HoneyPot Research Project: September 2007

9.27.2007

Goal I : To implement a Gen III HoneyNet

Learn Honeynet basics using the below articles (Target 09/30) -

Install, configure, deploy and maintain a Honeynet using the Roo CD using the online manual (Target 10/06) -

http://www.honeynet.org/tools/cdrom/roo/manual/index.html

9.26.2007

CSUS Project/Thesis Resources Link

http://www.csus.edu/gradstudies/forms.htm#Thesis

Arial 11pt Font Double line spacing - 26 lines per A4 sheet

9.25.2007

HoneyNet Roo CD

ISO Image located at -
http://www.honeynet.org/tools/cdrom/roo/iso/current/roo-1.2.hw-1.iso

How can I write (burn) ISO files to CD?
http://www.petri.co.il/how_to_write_iso_files_to_cd.htm

Free Tool 'ISO Recorder' for Windows XP SP2 -
http://isorecorder.alexfeinman.com/v2.htm

Steps to create a Honeynet Roo CD

Download and install ISO Recorder on the computer.
Download the HoneyNet ISO Image
Insert a blank CD into the CD-Writer
Right on the ISO Image and select 'Copy image to CD'

Project Goals

To implement a Linux Gen III HoneyNet setup using the Honeynet Roo CD in the CSUS RVR 2003 lab
To simulate an attack and demonstrate the basic capabilities of the Honeynet like -

Data Control

Firewall capabilities towards access control
Intrusion Prevention capabilities towards examining outgoing packets for malicious signatures
Connection rate limiting
Dropping packets with malicious signatures
Modifying malicious packets

Data Capture

Sources and times of attacks
Network packets
Attack signatures
App and system logs
Keystrokes

Data Analysis

Inbound and Outbound Connection patterns
Activity signatures
Network activity
Keystrokes

To enhance the capabilities of the setup using IDS

Using anomaly-based IDS to detect new attack signatures

To simulate an attack and demonstrate the enhancements that IDS brings to the setup

Detect new attack signature

To produce reports from analysis of the systems compromised during the attack

Sources and times of attacks
Network packets
Attack signatures
App and system logs
Keystrokes

Links

http://www.nku.edu/~waldenj1/talks/honeynets.html
http://www.honeynet.org/alliance/requirements.html
http://www.blackhat.com/presentations/bh-usa-05/bh-us-05-harper.pdf
http://seclists.org/focus-ids/2003/Mar/0038.html
http://www.securityfocus.com/infocus/1663

