objective of the presentation is to propose a technical approach and a way forward to achieve this goal.
The key concept is to enable users to express their search queries in natural language, which the LLM then enriches, interprets, and translates into structured queries based on the Solr index’s metadata.
This approach leverages the LLM’s ability to understand the nuances of natural language and the structure of documents within Apache Solr.
The LLM acts as an intermediary agent, offering a transparent experience to users automatically and potentially uncovering relevant documents that conventional search methods might overlook. The presentation will include the results of this experimental work, lessons learned, best practices, and the scope of future work that should improve the approach and make it production-ready.
Crafting Excellence: A Comprehensive Guide to iOS Mobile App Development Serv...
Crafting Excellence: A Comprehensive Guide to iOS Mobile App Development Serv...Pitangent Analytics & Technology Solutions Pvt. Ltd
Discover top-tier mobile app development services, offering innovative solutions for iOS and Android. Enhance your business with custom, user-friendly mobile applications.Northern Engraving | Modern Metal Trim, Nameplates and Appliance Panels
What began over 115 years ago as a supplier of precision gauges to the automotive industry has evolved into being an industry leader in the manufacture of product branding, automotive cockpit trim and decorative appliance trim. Value-added services include in-house Design, Engineering, Program Management, Test Lab and Tool Shops.
zkStudyClub - LatticeFold: A Lattice-based Folding Scheme and its Application...
Folding is a recent technique for building efficient recursive SNARKs. Several elegant folding protocols have been proposed, such as Nova, Supernova, Hypernova, Protostar, and others. However, all of them rely on an additively homomorphic commitment scheme based on discrete log, and are therefore not post-quantum secure. In this work we present LatticeFold, the first lattice-based folding protocol based on the Module SIS problem. This folding protocol naturally leads to an efficient recursive lattice-based SNARK and an efficient PCD scheme. LatticeFold supports folding low-degree relations, such as R1CS, as well as high-degree relations, such as CCS. The key challenge is to construct a secure folding protocol that works with the Ajtai commitment scheme. The difficulty, is ensuring that extracted witnesses are low norm through many rounds of folding. We present a novel technique using the sumcheck protocol to ensure that extracted witnesses are always low norm no matter how many rounds of folding are used. Our evaluation of the final proof system suggests that it is as performant as Hypernova, while providing post-quantum security.
Paper Link: https://eprint.iacr.org/2024/257
Must Know Postgres Extension for DBA and Developer during Migration
Mydbops Opensource Database Meetup 16
Topic: Must-Know PostgreSQL Extensions for Developers and DBAs During Migration
Speaker: Deepak Mahto, Founder of DataCloudGaze Consulting
Date & Time: 8th June | 10 AM - 1 PM IST
Venue: Bangalore International Centre, Bangalore
Abstract: Discover how PostgreSQL extensions can be your secret weapon! This talk explores how key extensions enhance database capabilities and streamline the migration process for users moving from other relational databases like Oracle.
Key Takeaways:
* Learn about crucial extensions like oracle_fdw, pgtt, and pg_audit that ease migration complexities.
* Gain valuable strategies for implementing these extensions in PostgreSQL to achieve license freedom.
* Discover how these key extensions can empower both developers and DBAs during the migration process.
* Don't miss this chance to gain practical knowledge from an industry expert and stay updated on the latest open-source database trends.
Mydbops Managed Services specializes in taking the pain out of database management while optimizing performance. Since 2015, we have been providing top-notch support and assistance for the top three open-source databases: MySQL, MongoDB, and PostgreSQL.
Our team offers a wide range of services, including assistance, support, consulting, 24/7 operations, and expertise in all relevant technologies. We help organizations improve their database's performance, scalability, efficiency, and availability.
Contact us: info@mydbops.com
Visit: https://www.mydbops.com/
Follow us on LinkedIn: https://in.linkedin.com/company/mydbops
For more details and updates, please follow up the below links.
Meetup Page : https://www.meetup.com/mydbops-databa...
Twitter: https://twitter.com/mydbopsofficial
Blogs: https://www.mydbops.com/blog/
Facebook(Meta): https://www.facebook.com/mydbops/
What is an RPA CoE? Session 1 – CoE Vision
In the first session, we will review the organization's vision and how this has an impact on the COE Structure.
Topics covered:
• The role of a steering committee
• How do the organization’s priorities determine CoE Structure?
Speaker:
Chris Bolin, Senior Intelligent Automation Architect Anika Systems
"Frontline Battles with DDoS: Best practices and Lessons Learned", Igor Ivaniuk
At this talk we will discuss DDoS protection tools and best practices, discuss network architectures and what AWS has to offer. Also, we will look into one of the largest DDoS attacks on Ukrainian infrastructure that happened in February 2022. We'll see, what techniques helped to keep the web resources available for Ukrainians and how AWS improved DDoS protection for all customers based on Ukraine experience
Recently uploaded (20)
Principle of conventional tomography-Bibash Shahi ppt..pptx
Principle of conventional tomography-Bibash Shahi ppt..pptx
Leveraging the Graph for Clinical Trials and Standards
Leveraging the Graph for Clinical Trials and Standards
GraphRAG for LifeSciences Hands-On with the Clinical Knowledge Graph
GraphRAG for LifeSciences Hands-On with the Clinical Knowledge Graph
Freshworks Rethinks NoSQL for Rapid Scaling & Cost-Efficiency
Freshworks Rethinks NoSQL for Rapid Scaling & Cost-Efficiency
inQuba Webinar Mastering Customer Journey Management with Dr Graham Hill
inQuba Webinar Mastering Customer Journey Management with Dr Graham Hill
Essentials of Automations: Exploring Attributes & Automation Parameters
Essentials of Automations: Exploring Attributes & Automation Parameters
"NATO Hackathon Winner: AI-Powered Drug Search", Taras Kloba
"NATO Hackathon Winner: AI-Powered Drug Search", Taras Kloba
"Scaling RAG Applications to serve millions of users", Kevin Goedecke
"Scaling RAG Applications to serve millions of users", Kevin Goedecke
Session 1 - Intro to Robotic Process Automation.pdf
Session 1 - Intro to Robotic Process Automation.pdf
From Natural Language to Structured Solr Queries using LLMs
From Natural Language to Structured Solr Queries using LLMs
Crafting Excellence: A Comprehensive Guide to iOS Mobile App Development Serv...
