1. An IoT Honeypot Device for Malware Forensics
Jingyu Tencent Anti-Virus Lab
Fan Tsinghua University

2. About Speakers Jingyu YANG Fan DANG Tencent Anti-Virus Lab
HaboMalHunter
Malware Analysis
IoT Security Research
Fan DANG
Tsinghua University
NFC & IoT Security Research

3. Outline Introduction Architecture Implementation Case Study Conclusion

4. Introduction High Interaction vs. Low Interaction
Traditional Honeypots vs. IoT Honeypots
Challenges in IoT environment

5. Interaction Why interaction matters?
Measures the capability of a honeypot
More interaction, more knowledge
More interaction, more risks

6. Interaction Low Interaction Honeypots High Interaction Honeypots
Limited interaction; normally work by emulating
Limited to capturing mainly known attacks
Easy to deploy
High Interaction Honeypots
Involve real operating systems
Attackers are given everything
Vulnerable

7. Shell / Video Streaming
Traditional vs IoT
Traditional
IoT
Architecture
x86 / x86-64
Heterogeneity
Service
Web / Shell
Shell / Video Streaming
Deployment
Cloud Computing
Physical (HIH)

8. Challenges Heterogeneity architectures Deployment
LIH: Lack of knowledge
HIH: Hard to emulate
Deployment
Expensive
Difficult

9. Architecture Access Layer Storage Layer View Layer Backend Execution
MongoDB
API Provider
Web Management System
Evidence Requests
Log Collector
Load Balancer

10. Load Balancer SSH Agent Port Proxy Telnet Agent Others
More Information
Accuracy
Malicious Actions
More Secure
Threats
Impact
Port Proxy
SSH Agent
Telnet Agent
Others

11. Technical Challenge How to Forward IP of Real Attackers
Hpfeeds Protocol Publish & Subscribe
TCP Connection Pair
How to Forward IP of Real Attackers

12. Yet Another SSH Honeypot
Design Principles
Hardware Based Design
Embedded Linux System
Monitoring Malicious Actions
Traditional Design (Cowrie)
Virtual Environment
Python Process
Command Emulation

13. Raspberry PI 3

14. Technical Challenges Re-Initialization Response to Hardware Failure

15. Relay

16. Case Study Pivoting Attack root:admin File less Network
ssh -D
./DoSAttack --sock5 localhost:18080 Target
Pivoting Attack
File less
Network
Dynamic port forwarding

17. Pivoting Attack

18. Why Hardware Solution Accurate Information Immune for Anti-Honeypot
CPUs Diversity

19. Hardware Based Solution
Conclusion
IoT Environment
HIH
Hardware Based Solution
SSH Honeypot

20. Acknowledgements Authors Tencent Tsinghua University
Jingyu YANG, Jie LI, Chen GENG, Zhao LIU, Guize LIU, Jinsong MA
Tsinghua University
Fan DANG, Yongfeng ZHANG, Prof. Zhenhua LI

21. References https://github.com/tencent/habomalhunter
paper-pa.pdf
networks-showcase-iot-honeypot-research-black-hat-2017/
direct-tcp-forward-attack.html

22. Thank you very much :)