Slashdot Mirror
OpenBSD 3.0 Honeypot Whitepaper
Tortured Potato writes "This white paper, by Michael Anuzis, details how he set up an OpenBSD 3.0 honeypot, watched it get cracked and then analyzed it -- all within 28 hours. Fascinating stuff...this is the first OpenBSD honeypot I've heard of."
Of just how much you need a firewall these days.
Especially if you run windows.
Michael
There is no cryptographic solution to the problem where the intended receiver and the attacker are the same entity.
Oooh, dems fightin' words! (runs into the General Store and closes the curtains, peeking out)
Vintage computer games and RPG books available. Email me if you're interested.
I think I'm not the only one who's reading this article and asking himself what a honeypot is. Could anyone please explain what it is? Thank you in advance.
http://www.google.ca/search?q=cache:b3jn4bU41cYC:w ww.omegapunx.org/+muffinface+band&hl=en&ie=UTF -8
This is not possible we all know that oBSD can't be hacked, only redhat Linux and Windows.
This white paper, by Michael Anuzis, details how he set up an OpenBSD 3.0 honeypot, watched it get cracked and then analyzed it -- all within 28 hours
You can do it with a default install in 30 minutes.
Windows doesn't come with shitty, insecure services like Apache2 and OpenSSH.
Surprised by Unicide! (fuck this shit)
Which is not very surprising for an OS that has had "One remote hole in the default install, in nearly 6 years!". An interesting read 'though.
By the way, there is a slashbox for OpenBSD Journal, which can be enabled here. It featured this story yesterday.
karma capped
If anyones interested, the website for the 'hacker' is omegapunx.org, his msn name is omegakidd@hotmail.com
E-Mail: omegakidd@tfz.net
E-Mail2: omegakidd@cheguevara.zzn.com
aim: eromlenosam
aim2: shoogy maple
aim3: satan the killer
msn: omegakidd@hotmail.com
yahoo: omegakidd
irc@efnet: omegakidd
Why the consistent use of "he/she"? I'm sorry but I've yet to see anyone of the female persuasion who is enough of a lowlife to become a script kiddie.
I took a honetpot to Prom, and it took me 28 hours to crack her and analyze it too....
Muffinface Google search
obligatory link to omegapunx's google-cached website is here
the best entry is certainly May 31st, when this gem appeared:
It seems to me that the Americans are actually the terrorists. I would elaborate right now but I am too lazy to type that much right now.
9:30PM: I had some fun with smoke bombs. I lit like 5 in my back yard and there was this pretty big smoke could going into my front yard. Sense it looked so cool I searched for some more smoke bombs, and all I could find was like 3. But then I lit them in the feild and that was cool. There was this cloud of blue smoke like 4 and a half feet from the ground. It was soo cool.
-- "Ignorance more frequently begets confidence than does knowledge." (Charles Darwin)
"its a reminder or just how much you need a firewall these days" and left it at that.
My brother's girlfriend Danyel gave me this purply long skirt thingy. It is soo cool. I would wear it to school tommorow, but there are these kids in the loccer room who hate gay people. They say things like "Man, if you are gay I am going to kick your ass." And stuff like that. So, they would probably think I am gay or something and kick my ass. Welp, what are you going to do in this world these days.
Well, there isn't really such a thing like a secure system.
So all this pro-OpenBSD propaganda by Theo de Rat saying "OpenBSD is secure, really, always" is rather a bad thing. I lulls sysadms into the belief that their system is save, making them unaware of the fact that a system is never secure at all.
Of course, the sources of every OS should be explicitly checked for security holes. But this shouldn't be the single feature of an OS. In fact claiming an OS "secure" just due to these checks is serving security rather badly.
I sometimes wonder if the OpenBSD project hasn't excatly the opposite effects than intended by it's maintainers for these very reasons. On the other hand there are some cynical commentators out there, who claim that the main intend of OpenBSD is to boost Theo's ego.
Owner of a Mensa membership card.
This makes me wonder what's the proportion of cracked to uncracked machines. I know I've had a box cracked from underneath me and I've found a set of other cracked boxes, but I wonder how many I've missed. Granted, I probably wouldn't have missed MuffinFace and his posse, but man.
