Honeypot An instrument for attracting and detecting attackers Adapted from R. Baumann

Honeypot - R. Baumann – April 2002 Agenda Theory Implementation Administrations Toolkit Attacks Conclusion

Honeypot - R. Baumann – April 2002 Theory Honeypot Term originally from the military Fake target or ambush In this presentation, the term „honeypot“ is used in network security environment

Honeypot - R. Baumann – April 2002 Theory Definition A honeypot is a resource which pretends to be a real target. A honeypot is expected to be attacked or compromised. The main goals are the distraction of an attacker and the gain of information about an attacker, his methods and tools.

Honeypot - R. Baumann – April 2002 Theory Benefit Productive environment: distraction from the real targets Research environment: information gathering but: No direct protection gained In difference to IDS: no false alerts

Honeypot - R. Baumann – April 2002 Theory Types of implementation Level of Involvement –Low Involvement: Port Listeners –Mid Involvement: Fake Daemons –High Involvement: Real Services Risk increases with level of involvement

Honeypot - R. Baumann – April 2002 Theory Honeynet Network of honeypots Supplemented by firewalls and intrusion detection systems Advantages: “More realistic” environment Improved possibilities to collect data

Honeypot - R. Baumann – April 2002 Implementation Projekt Honeybread Honeynet implementation Administration Toolkit Ethernet Tunneling Software

Honeypot - R. Baumann – April 2002 Implementation Schematic illustration HoneypotsDetectionInternet

Honeypot - R. Baumann – April 2002 Implementation Topology

Honeypot - R. Baumann – April 2002 Implementation Honeypots Multiple honeypots Virtual machines Different, independent systems

Honeypot - R. Baumann – April 2002 Implementation Detection unit Information logging Connection control Administration

Honeypot - R. Baumann – April 2002 Administration Interface Features Web-based Event visualization Connections from and to the honeynet Intrusion detection system alerts Session logs Statistics and reports

Honeypot - R. Baumann – April 2002 Administration Interface Screenshot

Honeypot - R. Baumann – April 2002 Attacks Facts Huge amount of IDS alerts (>40‘000) Mostly automated attacks Code Red Virus In less than 24 hours successfully attacked Well known security vulnerabilities used

Honeypot - R. Baumann – April 2002 Attacks IDS alerts

Honeypot - R. Baumann – April 2002 Attacks Distribution over time

Honeypot - R. Baumann – April 2002 Attacks Origin

Honeypot - R. Baumann – April 2002 Attacks Summary Amount of attacks surprised Origin of attacks mostly from local systems –Attacks on own subnet –Most tools use own subnet as default setting Conclusion: Protection required and possible

Honeypot - R. Baumann – April 2002 Summary Technology Honeypot as a safety solution not very attractive –Very time expensive –No out-of-the-box solutions –Risk quite high when used inappropriately –Deep knowledge needed –Legal situation uncertain Honeypot as a service very attractive

Honeypot - R. Baumann – April 2002 Summary Implementation Data analysis very complex and time consuming Very good learning results Very interesting research area Exciting and suprising moments