1. Use of Honey-pots to Detect Exploited Systems Across Large Enterprise Networks Ashish Gupta Network Security May 2004 http://project.honeynet.org/misc/project.html

2. Overview Motivation What are Honeypots? –Gen I and Gen II The GeorgiaTech Honeynet System –Hardware/Software –IDS –Logging and review Some detected Exploitations –Worm exploits –Sage of the Warez Exploit Words of Wisdom Conclusions

3. Why Honeynets ? An additional layer of security

4. Motivation Security a serious problem Methods for detection/protection/defense: –Firewall: The Traffic cop –IDS: detection and alert These have shortcomings: –Internal threats –Virus laden programs –False Positives and False negatives Honeynet: An additional layer –Not a panacea

5. Security: A serious Problem Firewall IDS A Traffic Cop Problems: Internal Threats Virus Laden Programs Detection and Alert Problems: False Positives False Negatives

6. The Security Problem FirewallIDS HoneyNets An additional layer of security

7. Captures all inbound/outbound data Standard production systems Intended to be compromised Data Capture –Stealth capturing –Storage location – away from the honeynet Data control –Protect the network from honeynets

8. Two types Gen IGen II Good for simpler attacks Unsophisticated targets Limited Data Control Sophisticated Data Control : Stealth Fire-walling Gen I chosen

10. GATech Honeynet System Huge network 4 TB data processing/day CONFIG Sub-standard systems Open Source Software Simple Firewall Data Control

11. IDS Invisible SNORT Monitor Promiscuous mode Two SNORT Sessions Session 1 Signature AnalysisMonitoring Session 2 Packet CaptureDATA CAPTURE

13. Data Analysis One hour daily ! Requires human resources Forensic Analysis SNORTDATA CAPTURE All packet logs stored Ethereal used

14. Detected Exploitations 16 compromises detected Worm attacksHacker Attacks

15. Honey Net traffic is Suspicious Heuristic for worm detection: Frequent port scans Specific OS-vulnerability monitoring possible Captured traffic helps signature development DETECTING WORM EXPLOITS

16. SAGA of the WAREZ Hacker Helped locate a compromised host Honeynet IIS Exploit  Warez Server + Backdoor Very difficult to detect otherwise !

17. Words of Wisdom Start small Good relationships help Focus on Internal attacks Don’t advertise Be prepared to spend time

18. Conclusion Helped locate compromised systems Can boost IDS research –Data capture Distributed Honey nets ?

19. Discussion The usefulness of the extra layer ? Dynamic HoneyNets Comparison with IDS: are these a replacement or complementary ? HONEY NET IDS