Crafting Excellence: A Comprehensive Guide to iOS Mobile App Development Serv...
Northern Engraving | Modern Metal Trim, Nameplates and Appliance Panels
Northern Engraving | Modern Metal Trim, Nameplates and Appliance Panels
zkStudyClub - LatticeFold: A Lattice-based Folding Scheme and its Application...
zkStudyClub - LatticeFold: A Lattice-based Folding Scheme and its Application...
Poznań ACE event - 19.06.2024 Team 24 Wrapup slidedeck
Poznań ACE event - 19.06.2024 Team 24 Wrapup slidedeck
Must Know Postgres Extension for DBA and Developer during Migration
Must Know Postgres Extension for DBA and Developer during Migration
"Frontline Battles with DDoS: Best practices and Lessons Learned", Igor Ivaniuk
"Frontline Battles with DDoS: Best practices and Lessons Learned", Igor Ivaniuk
HoneyPy & HoneyDB (LASCON 2016)
- 1. HoneyPy & HoneyDB A low to medium interaction honeypot LASCON
- 2. BIO Previously did security stuff at ● Goldman Sachs ● Ernst & Young ● Florida International University (some IT stuff too) On the socials ● Twitter: @foospidy ● Github: http://github.com/foospidy ● LinkedIn: https://www.linkedin.com/in/phillip-maddux-60499a105 ● Blog: http://pxmx.io LASCON Senior Solutions Engineer @ Signal Sciences https://signalsciences.com
- 4. AGENDA ● Honeypots Overview ● HoneyPy ● HoneyDB ● What’s next? ● Q&A LASCON
- 6. Honeypots Overview A computer configured to look like a legit system on the network, but its real purpose is to discover and/or track attackers. Types of Honeypots: ● Production ● Research ● Hobbyist Honeypot interaction tiers: ● Low - emulated services, limited to no emulated login capability (low risk). ● Medium - emulated services, emulated login, emulated commands. ● High - Actual services, system logins, and commands (very risky). LASCON
- 7. Intro to honeypots Production honeypots have are computers on the network that have no legitimate business purpose and should never see any traffic, unless… ● Something is misconfigured on the network ● Someone is malicious on the network Honeypot logs are low volume and high value LASCON
- 8. Intro to honeypots Research honeypots can have many purposes, just depends on what you are researching. ● Identify sources of malicious traffic ● Discover malware, botnets, c&c servers. ● Attacker techniques & tools LASCON
- 9. Intro to honeypots Checkout… No Budget Threat Intelligence - Tracking Malware Campaigns on the Cheap https://www.youtube.com/watch?v=DKfWukYffsE Andrew Morris ( @Andrew___Morris)- ShmooCon 2015 Great talk - Reversing malware - Uncovering c2 servers - Uncovering imminent ddos attacks LASCON
- 10. Intro to honeypots Cool new idea… Collect stats on malicious hosts that respond to a scan. https://twitter.com/backhack_detect LASCON
- 11. Intro to honeypots Hobbyist honeypots... ● I probably fit into this category. ● It’s fun! LASCON
- 14. Oops! LASCON
- 15. HoneyPy LASCON
- 16. HoneyPy ● Low to medium interaction honeypot ● Plugin based to implement various network services (tcp or udp based). ● Written in Python LASCON
- 17. HoneyPy Why create HoneyPy? ● Wanted a simple honeypot that can be easily extended ● Wanted a project to do more Python LASCON
- 18. HoneyPy The Code: http://github.com/foospidy/HoneyPy The Demo: LASCON
- 19. HoneyPy Features ● Plugins ○ https://github.com/foospidy/HoneyPy/tree/master/plugins ● Easy service config ○ https://github.com/foospidy/HoneyPy/blob/master/etc/services.cfg ● Integrations (loggers) ○ https://github.com/foospidy/HoneyPy/tree/master/lib LASCON
- 20. @HoneyPyLog Twitter feed of honeypot activity. https://twitter.com/HoneyPyLog LASCON
- 22. HoneyPy Additional Deployment Options LASCON ● Docker, because docker all the things... ○ https://github.com/foospidy/HoneyPy-Docker ● Raspberry Pi, because raspberry pi all the things... ○ https://github.com/foospidy/HoneyPyPi ○ Demos ■ https://asciinema.org/a/4814e766bqsgbdohcxandtvqc ■ https://asciinema.org/a/6erwn2n4w5jgjm5d2bvoontfv
- 23. HoneyDB Web site for viewing and accessing honeypot data. Activity charts, session details, and ThreatBin. https://riskdiscovery.com/honeydb LASCON
- 24. What’s Next? ● More plugins ● Enhance plugins ● More Integrations ● HoneyDB, more API endpoints Or... you come up with what’s next! Pull requests are welcome, please contribute :-) LASCON
- 25. References Blog post, HoneyPy getting started series. Good books: Honeynet Project ● https://www.honeynet.org LASCON
- 26. Help! Follow, maybe? @foospidy HoneyPy haz moar follow :-( LASCON