Slashdot Mirror
Using Honeypots to Fight Worms
scubacuda writes "Laurent Oudout, an active member of the French Honeynet Project (part of the Honeynet Alliance), has written a paper evaluating the usefulness of using honeypots in fighting Internet worms. (Imagine a well-constructed honeypot framework capturing a worm, redirecting worm traffic to fake services, and launching counter attacks to clean infected hosts!)"
Sounds like a lawsuit waiting to happen, unfortunately.
To ensure perfect aim, shoot first and call whatever you hit the target
We are all well aware of Welchia and the fact that it caused nearly as much nuisance as Blaster. Let us learn from this and never again release a worm for good purposes.
Will these counterattacks get better QA testing than MS patches?
and launching counter attacks to clean infected hosts Sounds illegal.... Unauthorized access to someone elses computer comes to mind. axehind
And here I thought they only caught bears named Poo.
Launching counter attacks to clean infected hosts? I see how this could be useful for internal networks where you actually have permission to clean machines, but it had better be restricted to that network, otherwise this could cause some major legal problems...
What about a P2P honeypot network? I'd think that would greatly increase the overall effectiveness.
And it won't EVER be subverted for nefarious purposes, will it?
Any technology distinguishable from magic is insufficiently advanced.
Imagine a well-constructed honeypot framework capturing a worm, redirecting worm traffic to fake services, and launching counter attacks to clean infected hosts
Yeah, the honeypot could proactively install patches to systems that it deemed infected, all around the world!
Sounds like Skynet. Run for the hills!
Wer mit Ungeheuern kämpft, mag zusehn, dass er nicht dabei zum Ungeheuer wird. --Nietzsche
Personally I don't like the "launching counter-attacks to clean infected hosts". It reminds me of what AOL did.
:-/
;)
Still what can one do against users who do not care if they have a worm or not? Should we invet a driving-license thing for the internet, with fines for disregarding the rules? But then we would have the "internet must stay free"-activists on it again
Personally I'd vote for some sort of internet driving license, without having thought much about it. But it feels like the right thing.
Oh well, babbled enough, back to work
There's nothing there about French Honeys.
I don't think worm writers are going to care very much. If they're spammers, then some more of their spam will go in the bin - but it's not costing them, so who cares?
On top of this you are definitely on crack if you think that "launching counter attacks to clean infected hosts!" is a) a good idea or b) legal.
When using your honeypot at the campgrounds, always practice safety.
Surround your honeypot with rocks to keep the fire from spreading. Be sure when
you're done with your honeypot to put it out with a bucket of water and make
sure it has stopped smoking before you leave the area.
Remember what Smokey the Bear says. Only you can prevent your honeypot from starting a forest fire.
...launching counter attacks to clean infected hosts!
They're just that, 'attacks.' Unauthorized access to users' machines with the intent of installing software without the users' knowledge (even with, it makes no difference.)
It's a nice idea in spirit, the Community (I hate that term) working to automatically protect those who can't help themselves (sounds rather elitist, doesn't it). But in the end, it's no better than your average hacker / skript kiddie futzing around with your machines.
Now one has to ask if it is legal to launch a counter worm?
Now as using a honeypot to analysis a worm, is that the whole purpose of a honeypot?
It is a nice attempt at active worm defense.
Unfortunately for him, I have just published a paper that shows that and how future worms will be much too fast for his - or anyone elses - manual defense methods.
In short, I've demonstrated that by the time he's starting to analyze the worm, it has already infected 90%+ of the vulnerable machines.
As soon as worm writers acquire some coding skills (most of the past worms were pathetic), all defenses that require manual actions will be too slow.
Sorry.
Assorted stuff I do sometimes: Lemuria.org
Welchia proved that good intentions can be disasterous. Even well-intentioned actions could damage someone's livelihood or equipment and open up the vigilante to criminal/civil penalties. A better approach would be a quick legal remedy that would permit one party to obtain a court order ordering the ISP of another party to cut off their internet access until they complied with the remedy (fixing the issue). The ISP is given 10 business days to notify the customer of the court order. An ISP could then try and verify the claim and file a response themselves if they find the claim unsubstantiated, or they could pass on the claim to the customer who would then would be responsible for replying. If the customer or ISP replied without properly addressing the claim or fixing the issue, they would be liable for criminal penalties and fines under the law. Wow, this whole idea ended up sounding kind of draconian which is not at all what I was going for. Any thoughts?
