1. 24 September 2003 1 An Introduction to Honeynets and Intrusion Protection Systems James Kearney Oct. 25, 2004

2. 24 September 2003 2 Outline What are honeypots/honeynets? Some basic implementation techniques What is an IPS/basic implementation General Comments Tie-in to research being done with Scott Miller

3. 24 September 2003 3 Honeypots ● A machine deployed intentionally to be broken in to. ● Deceptive by design ● Ideally provides information about penetration attempts against your network

4. 24 September 2003 4 Honeypots - Design Developed by what is now known as The Honeynet Project Standardized design, based upon Linux (flexible in terms of distribution) Based upon a particular combination of components: –Firewall –IDS –Extensive System Logging

5. 24 September 2003 5 Honeypots - Implications Two classes of Honeypots –Low-Interaction Simulated system, many commands/capabilities compared to a normal operating system are impared. –High-Interaction Full-blown system, running real servies –Relative risks?

6. 24 September 2003 6 Honeynets Expand the concept of a simple honeypot to a complete network of honeypots Currently in their second generation (the topic of this presentation) –First generation tools somewhat limited in potential

7. 24 September 2003 7 Honeynets - Design Three major principles: –Data Control Firewalls, IPS', bridging, session/rate limiting –Data Capture IDS', Sebek (or Termlog) –Data Analysis Honey Inspector, Sleuthkit, Sebek (web-interface), etc...

8. 24 September 2003 8 Honeynets – Implications First-gen honeynets and rate-limiting outgoing connections Limited Lifetime –How to restore Potential Dangers

9. 24 September 2003 9 Intrusion Protection Systems Affect in real-time the contents of a malicious payload Example implementation –IPTables + Snort Inline

10. 24 September 2003 10 Intrusion Protection Systems Use the QUEUE target in IPTables Snort Inline picks up the packets, using a modified ruleset (compared to common Snort implementations) Potentially makes changes to a given packet –Modify contents to render harmless –Drop packet entirely

11. 24 September 2003 11 General Comments Ease of deployment Necessary time/space complexity of honeynets Bob's Theorm

12. 24 September 2003 12 Work with Scott: Modified version of a honeynet More extensive (or completely new) uses of IPS' Employs many techniques based upon the research already done with honeynets

13. 24 September 2003 13 Questions?

14. 24 September 2003 14 References ● “Know Your Enemy”, Second Edition. The Honeynet Project. Addison-Wesley, 2004 ● www.honeynet.org www.honeynet.org ● Security-Focus' Honeypot Mailing List (honeypots@securityfocus.com)honeypots@securityfocus.com ● www.snort-inline.sf.net www.snort-inline.sf.net ● www.rootsecure.net (variety of articles used) www.rootsecure.net