Sweetening Your Threat Intelligence with Automated Honeypots Alexander

  • Slides: 28
Download presentation
Sweetening Your Threat Intelligence with Automated Honeypots Alexander Merck & Chris Collins

Sweetening Your Threat Intelligence with Automated Honeypots Alexander Merck & Chris Collins

Alexander Merck Chris Collins • Eight years experience working in Higher Ed. security •

Alexander Merck Chris Collins • Eight years experience working in Higher Ed. security • Focus on development and automation of security processes • 10 years Linux sysadmin experience • Container and Automation evangelist • Info. Sec Newbie

STINGAR

STINGAR

How do we do this?

How do we do this?

Honeypots

Honeypots

STINGAR? MHN? CHN? • STINGAR (Shared Threat Intelligence for Network Gatekeeping with Automated Response)

STINGAR? MHN? CHN? • STINGAR (Shared Threat Intelligence for Network Gatekeeping with Automated Response) – overarching threat intelligence sharing project • MHN (Modern Honey Network) – Honeypot management and deployment system developed by Threatstream • CHN (Community Honey Network) – Forked and divergent repositories from Threatstream’s MHN project

Honeypot Statistics • 25 honeypots deployed – 21 inside our network – 4 outside

Honeypot Statistics • 25 honeypots deployed – 21 inside our network – 4 outside our network • ~1750 events per hour • ~800 IP addresses blocked a day • Primary activity is SSH bruteforcing / abuse

Why not just run MHN? • Because containers and automation are fun! • Also…

Why not just run MHN? • Because containers and automation are fun! • Also… – MHN appears to no longer be actively supported by Threatstream – Designed as a monolithic architecture – Dead dependencies – Limited Python 3 support

Building a Honeypot DEBUG=false CHN_SERVER="http: //chnserver" FEEDS_SERVER="localhost" FEEDS_SERVER_PORT=10000 DEPLOY_KEY=<key> SSH_LISTEN_PORT=2222 TELNET_LISTEN_PORT=2223 version: '2' services:

Building a Honeypot DEBUG=false CHN_SERVER="http: //chnserver" FEEDS_SERVER="localhost" FEEDS_SERVER_PORT=10000 DEPLOY_KEY=<key> SSH_LISTEN_PORT=2222 TELNET_LISTEN_PORT=2223 version: '2' services: cowrie: build: context: https: //github. com/Community. Honey. Network/cowrie. git#v 1. 2 dockerfile: Dockerfile-centos image: cowrie: centos volumes: -. /cowrie. sysconfig: /etc/sysconfig/cowrie -. /cowrie: /etc/cowrie ports: - “ 2222: 2222”

Honeypots Ready to Deploy • Cowrie – SSH / Telnet honeypot – Logs brute

Honeypots Ready to Deploy • Cowrie – SSH / Telnet honeypot – Logs brute force attacks + shell sessions • Dionaea – Multi-service honeypot – Captures binaries, auto uploading to Virus. Total and Sandbox services – FTP, HTTP, My. SQL, MSSQL, SMB, SIP, TFTP, etc

Honeypots ready for alpha testers • • • Wordpot – Wordpress website honeypot Conpot

Honeypots ready for alpha testers • • • Wordpot – Wordpress website honeypot Conpot – SCADA device honeypot Glastopf – Generic web honeypot RDPHoney – Simple RDP honeypot Amun – Low-interaction multi-service honeypot

Integrating CHN with Other Applications

Integrating CHN with Other Applications

sysconfig HPFEEDS_HOST='hpfeeds' HPFEEDS_PORT=10000 MONGODB_HOST='mongodb' MONGODB_PORT=27017 CIF_HOST='http: //cifv 3: 5000' CIF_TOKEN='' CIF_PROVIDER='chn' docker-compose. yml version:

sysconfig HPFEEDS_HOST='hpfeeds' HPFEEDS_PORT=10000 MONGODB_HOST='mongodb' MONGODB_PORT=27017 CIF_HOST='http: //cifv 3: 5000' CIF_TOKEN='' CIF_PROVIDER='chn' docker-compose. yml version: '2' services: hpfeeds-cif: build: context: https: //github. com/Community. Honey. Network/hpfeeds -cif. git dockerfile: Dockerfile-centos image: hpfeeds-cif: centos volumes: -. /hpfeedscif. sysconfig: /etc/sysconfig/hpfeeds-cif: z

CIFv 3 in Docker • https: //github. com/Community. Honey. Network/stingar-cif version: '2' services: stingar-cif:

CIFv 3 in Docker • https: //github. com/Community. Honey. Network/stingar-cif version: '2' services: stingar-cif: build: dockerfile: . /Dockerfile-centos context: https: // github. com/Community. Honey. Network/stingar-cif image: stingar-cif: centos privileged: true links: - hpfeeds: hpfeeds ports: - localhost: 5000

