1. What if you hit back? Counter-intelligence and Counter-attack
Honeynet Project -
What if you hit back? Counter-intelligence and Counter-attack
Dave Dittrich University of Washington cac.washington.edu>
11/14/2018

2. Honeynet Project - project@honeynet.org
Overview
Honeynet Project -
Levels of Active Defense
Use of “Intelligence”
Case Studies Included as Examples
Conclusion
Discussion
11/14/2018

3. Levels of active defense
Honeynet Project -
Intelligence gathering locally
Intelligence gathering remotely
Actively tracing the attacker
Actively retaliating against the attacker
11/14/2018

4. Honeynet Project - project@honeynet.org
Intelligence (local)
Honeynet Project -
Host, IDS & Firewall Logs
Malware artifacts & Sniffer Logs
Network Traffic
Case study: “BlennY” (1999)
11/14/2018

5. Intelligence (remote)
Honeynet Project -
External services
Internal commands
Malware artifacts
Case study: Trin00 (1999)
11/14/2018

6. Honeynet Project - project@honeynet.org
Active traceback
Honeynet Project -
Requires intelligence (local, remote)
Requires active cooperation of remote site
Requires careful correlation of logs
Case study: mountd attacks (1998)
11/14/2018

7. Honeynet Project - project@honeynet.org
Active retaliation
Honeynet Project -
Requires multiple levels of local/remote intelligence
More remote, less trustworthy/accessible
Attribution?
Liability
Case study: (not here!)
11/14/2018

8. Conclusion Locally, you have control Remotely, you don’t
Attribution is hard
Think very carefully
11/14/2018

9. Honeynet Project - project@honeynet.org
Questions?
Website:
11/14/2018