9.20.2007

Define project goals -
The goal is to design and implement HONEYNET in the CSUS RVR 2003 lab, to simulate an attack in the honeynet and be able to capture data (potentially an attack signature).
Outline of Methodology:
There are 4 phases in the design of Honeynet -
1) Data control is the containment of activity. There should be a balance between how much freedom an attacker can be given versus how much restriction provided to them.
2) Data capture collects the data about the user activities and motivation.
3) Data encryption & decryption - A large portion of attacker activity happens over encrypted channels such as IPSec, SSH, SSL, etc. Data Capture mechanisms must take encryption into consideration.
4) Data analysis - Read the collected data and analyze the data to know about the hacker’s actions.
Possible Extensions -
1) Automatic isolation of compromised systems https://www.auto.tuwien.ac.at/Workshops/dimva05/materials/riebach.pdf
2) Deceptive honeypots coupled with appropriate intrusion detection systems and firewalls may provide a means for providing much need forward intelligence about attackers and give defenders an increased reaction and countermeasure time window. http://www.infosecwriters.com/text_resources/pdf/Gupta_Honeynets.pdf
Honeynet Basics -
1) A honeypot is a security resource who's value lies in being probed, attacked, or compromised. Unlike firewalls or IDS sensors, honeypots are something you want the bad guys to interact with.
2) A honeypot is a security resource who's value lies in being probed, attacked, or compromised. Unlike firewalls or IDS sensors, honeypots are something you want the bad guys to interact with.
3) Low-Interaction honeypots
emulates operating systems and services.
Easy to install and deploy.
Usually requires simply installing and configuring software on a computer.
Minimal risk, as the emulated services control what attackers can and cannot do.
Captures limited amounts of information, mainly transactional data and some limited interaction.
4) High-Interaction Honeypots
No emulation, real operating systems and services are provided.
Can capture far more information, including new tools, communications, or attacker keystrokes.
Can be complex to install or deploy (commercial versions tend to be much simpler).
Increased risk, as attackers are provided real operating systems to interact
5) One Example of Low-interaction honeypot is Honeyd.
One Example of High-interaction honeypot is Honeynets.
6) Honeynets are entire networks of systems designed to be compromised. Honeynets are the most complex of honeypot solutions and have the greatest risk. However, they can also capture the most information of any honeypot. Honeynets are entire networks or real systems designed to be compromised.
http://tracking-hackers.evilcoder.org/solutions/
7) Honeynets are not a product, they are not a software solution that you install on a computer. Instead, Honeyents are an architecture, an entire network of computers designed to attacked. The idea is to have an architecture that creates a highly controlled network, one where all activity is controlled and captured. Within this network we place our intended victims, real computers running real applications. The bad guys find, attack, and break into these systems on their own initiative. When they do, they do not realize they are within a Honeynet. All of their activity, from encrypted SSH sessions to emails and files uploads, are captured without them knowing it. This is done by inserting kernel modules on the victim systems that capture all of the attacker's actions. At the same time, the Honeynet controls the attacker's activity. Honeynets do this using a Honeywall gateway. This gateway allows inbound traffic to the victim systems, but controls the outbound traffic using intrusion prevention technologies. This gives the attacker the flexibility to interact with the victim systems, but prevents the attacker from harming other non-Honeynet computers.
http://tracking-hackers.evilcoder.org/papers/honeypots.html
Advantages of Honeypots -
Small data sets:
Honeypots collect small amount of data, but almost all of this data is real attacks or unauthorized activity. Instead of dealing with 5,000 alerts and 10GB of logs every day, you may only get 30 alerts with your honeypots and 1MB of logs every day. Since honeypots collect only malicious activity, it makes it much easier to analyze and react to the information they collect.
Reduced false positives:
With most detection technologies (such as IDS sensors) a large percentage of your alerts are false warnings, making it very difficult to figure out what is a real attack. With honepyots, almost everything you detect or capture is an attack or unauthorized activity, vastly reducing false positives.
False negatives:
Unlike most technologies, its very easy for honeypots to detect and records attacks or behavior never seen before in the wild.
Cost effective: Honeypots only interact with malicious activity, you do not need high performance resources. Most honeypots can easily run on an old Pentium computer with 128 MB of Ram.
Simplicity:
Honeypots are very simple, there are no advance algorithims to develop, nor any rulebases to maintain.
http://tracking-hackers.evilcoder.org/misc/faq.html#faq1
Disadvantages of Honeypots -
Limited View:
Honeypots only see activity that interacts with them. They do not see nor capture any attacks directed against existing systems.
Risk:
Anytime you add another resource with an IP stack, you introduce risk. While different honeypots have different levels of risk, this is always an issues you must address.
http://tracking-hackers.evilcoder.org/misc/faq.html#faq1

9.13.2007

Project Report Outline

Table of Contents

Introduction
Honeypots, Honeynets and Honeywalls
Advantages of Honeypots
Disadvantages of Honeypots
IDS
Advantages of IDS
Disadvantages of IDS
How can IDS help Honeypots?
The Suggested Architecture
Possible extensions to this Architecture
Conclusions
Appendices

9.12.2007

Project Plan and Schedule

Project Title :

Combining IDS and Honeynet Methods for Improved Detection and Analysis of Compromised Systems

This project involves the following steps -

Scoping

Define project (Completed)
Define project goals (Estimated 9/17)
Identify possible extensions (Estimated 9/17)
Identify estimated completion dates for all activities (Completed)
Estimate final completion date (Completed)

Department Deadline 11/26
University Deadline 01/12
Review Deadline 10/26
Project Completion Date 11/01

Research

Honeynet basics (Estimated 9/19)
Disadvantages of Honeypots/Honeynets (Estimated 9/19)
Fundamentals of IDS (Estimated (9/21)
How IDS can enhance Honeynet architecture (Estimated 9/21)
Identify Software tools required (Estimated 9/18)

Planning

Define deployment model (Estimated 9/21)
Hardware/Software planning (Estimated 9/19)
Procure Software tools necessary (Estimated 9/21)

Implementation

Learn Software tools (Estimated 9/28)
Deploy tools (Estimated 9/28)
Implement Project (Estimated 10/20)

Documentation

Identify Table of contents (Estimated 9/21)
Identify Sections (Estimated 9/21)
Create Project Report (Estimated 10/19)
Create diagrams and flowcharts (Estimated 10/19)

HW/SW Requirements

For this project, total of 5 systems will be required -
2 systems - Honeypots
1 system - Honeywall Gateway (Data Control and Capture)
2 systems - Production systems

Hardware Requirements for Honeywall Gateway System -

1) CPU: Intel x_86 Pentium class CPU (or better) - Also earlier CPUs (such
as Pentium, Pentium Pro, Pentium II, Pentium III, and including AMD and
VIA variants)
2) MEMORY: 1GB (recommended)
3) HARDDISK: 10GB hard drive
4) NETWORK INTERFACE CARDS: 3 cards required

Software\OS Requirements -

1) Fedora core 6
2) Windows XP (any service pack)
3) Red Hat Linux