1. Honeypot An instrument for attracting and detecting attackers Adapted from R. Baumann

2. Honeypot - R. Baumann – April 2002 Agenda Theory Implementation Administrations Toolkit Attacks Conclusion

3. Honeypot - R. Baumann – April 2002 Theory Honeypot Term originally from the military Fake target or ambush In this presentation, the term „honeypot“ is used in network security environment

4. Honeypot - R. Baumann – April 2002 Theory Definition A honeypot is a resource which pretends to be a real target. A honeypot is expected to be attacked or compromised. The main goals are the distraction of an attacker and the gain of information about an attacker, his methods and tools.

5. Honeypot - R. Baumann – April 2002 Theory Benefit Productive environment: distraction from the real targets Research environment: information gathering but: No direct protection gained In difference to IDS: no false alerts

6. Honeypot - R. Baumann – April 2002 Theory Types of implementation Level of Involvement –Low Involvement: Port Listeners –Mid Involvement: Fake Daemons –High Involvement: Real Services Risk increases with level of involvement

7. Honeypot - R. Baumann – April 2002 Theory Honeynet Network of honeypots Supplemented by firewalls and intrusion detection systems Advantages: “More realistic” environment Improved possibilities to collect data

8. Honeypot - R. Baumann – April 2002 Implementation Projekt Honeybread Honeynet implementation Administration Toolkit Ethernet Tunneling Software

9. Honeypot - R. Baumann – April 2002 Implementation Schematic illustration HoneypotsDetectionInternet

10. Honeypot - R. Baumann – April 2002 Implementation Topology

11. Honeypot - R. Baumann – April 2002 Implementation Honeypots Multiple honeypots Virtual machines Different, independent systems

12. Honeypot - R. Baumann – April 2002 Implementation Detection unit Information logging Connection control Administration

13. Honeypot - R. Baumann – April 2002 Administration Interface Features Web-based Event visualization Connections from and to the honeynet Intrusion detection system alerts Session logs Statistics and reports

14. Honeypot - R. Baumann – April 2002 Administration Interface Screenshot

15. Honeypot - R. Baumann – April 2002 Attacks Facts Huge amount of IDS alerts (>40‘000) Mostly automated attacks Code Red Virus In less than 24 hours successfully attacked Well known security vulnerabilities used

16. Honeypot - R. Baumann – April 2002 Attacks IDS alerts

17. Honeypot - R. Baumann – April 2002 Attacks Distribution over time

18. Honeypot - R. Baumann – April 2002 Attacks Origin

19. Honeypot - R. Baumann – April 2002 Attacks Summary Amount of attacks surprised Origin of attacks mostly from local systems –Attacks on own subnet –Most tools use own subnet as default setting Conclusion: Protection required and possible

20. Honeypot - R. Baumann – April 2002 Summary Technology Honeypot as a safety solution not very attractive –Very time expensive –No out-of-the-box solutions –Risk quite high when used inappropriately –Deep knowledge needed –Legal situation uncertain Honeypot as a service very attractive

21. Honeypot - R. Baumann – April 2002 Summary Implementation Data analysis very complex and time consuming Very good learning results Very interesting research area Exciting and suprising moments