Getting data out of CIFv 3 • CIFv 3 API – $ curl -v

Getting data out of CIFv 3 • CIFv 3 API – $ curl -v -H "Authorization: Token token=1234" -i https: //cifserver: 5000/indicators? indicators • CIFv 3 Python SDK – cif --token 1234 --remote 'https: //localhost' -q example. com

CHN data in CIFv 3 { "itype": "ipv 4", "indicator": "10. 182. 1. 56",

CHN data in CIFv 3 { "itype": "ipv 4", "indicator": "10. 182. 1. 56", "reporttime": "2018 -04 -05 T 17: 13: 09. 014466 Z", "provider": "chn", "tags": [ "honeypot" ], "portlist": "None", "confidence": 8. 0, "lasttime": "2018 -04 -05 T 17: 13: 09. 014431 Z", "count": 1, "tlp": "amber", "firsttime": "2018 -04 -05 T 17: 13: 09. 014431 Z", "additional_data": null }

Using Threat Intelligence from CHN • Splunk • Black Hole Routing • Host based

Using Threat Intelligence from CHN • Splunk • Black Hole Routing • Host based / network firewall rules

Future Plans

Future Plans

How You Can Help

How You Can Help

• Documentation: – Communityhoneynetwork. github. io • Repository: – https: //github. com/Community. Honey.

• Documentation: – Communityhoneynetwork. github. io • Repository: – https: //github. com/Community. Honey. Network • Contact: – stingar@duke. edu – Twitter: • @Chris. In. Durham • @merckedsec

QUESTIONS?

QUESTIONS?

CYBER THREAT INTELLIGENCE What is Threat Intelligence ThreatCYBER THREAT INTELLIGENCE What is Threat Intelligence Threat
Honeypots Building Honeypots Commercial honeypotsemulating services Specter HoneyedHoneypots Building Honeypots Commercial honeypotsemulating services Specter Honeyed
FIREWALL AND INTRUSION DETECTION SYSTEM Honeypots Honeypots HoneypotFIREWALL AND INTRUSION DETECTION SYSTEM Honeypots Honeypots Honeypot
Current threat levels Threat Level The threat levelCurrent threat levels Threat Level The threat level
TEAGUE TREATING PLANT Infeed and Amine Sweetening 11409TEAGUE TREATING PLANT Infeed and Amine Sweetening 11409
Section Two Unit 4 Sweetening Agents Fat andSection Two Unit 4 Sweetening Agents Fat and
Honeycomb Automated IDS Signature Generation using Honeypots ChristianHoneycomb Automated IDS Signature Generation using Honeypots Christian
Product Intelligence Competitor Intelligence Market Intelligence Customer IntelligenceProduct Intelligence Competitor Intelligence Market Intelligence Customer Intelligence
Shared Threat Intelligence for Network Gatekeeping with AutomatedShared Threat Intelligence for Network Gatekeeping with Automated
THE EIGHTEENTH CENTURY ALEXANDER POPE ALEXANDER POPE AlexanderTHE EIGHTEENTH CENTURY ALEXANDER POPE ALEXANDER POPE Alexander
ALEXANDER GRAHAM BELL Alexander Graham Bell History AlexanderALEXANDER GRAHAM BELL Alexander Graham Bell History Alexander
Total Threat Protection Securing All Your Threat VectorsTotal Threat Protection Securing All Your Threat Vectors
Indicators and Intelligence Incident Response Threat Intelligence InformationIndicators and Intelligence Incident Response Threat Intelligence Information
Threat Intelligence A quick glace at Intelligence LedThreat Intelligence A quick glace at Intelligence Led
Honeypots An Overview By Lance Spitzner Your SpeakerHoneypots An Overview By Lance Spitzner Your Speaker
THREAT ASSESSMENT THREAT MANAGEMENT Employee Assistance Professional AssociationTHREAT ASSESSMENT THREAT MANAGEMENT Employee Assistance Professional Association
Threat Assessment Stafford County Public Schools Threat AssessmentThreat Assessment Stafford County Public Schools Threat Assessment
UNCLASSIFIED Cyber Threat Overview Threat Reporting Donald ToddUNCLASSIFIED Cyber Threat Overview Threat Reporting Donald Todd
Safety Threat Assessment Threat Assessments Essentials of SchoolSafety Threat Assessment Threat Assessments Essentials of School
Cyberoam Unified Threat Management Identitybased Unified Threat ManagementCyberoam Unified Threat Management Identitybased Unified Threat Management
Threat Assessment Presented by the WCU Threat AssessmentThreat Assessment Presented by the WCU Threat Assessment
Notes on The Cyber Threat The threat getsNotes on The Cyber Threat The threat gets
Practical Threat Modeling with Microsofts Threat Modeling ToolPractical Threat Modeling with Microsofts Threat Modeling Tool
Threat Assessment and Threat Management in Schools KatieThreat Assessment and Threat Management in Schools Katie