I think it may be time to knuckle down and write a *good* set of iptable rules instead of the wacky mash I've got now.
Why is it that BSD users always feel the need to knock Linux? This article kicks off with "Most honeypots out there tend to be Redhat Linux as it's has the worst record for security out of pretty much every OS out there". RH is pretty damn secure compared with Windows, which seems to have a major security alert almost every day.
HH
After Theo lost his precious "no remote hole" boast he has started up another project named SecureBSD.
Do you have an I?. Then we can all be leet haxors and see if we can break into his box. My bet is that there is at least someone on slashdot that could break in(I am pretty darn sure there are quite a large number of highly skilled black hats that read slashdot.).
Registrant:
OmegaPunx
5233 Welcome Ave N.
Crystal, Minnesota 55429
US
Registrar: Dotster (http://www.dotster.com)
Domain Name: OMEGAPUNX.ORG
Created on: 03-MAY-02
Expires on: 03-MAY-03
Last Updated on: 03-MAY-02
Administrative, Technical Contact:
Elmore, Mason omegakidd@tfz.net
OmegaPunx
5233 Welcome Ave N.
Crystal, Minnesota 55429
US
(763)531-0637
I tried calling the number, but no one answered (at 9:30AM EST) let me know if
This article is valuable not so much for how to set up a honeypot (and no doubt this discussion will ventilate that issue) but, to a security newbie (me), it shows how the analysis of the logs proceeded.
Nice one. One question though - why not publish the IP of the hackers? Why protect their anonymity?
Backward%20compatibility%20is%20over-rated
"It is not the job of Linux advocates to promote BSD" when the topic was Open Source, what makes YOU think a BSD advocate should spend any time defending GNU/Linux?
You are seeing the reaping of what 'the leaders of Linux' sow.
Comment removed based on user account deletion
Whoah dude you missed out on something! She's Dark angel on TV. Here she is:
http://www.jessicaalba.net/wallpaper.html
I thought this had something to do with Winnie the Pooh using BSD. Oh well.
He's a Windows honeypot, in case anyone wants to practice (note: please be nice, you are beign watched :)
200.49.83.130
The term "whitepaper" refers to a technical specification and/or writing of a document. Yes, there are other types of papers.
Well for one thing the IP may be dynamic. Some other person may have been assigned that IP. Another thing is that they might have been working from a compromised system (though I doubt that in this case.)
In any case the anonymity of at least one of them was not really too well protected as several of the posts above indicate.
From the article:
Firstly, assuming they used a tool like "nmap" to do the portscan they would already know that some of the ports are forwarded - nmap states which ones are in the results of the scan (I believe it can tell by the differences in TCP sequence numbers.)
Secondly, why would this detract from the realism of the situation? Not everyone who wants to provide limited services on the internet buys additional IPs. I know I don't have the money to!
Julian
A quick serach for the band NAME "Muffinface"in the article and viola
:-)
Please be gentle
Friday May 10th, 2002
At this moment I am uploading all of my music to this comp so it can go on this web page. Tommorow the band that I am in, Muffinface, will be playing at my friends house. So that is cool. That is all for today. Oh yeah, and also for the music. If you want ftp access, when it is up. The username and password will be music. And the FTP is just omegapunx.org port 21.
Now, how secure is this network? You've got a firewall, so you're secure, right? Just two minor little flaws: the security holes mentioned in the article are in Apache and SSH. Your firewall didn't add any security at all! You're just as exposed as the next guy with no firewall.
Sticking a firewall in front of your network and thinking you're secure can be very dangerous, if it lulls you into thinking that the machines behind the firewall are now secure. Most exploitable holes are not on the thousands of unused ports that a firewall blocks - they're on the ports that the firewall lets through.
I should mention that with a stateful firewall, you can get greater security, since it monitors the actual content of the connection and may be able to detect hack attempts. However, stateful firewalls tend to be more expensive, less transparent (require more maintenance), and if they're commercial, more expensive. And many hacks can't even be detected by a stateful firewall, and there are all sorts of tunneling tricks that can be used to circumvent this kind of security. Ultimately, the only way to be secure is to make sure that every box that can be accessed from the outside is completely secure.
