Copyright 2010 Justin C. Klein Keane Using Kojoney Open Source Low Interaction Honeypot to Develop Defensive Strategies and Fingerprint Post-Compromise Behavior Justin C. Klein Keane Sr. InfoSec Specialist University of Pennsylvania, School of Arts and Sciences
Copyright 2010 Justin C. Klein Keane Background SSH Secure replacement for telnet RFC defined protocol (open) Available on most Linux/Unix machines Ongoing brute force attacks are seen on SSH servers Unfortunately we don't know what are attackers after Tempting logical fallacy to assume motivation Threat modeling and risk analysis depend on knowing motivation
Copyright 2010 Justin C. Klein Keane Honeypots What is a honeypot? Service deliberately configured to attract malicious attention Why would you use one? Tar pit, waste attacker time Early warning, warn of attacks Profiling, determine the types of attacks that are being utilized against your resources
Copyright 2010 Justin C. Klein Keane Types of Honeypots High interaction Full system installation Advantage is attacker has a full stack to interact with Disadvantage is attacker has more tools, could hide or break out of the honeypot Low interaction Software implementation that simulates a system Controlled environment, but is much easier for attackers to detect
Copyright 2010 Justin C. Klein Keane Danger! Downstream liability Attackers could user your honeypot as a launching pad to attack others Attackers could host malicious content on your server Attacker could use your honeypot as a dump site for illegal material Pivot point Attackers could end-run access control to internal resources using the honeypot
Copyright 2010 Justin C. Klein Keane Logistical Considerations Resource intensive Set up is time consuming, installation of OS and configuring software Analysis – it takes time to pore through logs and recreate attacker activity Redeployment can be a hassle, although virtual machine snap-shots make this much easier
Copyright 2010 Justin C. Klein Keane Kojoney Open source low interaction SSH honeypot Written in Python so it should work on any platfrom Has some flaws... Static timestamps, many commands unsupported, limited filesystem, etc.
Copyright 2010 Justin C. Klein Keane How Kojoney Works How it works Negotiates a full SSH session with attackers Takes attacker input, logs it, examines it and responds with simulated output Allows attackers to download toolkits with wget and curl, but stores the files outside the sandbox
Copyright 2010 Justin C. Klein Keane Customization Modified interaction to appear more dynamic Updated directories, using the defaults can be a dead giveaway Added directory functionality so attackers can navigate the structure, create and remove directories Added support for “requested” commands, if we saw attempts to use an unsupported command we built support in Added MySQL database support where all login data and commands are stored which makes reporting and analysis much easier
Copyright 2010 Justin C. Klein Keane Setup Kojoney running October 27, 2009, through May 3, Commodity desktop hardware, just an old Pentium powered machine with 512 MB RAM Dedicated IP Separate management interface
Copyright 2010 Justin C. Klein Keane Data Set Observed 109,121 login attempts 596 distinct IP addresses 70 IP's participated in multiple attacks Longest span between attacks was 135 days
Copyright 2010 Justin C. Klein Keane Attacks per Hour
Copyright 2010 Justin C. Klein Keane Attacks per Day
Copyright 2010 Justin C. Klein Keane Attacks per Month
Copyright 2010 Justin C. Klein Keane Top 16 Attacks by Country
Copyright 2010 Justin C. Klein Keane Top 20 Usernames
Copyright 2010 Justin C. Klein Keane Top 20 Passwords
Copyright 2010 Justin C. Klein Keane Most Popular Commands (3,062 issued, 181 distinct)
Copyright 2010 Justin C. Klein Keane Distinct Commands
Copyright 2010 Justin C. Klein Keane Commands by Session
Copyright 2010 Justin C. Klein Keane Wget Downloads 282 downloads captured Windows XP SP 3 downloaded 41 times Other popular downloads: PsyBNC Other IRC bots UDP Ping Flooders Port scanners SSH brute force tools
Copyright 2010 Justin C. Klein Keane Attack Command Analysis Context is key In 94/150 times 'cat' was used as: cat /proc/cpuinfo Some attacker commands innocuous, others not: w uptime wget unset
Copyright 2010 Justin C. Klein Keane Target Accounts System accounts favorite targets Dictionary lists were uncommon Passwords were relatively complex Dictionary attack was uncommon Username 'alice' with password 'password' would withstand attacks
Copyright 2010 Justin C. Klein Keane Defensive Strategies Use SSH keys Disable remote root login over SSH Run SSH on an alternate port Use login attempt limits to frustrate brute force
Copyright 2010 Justin C. Klein Keane Detection Mechanisms Blacklist using: OSSEC SSH Black
Copyright 2010 Justin C. Klein Keane Conclusions Blocking by source IP may be feasible Limit access by time of day Use IP to seed examination of other logs 'trojan' certain programs to log activity
Copyright 2010 Justin C. Klein Keane Known Hostile Traffic Look for internal source Use IP as seed for log analysis Fingerprint malware captures Look for traceable activity Creating directories with names like.tmp unset history