It is obvious that 'attacks' can ony be made inside a corporate network or similar, or else one would probably face lega consequences.
Apart from that, I think this is a great idea. You could use honeypots to automaticly update firewall filters and block further infection attempts!
Half the time we don't know our network is infected until it is too late, or someone complains the internet is slow.
Just having a honeypot that can alarm us to what boxes are infected is a big plus. We can take it from there.
Somehow taking the computer off the network would be a bonus as well. I wish our firewall had this functionality.
May be, but you are the anonymouse coward.
WTF am I doing replying to an AC at 5 A.M on a Friday night?
It is a nice attempt at active worm defense.
Unfortunately for him, I have just published a paper that shows that and how future worms will be much too fast for his - or anyone elses - manual defense methods.
In short, I've demonstrated that by the time he's starting to analyze the worm, it has already infected 90%+ of the vulnerable machines.
As soon as worm writers acquire some coding skills (most of the past worms were pathetic), all defenses that require manual actions will be too slow.
Sorry.
Assorted stuff I do sometimes: Lemuria.org
Yes. Just imagine.
wait, here it is.
The article even infers (to me anyway) that it should be used in a department or organisation and not on the net, and mentions the ethics of such a procedure.
This script, given strictly as an example, can be improved upon by using evolved programming languages such as VBS. A longer example [ref 13] has been tested on a research network, cleaning our infected hosts in a few minutes.
Some SysAdmins were recently polled to determine if it is ethical to take active defense measures in such a targeted, counter offensive way, within a network their organizations owns. The results can be seen here [ref 14, page 29 & 32] (76 respondents).
This honeypot can either be a "sacrificial lamb" (a normal host without the very latest updates applied on, sacrificed in expectation of an attack), or just a simulation of services.
If a host had the latest patches applied, wouldn't it be immune from attack? Didn't MS release the patch for the RPC exploit months before the virus came out? I think it would be better to have a small network of 6-8 computers (wouldn't have to be much, just get a rack off Ebay and a few of those mini-itx components, load em in, don't need a fan, case, etc) and have each computer at varying levels of patches. One computer is patched every day, one patched every two weeks, etc. There isn't enough time to customize a computer to be infected by the worm; by the time you hear about it, the worm has already infested millions of computers.
They also should look more into that counterstrike idea. Seriously, if you attack my computer, even if you didn't know about the virus, then I have the right to self defense. I'll gladly install some of that counterstrike software when I set up a honeypot. You're PO'ed because I attacked your computer? You attacked me first. I'm only exploiting the same vulnerability the worm did. If you were a SMART web citizen, you would have gotten a firewall to protect yourself from the worm in the first place.
Winnie the Pooh, Winnie the Pooh,
Chubby little buddy, all stuffed with fluff
it's Winnie the Pooh, Winnie the Pooh
little bitty silly ole' bear!
CMDRTACO CHECK YOUR EMAIL!
Personnally, if someone is too dumb to patch his/her computer, enabling a worm to spread, wasting bandwidth, possibly provoking network slowdowns, I really see no problem "fixing" his/her computer or getting it offline using the same vulnerability as the worm.
...use IIS so webservers quickly surrender to worms.
The Internet in general is an attractive nuisance to script kiddies.
Because, think about it. All those computers that have been infected will still be scanning for computers to infect, even if the internet is saturated with virii. So when the worm attacks a honeypot, the honeypot can then erase the worm. As long as the honeypots clean faster than the worm spreads (which would take a very big honeypot network indeed) then the worm infestation will slowly go down.
I think that the worms and viruses should be disected and once the origin is known, launch an all assault on the author. DDoS the SOB into oblivion.
Or, for virus writers, how about giving them a good dose of SARS or AIDS?? That'll teach them to play games..
All virus writers have to do is 'secure' the system they just compromized. This could be as easy as shutting down a service.
autopr0n is like, down and stuff.
"Using Linux to Fight Worms"
Sounds easier to me.
Install COX in your backend today!
I work for a large UK ISP and we have had honeypots in use since the blaster outbreak - they work well.
If a user is infected and randomly attacks IPs within our network, they eventually hit one of the honeypots. The honeypots flag their account and when they next reconnected they are sent to a 'walled garden' - a dummy DNS RADIUS community where they can only get one webpage, that advises them that they have a virus and provides a download section for removal tools. When they have downloaded all necessary patches, they are automatically removed from the walled garden (using apache logs and RADIUS trace IPs to link the download with their account) and allowed back on the network.
