ACM CCS Workshop on Security and Privacy in Smartphones and Mobile Devices (SPSM) This Network is Infected: HoSTaGe - a Low-Interaction Honeypot for Mobile Devices Emmanouil Vasilomanolakis, Shankar Karuppayah, Mathias Fischer, Max Mühlhäuser, Mihai Plasoianu, Lars Pandikow and Wulf Pfeiffer shankar.karuppayah@cased.de

Introduction Increasing number of cyber attacks Availability of open wireless access, e.g., airports, coffee shops Many mobile devices are used Malware propagation hub/medium Users blindly connect to these networks Defense mechanism usually known to users Firewall Antivirus Notifies AFTER being attacked © Jeremy Brooks, Flickr © Daniel Duclos, Flickr © Jeremey Keith, Flickr HosTaGe - a Low-Interaction Honeypot for Mobile Devices

© Calgary Reviews, Flickr Introduction (cont.) What else can the users use? Honeypots provide an early alert system Designed to be probed, attacked or compromised Emulate vulnerabilities Identify potential malware/attacker BEFORE an attack Requires dedicated machine/hardware (not portable) Honeypot-to-go A mobile (application) honeypot Easily accessible Analysis before connecting to a network © Calgary Reviews, Flickr HosTaGe - a Low-Interaction Honeypot for Mobile Devices

Outline Requirements Architecture Proof-of-concept Performance analysis Limitations & Future work Conclusion HosTaGe - a Low-Interaction Honeypot for Mobile Devices

HosTaGe: A low-interaction honeypot for mobile devices Requirements Requirements Honeypot High interaction Low interaction 1. Visibility 2. Usability 3. Security & Containment 4. Min. Resource Utilization 5. Extendability & Interoperability Define Mobile Honeypot’s definition HosTaGe: A low-interaction honeypot for mobile devices HosTaGe - a Low-Interaction Honeypot for Mobile Devices

Graphical User Interface (GUI) Architecture Logger SQLite database JSON format Text file Port Binder Android OS security policy prevents access to port < 1024 Work around needed HosTaGe Core Emulator: SMB, FTP, … Connection Guard Max connections Timeouts Graphical User Interface (GUI) Single glance overview Network security health indicator Usability Graphical User Interface (GUI) HosTaGe Core Extendability & Interoperability Visibility Emulator Logger Security & Containment Connection Guard Min. Resource Utilization Port Binder Protocol Emulation SMB FTP … Connection 1 Connection 2 … … Dalvik VM Linux Kernel HosTaGe - a Low-Interaction Honeypot for Mobile Devices

Proof-of-concept Isolated testbed 3x Computers 1x HosTaGe 1x Wireless access point HosTaGe - a Low-Interaction Honeypot for Mobile Devices

Proof-of-concept (cont.) HosTaGe - a Low-Interaction Honeypot for Mobile Devices

Performance Analysis (cont.) Resource Utilization Automated attacks: 0-5 connection/30s 60 minutes Measured using PowerTutor [1] Other applications measured: WhatsApp Facebook AVG Free Antivirus HosTaGe Under Stress HosTaGe - a Low-Interaction Honeypot for Mobile Devices

Limitations & Future Work Requirement of a rooted device i.e., access to ports < 1024 Malware specific behaviors: Influence detection efficiency, i.e., time required before detection Future Work Extending protocol(s) Call Home feature Geographical location attack mapping Enhancing HosTaGe, e.g., anti-fingerprinting Malware behavior.. Doesn’t affect if it’s a malicious user conducting scan and then attack HosTaGe - a Low-Interaction Honeypot for Mobile Devices

shankar.karuppayah@cased.de Conclusion Proposed the idea of Honeypot-to-go HosTaGe, first low-interaction honeypot for mobile devices Showed the feasibility of such a system Tool to boost security awareness On-the-go security analysis for network administrators Shankar Karuppayah, Doctoral Researcher CASED Mornewegstr. 32 64293 Darmstadt/Germany shankar.karuppayah@cased.de Phone +49 6151 16-3983 Fax +49 6151 16-3052 www.cased.de HosTaGe available at : http://www.tk.informatik.tu-darmstadt.de/de/research/secure-smart-infrastructures/hostage/ HosTaGe - a Low-Interaction Honeypot for Mobile Devices

References [1] M. Gordon, L. Zhang, B. Tiwana, R. Dick, Z. M. Mao, and L. Yang, “PowerTutor: A power monitor for android-based mobile platforms”, http://ziyang.eecs.umich.edu/projects/powertutor/, 2013. [2] C. Mulliner, S. Liebergeld, and M. Lange. “Poster : HoneyDroid - Creating a Smartphone Honeypot”. In IEEE Symposium on Security and Privacy (S&P), 2011. [3] M. Wählisch, T. C. Schmidt, A. Vorbach, C. Keil, J. Schönfelder, and J. Schiller. “Design, Implementation, and Operation of a Mobile Honeypot”. Technical report, 2013. [4] M. Wählisch, S. Trapp, C. Keil, J. Schönfelder, T. C. Schmidt, and J. Schiller. “First Insights from a Mobile Honeypot”. In ACM SIGCOMM conference on Applications, technologies, architectures, and protocols for computer communication, pages 305–306. ACM, 2012. [5] S. Antonatos, E. P. Markatos, and K. G. Anagnostakis. “Honey @ home : A New Approach to Large-Scale Threat Monitoring”. In ACM workshop on Recurring malcode, pages 38–45. ACM, 2007. HosTaGe - a Low-Interaction Honeypot for Mobile Devices