An Io T Honeypot Device for Malware Forensics

§ Jingyu YANG § Tencent Anti-Virus Lab § Habo. Mal. Hunter § Malware Analysis

§ Introduction § Architecture § Implementation § Case Study § Conclusion 2017. 12. 08

High Interaction vs. Low Interaction Traditional Honeypots vs. Io. T Honeypots Challenges in Io.

§ Why interaction matters? § Measures the capability of a honeypot § More interaction,

§ Low Interaction Honeypots § Limited interaction; normally work by emulating § Limited to

Traditional Io. T Architecture x 86 / x 86 -64 Heterogeneity Service Web /

§ Heterogeneity architectures § LIH: Lack of knowledge § HIH: Hard to emulate §

Access Layer Storage Layer View Layer Load Balancer Mongo. DB Backend Execution API Provider

Accuracy Malicious Actions More Secure Threats Impact Port Proxy More Information SSH Agent Telnet

Design Principles • Hardware Based Design • Embedded Linux System • Monitoring Malicious Actions

Re-Initialization Response to Hardware Failure 2017. 12. 08 14

§ Pivoting Attack § File less § Network § Dynamic port forwarding root: admin

Accurate Information Immune for Anti-Honeypot CPUs Diversity 2017. 12. 08 18

Io. T Environment HIH Hardware Based Solution SSH Honeypot 2017. 12. 08 19

§ Authors § Tencent § Jingyu YANG, Jie LI, Chen GENG, Zhao LIU, Guize

1. https: //github. com/tencent/habomalhunter 2. https: //github. com/threatstream/mhn 3. https: //github. com/threatstream/hpfeeds 4. https:

Slides: 22

Download presentation

An Io. T Honeypot Device for Malware Forensics Jingyu YANG@ Tencent Anti-Virus Lab Fan DANG@ Tsinghua University 1 2017. 12. 08

§ Jingyu YANG § Tencent Anti-Virus Lab § Habo. Mal. Hunter § Malware Analysis § Io. T Security Research § Fan DANG § Tsinghua University § NFC & Io. T Security Research 2017. 12. 08 2

§ Introduction § Architecture § Implementation § Case Study § Conclusion 2017. 12. 08 3

High Interaction vs. Low Interaction Traditional Honeypots vs. Io. T Honeypots Challenges in Io. T environment 2017. 12. 08 4

§ Why interaction matters? § Measures the capability of a honeypot § More interaction, more knowledge § More interaction, more risks 2017. 12. 08 5

§ Low Interaction Honeypots § Limited interaction; normally work by emulating § Limited to capturing mainly known attacks § Easy to deploy § High Interaction Honeypots § Involve real operating systems § Attackers are given everything § Vulnerable 2017. 12. 08 6

Traditional Io. T Architecture x 86 / x 86 -64 Heterogeneity Service Web / Shell / Video Streaming Deployment Cloud Computing Physical (HIH) 2017. 12. 08 7

§ Heterogeneity architectures § LIH: Lack of knowledge § HIH: Hard to emulate § Deployment § Expensive § Difficult 2017. 12. 08 8

Access Layer Storage Layer View Layer Load Balancer Mongo. DB Backend Execution API Provider Web Management System Log Collector Evidence Requests 2017. 12. 08 9

Accuracy Malicious Actions More Secure Threats Impact Port Proxy More Information SSH Agent Telnet Agent Others 2017. 12. 08 10

How to Forward IP of Real Attackers • Hpfeeds Protocol Publish & Subscribe • TCP Connection Pair 2017. 12. 08 11

Design Principles • Hardware Based Design • Embedded Linux System • Monitoring Malicious Actions Traditional Design (Cowrie) • Virtual Environment • Python Process • Command Emulation 2017. 12. 08 12

2017. 12. 08 13

Re-Initialization Response to Hardware Failure 2017. 12. 08 14

2017. 12. 08 15

§ Pivoting Attack § File less § Network § Dynamic port forwarding root: admin ssh -D 18080 user@Io. T . /Do. SAttack --sock 5 localhost: 18080 Target 2017. 12. 08 16

2017. 12. 08 17

Accurate Information Immune for Anti-Honeypot CPUs Diversity 2017. 12. 08 18

Io. T Environment HIH Hardware Based Solution SSH Honeypot 2017. 12. 08 19

§ Authors § Tencent § Jingyu YANG, Jie LI, Chen GENG, Zhao LIU, Guize LIU, Jinsong MA § Tsinghua University § Fan DANG, Yongfeng ZHANG, Prof. Zhenhua LI 2017. 12. 08 20

1. https: //github. com/tencent/habomalhunter 2. https: //github. com/threatstream/mhn 3. https: //github. com/threatstream/hpfeeds 4. https: //www. usenix. org/system/files/conference/woot 15 - paper-pa. pdf 5. https: //researchcenter. paloaltonetworks. com/2017/07/palo-alto- networks-showcase-iot-honeypot-research-black-hat-2017/ 6. http: //blog. malwaremustdie. org/2017/02/mmd-0062 -2017 -ssh-direct -tcp-forward-attack. html 2017. 12. 08 21

2017. 12. 08 22