There's no legal issues involved with us - we are a residential ISP and stuff like this is covered in T&Cs.
Overall a very good article. The article could have touch upon the ability for honeypot to help create IDS signature. At current technology level, IDS are mostly still signature based and early detection with honeypot to help with creating IDS signature is very important.
For active countermeasure (or attack), this has to be done VERY carefully. Remember Max Vision? It's good to fix your own machines, and make sure you only attack and fix yours. Access to unauthorized machines are almost always illegal. If one of your boxes got hacked, the incident response team should get involved and do their investigation, auto-patching without investigation can be a risky thing because you just don't know the extend of the problem. When you fix it, the hacker could have backdoor installed on your box.
...a beowulf cluster of these!
They have told me over and over again that 95% of the computers out there are MS. So most of the problems are coming from computers with there operating system. So maybe they should help pay for some of these solutions.
Oh yeah, its because they want us to pay them for the solution.
What a ridiculous waste of time and money. Honeypots and viruses and worms and trojans. WTF. Computers are just friggin computational tools. And whiny little bedwetter nerds want to wage inane little wars against each other with them.
How about we start making harsh examples out of the virus writers that do get caught? And I mean *harsh*. No this will not deter all from creating more of this crap, but it will deter many. And no it will not stop it coming from backwords countries with slack laws, but at least its a start.
How about we start taking this shit seriously like we would if someone was attacking any other piece of our telecommunications infrastructure?
Let's quit fooling around trying to play cat and mouse footsie with these scumbags by using our friggin "honeypots".
...because as we all know, shit attracts flies or lawyers.
I wrote about that too. Mine is implemented using a simple Servlet.
A programmer is a machine for converting coffee into code.
Hey can you make Honey pots for SCO stuff??
Imagine a well-constructed honeypot framework capturing a worm, redirecting worm traffic to fake services, and launching counter attacks to clean infected hosts!
Imagine discussing this in 1988 when the first internet worm was released! There is nothing new in that paper.
To be perfectly honest, there's no legislation to go after the "Joe Average Infected Computer User" for spreading the original worm. What makes you think they'd be all set to jump on (supposed) "White Hats" with systems that only respond to attacks in an effort to stem them (technically "illegal" or not)?
Before I had a webserver up-n-running doing useful stuff, I had Code Red Vigilante running on port 80; it felt good knowing that machines that had tried to infect me were being warned that they were infected... you know, trying to be a good netizen and enlighten my fellow surfer.
Of course, I was able to do that because I could look through the Java code I was installing and determine exactly what that code was doing (ie, not fall victim to a socially engineered attack where I mistakenly INSTALL someone's worm code on my computer!)
No... the real question won't be how this all gets sorted out legally; we'll figure out how to use technology to stop this crap before any law gets passed to "protect me."
The real question will be how do we protect the average person in the interim without making them easily exploitable targets for malicious anti-worm code that is, in essence, a socially-engineered worm attack in its own right.
Diplomacy is the art of saying, "Nice doggie!" until you can find a rock.
If you actively update the "defense boxes" with all the latest exploits and then configure it to use it's full arsenal to take down any attacking hosts (e.g. by making all exploits simply turn off networking on the target machine), then you'll have a very high success rate indeed. Then only worms exploiting previously unknown holes on otherwise fully patched machines will be able to run unchecked. This raises the bar for worm writers by an order of magnitude... or two.
Note that I'm suggesting that the "counter attack" would be simply disable networking on the infected host. This is easier to get right than any sort of complex cleanup, thus lowering the odds that you'll break the infected machine. Also, a machine which keeps dropping off the network will eventually get attended to by a technician, who will hopefully disinfect and patch it properly.
This would also have the beneficial side-effect that worm authors would be forced to close the holes they exploit in order for their worms to live. This would suddenly mean that worms and viruses would be competing against each other instead of coexisting peacefully.
Frankly I hope someone writes such a thing and a government body or group of white hats simply deploys it. Or both. Then the internet will finally have an immune system.
Host your own websites, anywhere!
But the problem of scanning the IPv6 space is non-trivial. Not only is it easier to hide somewhere inside this much larger space, but serious folks, why don't we start from the beginning having routers to identify obvious scanning attempts (i.e. requests to a whole lot of different IP addresses over a short period of time) and work to locate and isolate those machines while raising an alarm? There's more that could be done to halt obvious misuse of the Internet than is being done now.
