Are you aware that malicious attackers are attacking your unused IP addresses?

1. Monitoring Indonesia Darknets –
Revealing the Unseen Security
Intrusion
CodeBali International Cyber Security Conference
Bali, 22 September 2015
Charles Lim

2. Speakers
• Charles Lim, Msc., ECSA, ECSP, ECIH,
CEH, CEI
• More than 20+ year in IT services industry
• IP networking, Software Automation,
• Led Indonesia Chapter (2012)
• Lecturer and Researcher at Swiss German
University (Information Security Group) –
http://people.sgu.ac.id/charleslim

3. Agenda
• Introduction to Honeynet
• Introduction to Honeynet - Indonesia
Chapter
• What is darknets?
• Honeypots
• Attack Statistics
• The New Dashboard
• Conclusion

4. Introduction to The Honeynet
Project
• Volunteer open source computer security
research organization since 1999 (US 501c3
non-profit)
• Mission: ¨learn the tools, tactics and motives
involved in computer and network attacks, and
share the lessons learned¨ -
http://www.honeynet.org

5. Brief Introduction to The
Honeynet Project
Honeynet Workshop 2015 @ Stavanger

6. Indonesia Chapter
• 25 November 2011, about 15
people from academia, security
professionals and government
made the declaration during
our yearly malware workshop
at SGU (Swiss German
University)
• 19 January 2012 accepted as
part of Honeynet Chapter
• Members: 109 (today)

7. Indonesia Chapter
• Indonesia Honeynet Project
• Id_honeynet
• http://www.honeynet.or.id
• http://groups.google.com/group/id-honeynet

8. Indonesia Honeynet Project
Seminar & Workshop
Honeynet Workshop 10-11 Juni 2015, Lampung

9. How we start?
• Four students of SGU in 2010 wanted to
explore how to use Data Mining to understand
Cyber Security Threats:
• 2 students focusing on Malware Threats
• 2 students focusing on Cyber Terrorism
• 1 Student SGU focused on capturing malware
using Honeypots (Nepenthes)
• We also invited Malware Expert, Pak Aat to
share his experience

10. Honeypot Deployment History
2009 2011 2013 2015
Learning
Period
Early
Period
Growing
Period
Expanding
Period
Honeypot:
Nepenthes
Honeypot:
Nepenthes,
Dionaea
Honeypot:
Dionaea
Honeypot:
Dionaea, Kippo,
Glastopf,
Honeytrap
Learning How to
install and
configure
Deployed 1st
Honeypot in SGU
More Honeypots
deployed
Coverage: Java,
Bali, Sumatera,
# Honeypots
deployed: None
# Honeypots
deployed: 1
# Honeypots
deployed: 5
# Honeypots
deployed: 13
Hardware: Client Hardware: Simple
Client and Server
Hardware: Mini PC
and Server
Hardware:
Raspberry Pi and
Dedicated servers

11. List of contributors
• Amien H.R.
• Randy Anthony
• Michael
• Stewart
• Glenn
• Mario Marcello
• Joshua Tommy
• Andrew Japar
• Christiandi
• Kevin Kurniawan

12. What is Darknets?
Darknet – portion of routed, allocated IP
space in which no active servers reside.
— Team CYMRU

13. What is Darknets?
Livenet Darknet
Live IP Address (used) Unused IPs

14. Darknets and Honeypots
Goal
• To understand cyber activities in our institutions
in Indonesia (Government, Education and
Industry)
How
• Honeypot servers put in the unused IP address
across the above organizations

15. Honeypots
Currently deployed
• Dionaea
• Kippo
• Glastopf
• Honeytrap
Future
• SPAMpots

16. Previous Works
• Nano PC with Atom processors
• Pull Protocol

17. Today
• Raspberry PI
• ARM processor
• RAM 512 MB, 8 GB SD Card
• Push Protocol

18. Near Future
• 1 U Rack Case
• 5 Raspberry PI
• 5 different honeypots: dionaea, glastopf, kippo,
etc.

19. Monitoring Results

20. Monitoring Results

21. Monitoring Results

22. Monitoring Results

23. Monitoring Results

24. Monitoring Results (Ports Attacked)

25. Monitoring Results (Ports Attacked)

26. Monitoring Results (Ports Attacked)

27. Monitoring Results (Ports Attacked)

28. Monitoring Results (Ports Attacked)

29. Monitoring Results (Malware)

30. Monitoring Results (Malware)

31. Monitoring Results (Malware)

32. Monitoring Results (Malware)

33. Monitoring Results (Malware)

34. Monitoring Results (Malware)

35. Monitoring Results (Malware)

36. Monitoring Results (Malware)

37. New Dashboard

38. Further Information
• The Honeynet Project
(http://www.honeynet.org)
• Indonesia Honeynet Project
(http://www.honeynet.or.id)
• Swiss German University
(http://www.sgu.ac.id)
• My Blog
(http://people.sgu.ac.id/charleslim)

39. Indonesia Chapter
• Indonesia Honeynet Project
• Id_honeynet
• http://www.honeynet.or.id
• http://groups.google.com/group/id-honeynet

40. Questions ???