Along those lines, one of my favorite firewall-related quotes came from a sysadmin whose mail server and entire internal 70-station LAN had been infected by NIMDA: "But we have a firewall! How did it get through??"My brother's girlfriend Danyel gave me this purply long skirt thingy. It is soo cool. I would wear it to school tommorow, but there are these kids in the loccer room who hate gay people.
This guy has a lot going for him. He can crack any kid's computer that tried to beat him up.
For some interesting reading related to this article, take a look at the text files that come with the exploit that was used to crack this honeypot.
> Most honeypots out there tend to be Redhat Linux as it's has the worst record for security out of pretty much every OS out there, and so it makes for a good honeypot since the goal is to get hacked.
Obviously, he's never heard of Windows.
this is getting old and so are you
blog
I love you Hunnybunny!
Link to newsgroups provides clues of information sources used by this script kiddy. No direct references to this exploit though.
That has already been posted...
Wow... most of us feel good about getting a story we've written posted on Slashdot. You got a story written about you! Kudos man... now if only it wasn't a story about something you did that was incredibly stupid!
SIG: HUP
Ok, so we have info on "Hacker 1" but what about his litte friend "Hacker 2"? Who is he? Maybe omegakidd can help us out with that one...
Clothing doesn't make people gay. Try reading this book and see if you look at the world in the same way ever again.
~~~LXT~~~
Life is like a computer program: anything that can't happen, will.
I've got a dollar bill with www.omegapunx.org written on it. Do I win something?
First, my apologies to the Honeynet Project (http://project.honeynet.org), the Distibuted Honeypot Project (http://www.lucidic.net), and everyone else who does research in the field of honeynets for releasing a paper which revealed the identity of the hackers involves, as this clearly doesn't fall into the scope of releasing a good whitepaper on the topic. Second, my sincerest apologies to the two hackers who compromised my honeypot. I went through and tried to conceal the identity of the two hackers involved, but it's true I knew they could still be traced by searching google's cache for pretty much any sentence on the cached page I displayed. I had no intention of revealing their identities, and it's clear I thoroughly overestimated the level of maturity of my target audience. To be completely honest, I would rather have never had this article featured on deadly.org and /. if I had known ahead of time how badly the two hackers personal information would be exploited.
To those people who read this, please stop bugging the hackers involved. They appear to be nothing more than innocent (and slightly unwise) kids. Let's grow up for a minute here for their sake.
It can't be all bad, because after all they did hack a honeypot... so I guess there's a moral to be learned with this story, but please don't take their humiliation any farther than it's already gone.
I'm honored my whitepaper was featured on these great websites, and I hate to feel like I'm crashing the party... but I can't help but feel bad for the poor hackers involved.
With utmost sincerity, Michael Anuzis
Note that this user has only posted one message, and has no information linking them to the actual author of the article. The legitimacy of the message should be IN QUESTION.
(Off topic: How did this posting get +1 without any other comments to get karma from?)
TANSTAAFI: There Ain't No Such Thing As A Free iPod.
http://www.omegapunx.org/pics/me/Pict0003.JPG
The purpose of a honeypot is to get knowledge from the hacker. In this case, I think the sysadmin should pay the hacker for the knowledge gained.
As of the 13th of July, our script kid friend wants to hide his screenshots section for some reason.
Too bad Google has it cached.
War crimes, torture, lies, illegal spying... Would someone give Bush a blowjob, already, so he can be impeached?
Time for a reminder that BSD is dead:
BSD is dead and has been for a long time.
Join us again at 3:58 for another reminder. Coming up next: traffic and weather together.
For those interested the site the whitepaper was on has been temporarily disabled by the web hosting company due to too much traffic.
Another copy of the whitepaper is available at:
http://www.anuzisnetworking.com/whitepapers/
And to verify, yes it was in fact me who posted the above apology. --Michael Anuzis
Just an interesting note that the whitepaper in question has been removed from the web site. Started reading it yesterday and was unable to finish reading it. Slashdot effect? Anyone have it saved, could ya send it to me at robert.fleming@rogers.com
Time for another reminder that BSD is dead:
BSD has more holes than Swiss cheese! No wonder it can't be used in any type of business environment.
Coming up next, traffic and weather together.
I'm sorry I have to tell you this, but I think it's dead ma'am.
Time of death: 5 years ago.