"It's the height of ridiculousness to say for those 9 lines you get hundreds of millions."
You only need one honeypot in your theory. You don't have to clean faster than it spreads. Once it's saturated, it can't spread.
(Imagine a well-constructed honeypot framework capturing a worm, redirecting worm traffic to fake services, and launching counter attacks to clean infected hosts!)
As a matter of a fact it sounds an awful lot like the anti-blast worm some jackass wrote. That bit of well meaning cyber-carpentry got on my network despite being prepared for blast and it did very similar damage. The honey pot project should look for useful things to the community not to an individual.
We got caught out by Welchia by someone kindly connecting an infected laptop directly into the network behind the firewalling. Ironically this was possible due to a mistake in SMS package deployment (was done hastily - my fault).
My solution was to deploy honeypot windows machines running snort which reported into a central SQL server database.
Using Windows scripting host, I then wrote a script that ran periodically on a network management workstation which queried the database, creamed off the last machine that was an infector and using the wonderful free PS Tools from Sysinternals automatically determined what OS the machine was running (PSInfo), updated its antivirus signatures (PSExec), de-wormed the machine using the Symantec "FixWelch" utility (again using PSExec), decided if the machine was up to service pack spec (data from PSInfo) and if not service packed it (PSExec) then applyed the patches to prevent re-infection (PSExec).
All worked a treat.
I'm kind of glad we got hit because as a result I can now insist machines get patched (previously people would complain about a "box on the screen" (SMS installer)) while also being able to remove machine admin rights across the board and ban any machines that are not ours from being connected on pain of a disciplinary offence.
A lot of work but ultimately, I WIN. MOO HAR HAR!!
Throught Asia, honeypots are used to store 'nightsoil.
I throught you make a good point.
Apperently HoneyD has been doing this for a while, looks like the pretty much copyed HoneyD's work. http://www.citi.umich.edu/u/provos/honeyd/msblast. html
+-+-+-The folowing statement is true. The previous statement is false.-+-+-+
I would think that Honeybuckets and Johnny-on-the-Spots attract a lot of worms...don't worms thrive in human waste?
:-)
Ohhh...Honeypots! Sorry...wrong item
Read whatever you're quoting twice before commenting on it. It's easy to overlook things on the first pass.
As for the counterstrike idea, it isn't a bad thing in and of itself. The problem is that it would set a precedent for retaliation, something a few media associations would certainly like to see allowed.
Such measures could be restricted to internet access providers concerning their own networks. But I have a feeling there's probably a loophole in there to be abused by doing that.
http://hackbusters.net
Has there ever been a better way to fight them?
There's nothing wrong with trying to clean up your own network. These boxes would be a great idea on a corporate network. When some new M$ transmitted disease comes springing out of LookOut of Internet Exploder, a central box could fix the problem.
For all that, I still think projects like this are a waste of time. Why should prople spend their time fixing Windoze? The best you can hope for is the RAV fate, a buyout. Microsoft more than likely, will give you the shaft some other way. Look how they treat the SAMBA people who have done fantastic work fixing M$ flaws and omisions. People who use Windoze should just be left to their fate. The Fanboys who still want to use Windoze are simply going to blame this service when things go wrong. Midrosoft is shit, all you get when you fool with it is dirty.
Friends don't help friends install M$ junk.
In the "theoretical limits" section, several times you have too much in the superscript in your calculations. (This looks like a pure TeX typesetting error, not an error in your calculations) Also, for the final result I believe you meant:
t = \log_{(r+1)} n_t - \log_{(r+1)} i
Not, as you have there,
t = log_{(r+1)} n_t
I have recently begun beta testing of an extended-functionalty version of my original Open Source application, LaBrea, mentioned in the article. The new software, known as LaBrea Sentry, uses the same methods of trapping and holding connection attempts by worms and scanners. It also proactively defends real machines from attack from those same worms and scanners as well as communicating all log information to a central server which provides updated "Bad Guy" lists to the entire network of Sentry boxes. Scanning IPs that make it onto the "Bad Guy" list are blocked from access to all monitored networks while they continue to scan. (And before you even ask, yes, there are many safeguards on the system to prevent spoofing...)
In initial tests, the system knocked down 94.7% of the scripted, scanning attacks against a live webserver, BEFORE those attacks ever made it to the server or IDS logs. That's what it's designed for: not to replace firewalls or IDS systems, but to simply cut down on all of the crap that they see...
Note: There seems to be a great deal of confusion about the "countermeasures" mentioned in the article. In the case of both LaBrea and LaBrea Sentry, these are "passive" countermeasures, consisting of trapping or tarpitting connection attempts. I agree that the idea of "actively" attempting to patch a machine is frought with legal issues.
More information on LaBrea Sentry can be found here.
Vigilante justice may be bad, but when there is no police force, it's all that stands between people and anarchy.
This may be a bad precedent (and illegal), but without any effective legal methods to stop the 'bad guys', it's essentially all we've got. This is a full assault - hackers, crackers, script-kiddies, scammers, spammers, etc. are not holding back, they're not stopping, and they've got little resistance. Legal methods (anti-viral programs, patches) aren't doing much to stop them - it's not a war, it's a slaughter. The vigilante white-hats aren't the best thing to have by any means, but I don't see much help in other corners. They may make things worse, but they may also be the big guns that can level the playing field (or win). Show me a an effective legal army, and I'll be against this, too. Until then, someone has to fight back, no?
GL
In section 5.1.1 you use your theoretical limit, but you forget that you started with 10 infected hosts. This leads to a theoretical best time-to-saturation of 29.499 seconds, not 36.506 seconds.
I will concede that this point isn't crucial, however. It still makes a worm that hits saturation in under a minute very close to ideal.
You see
Imagine a well-constructed honeypot framework...
and read it as
Imagine a Beowulf cluster...
... writers use the technology to counter-counter-attack with honeypott'ed 'virtual cells' constructed on infected hosts for double-service as a DDOS distraction ...
; -- the corruption of government starts with its secrets. a truly free people keep no secrets. --
The key difference here is that the honeypot is passive, it does not go out looking for vulnerable hosts, it waits until after the three-way TCP handshake on TCP/135 is complete, and only then does it react.
Spoofing complete TCP sessions is non-trivial, making false-positives (especially for a two-stage worm like Blaster and Nachia, using two different sessions to complete the infection) highly unlikely.
Secondly, while I agree that vigilante entrapment on the wild Internet is a dangerous direction, the basic concept is a sound approach to handling worm propagation within an ISP, corporate WAN, or other "private" (Internet-connected or otherwise) network where the honeypot operator has the legal and moral right to act.
I do not deploy Linux. Ever.
Thanks to this correction (also to the other, which yes is a typo and was pointed out to me already).
There has been much feedback from the community ever since I posted it, and I will update it soon (have a conference talk to do that takes priority right now).
Assorted stuff I do sometimes: Lemuria.org
Not if I have a destructive worm as outlined in chapter 8.1 of my paper. :)
Assorted stuff I do sometimes: Lemuria.org
needs to be notified in some way. As to legal or illegal, while I agree emotionally with you :) the 'proper' method would be contact the ISP and let them deal with the infected user/node. At some point though you are correct, the negligence has to transfer, even the dumbest driver is responsible for air in the tires and gas in the tank, and either they learn to deal with it or they hire a service to handle it for them. Maybe we need a driver's license for the Net ? as silly as it sounds it would ensure some basic level of knowledge and responsibility.
errr....umm...*whooosh* *whoosh* Is this thing on ?
At the beginning of the article, he discusses this as a perimeter defense. MSBlaster was only directly penetrating the perimeter of networks that had inbound TCP 135 open. Anybody who is going to take security seriously enough to set up honeypots as a defense against worms is going to close inbound TCP 135. Everybody I know that saw MSBlaster on their network (and I have a bunch of customers that got it) was infected in some other way, either by an infected laptop plugging in internally, or an infected host coming in via VPN. (BTW, I'd love to see a good solution for intrusion detection that works at the point of entry for VPN connections.)
But then he start talking about counterattacks as if this is something you are going to use to protect your uninfected hosts from your infected hosts internally. Even assuming you don't have a switched network, I still can't imagine the IDS that will analyze all internal network traffic and respond in a timely way, especially under the conditions of a worm attack, which typically involves flooding the network.
And all of that are really details. It all depends on being able to detect and respond to worm traffic faster than worm traffic can infect you. If anybody could find a way to do that, they'd integrate it into a firewall product and use it to just cut off this traffic, and everybody would run out and buy it. Rerouting the traffic instead of cutting it off would be just a curiosity that pretty much nobody would care about.