Slashdot Mirror
Using Honeypots to Fight Worms
scubacuda writes "Laurent Oudout, an active member of the French Honeynet Project (part of the Honeynet Alliance), has written a paper evaluating the usefulness of using honeypots in fighting Internet worms. (Imagine a well-constructed honeypot framework capturing a worm, redirecting worm traffic to fake services, and launching counter attacks to clean infected hosts!)"
Sounds like a lawsuit waiting to happen, unfortunately.
To ensure perfect aim, shoot first and call whatever you hit the target
We are all well aware of Welchia and the fact that it caused nearly as much nuisance as Blaster. Let us learn from this and never again release a worm for good purposes.
And here I thought they only caught bears named Poo.
Launching counter attacks to clean infected hosts? I see how this could be useful for internal networks where you actually have permission to clean machines, but it had better be restricted to that network, otherwise this could cause some major legal problems...
What about a P2P honeypot network? I'd think that would greatly increase the overall effectiveness.
Imagine a well-constructed honeypot framework capturing a worm, redirecting worm traffic to fake services, and launching counter attacks to clean infected hosts
Yeah, the honeypot could proactively install patches to systems that it deemed infected, all around the world!
Sounds like Skynet. Run for the hills!
Wer mit Ungeheuern kämpft, mag zusehn, dass er nicht dabei zum Ungeheuer wird. --Nietzsche
Personally I don't like the "launching counter-attacks to clean infected hosts". It reminds me of what AOL did.
:-/
;)
Still what can one do against users who do not care if they have a worm or not? Should we invet a driving-license thing for the internet, with fines for disregarding the rules? But then we would have the "internet must stay free"-activists on it again
Personally I'd vote for some sort of internet driving license, without having thought much about it. But it feels like the right thing.
Oh well, babbled enough, back to work
I don't think worm writers are going to care very much. If they're spammers, then some more of their spam will go in the bin - but it's not costing them, so who cares?
On top of this you are definitely on crack if you think that "launching counter attacks to clean infected hosts!" is a) a good idea or b) legal.
When using your honeypot at the campgrounds, always practice safety.
Surround your honeypot with rocks to keep the fire from spreading. Be sure when
you're done with your honeypot to put it out with a bucket of water and make
sure it has stopped smoking before you leave the area.
Remember what Smokey the Bear says. Only you can prevent your honeypot from starting a forest fire.
...launching counter attacks to clean infected hosts!
They're just that, 'attacks.' Unauthorized access to users' machines with the intent of installing software without the users' knowledge (even with, it makes no difference.)
It's a nice idea in spirit, the Community (I hate that term) working to automatically protect those who can't help themselves (sounds rather elitist, doesn't it). But in the end, it's no better than your average hacker / skript kiddie futzing around with your machines.
Welchia proved that good intentions can be disasterous. Even well-intentioned actions could damage someone's livelihood or equipment and open up the vigilante to criminal/civil penalties. A better approach would be a quick legal remedy that would permit one party to obtain a court order ordering the ISP of another party to cut off their internet access until they complied with the remedy (fixing the issue). The ISP is given 10 business days to notify the customer of the court order. An ISP could then try and verify the claim and file a response themselves if they find the claim unsubstantiated, or they could pass on the claim to the customer who would then would be responsible for replying. If the customer or ISP replied without properly addressing the claim or fixing the issue, they would be liable for criminal penalties and fines under the law. Wow, this whole idea ended up sounding kind of draconian which is not at all what I was going for. Any thoughts?
It is obvious that 'attacks' can ony be made inside a corporate network or similar, or else one would probably face lega consequences.
Apart from that, I think this is a great idea. You could use honeypots to automaticly update firewall filters and block further infection attempts!
Half the time we don't know our network is infected until it is too late, or someone complains the internet is slow.
Just having a honeypot that can alarm us to what boxes are infected is a big plus. We can take it from there.
Somehow taking the computer off the network would be a bonus as well. I wish our firewall had this functionality.
It is a nice attempt at active worm defense.
Unfortunately for him, I have just published a paper that shows that and how future worms will be much too fast for his - or anyone elses - manual defense methods.
In short, I've demonstrated that by the time he's starting to analyze the worm, it has already infected 90%+ of the vulnerable machines.
As soon as worm writers acquire some coding skills (most of the past worms were pathetic), all defenses that require manual actions will be too slow.
Sorry.
Assorted stuff I do sometimes: Lemuria.org
wait, here it is.
This honeypot can either be a "sacrificial lamb" (a normal host without the very latest updates applied on, sacrificed in expectation of an attack), or just a simulation of services.
If a host had the latest patches applied, wouldn't it be immune from attack? Didn't MS release the patch for the RPC exploit months before the virus came out? I think it would be better to have a small network of 6-8 computers (wouldn't have to be much, just get a rack off Ebay and a few of those mini-itx components, load em in, don't need a fan, case, etc) and have each computer at varying levels of patches. One computer is patched every day, one patched every two weeks, etc. There isn't enough time to customize a computer to be infected by the worm; by the time you hear about it, the worm has already infested millions of computers.
They also should look more into that counterstrike idea. Seriously, if you attack my computer, even if you didn't know about the virus, then I have the right to self defense. I'll gladly install some of that counterstrike software when I set up a honeypot. You're PO'ed because I attacked your computer? You attacked me first. I'm only exploiting the same vulnerability the worm did. If you were a SMART web citizen, you would have gotten a firewall to protect yourself from the worm in the first place.
I would think and hope that it is not. It is still an intrusive attack on another machine and an invasion of privacy.
Even if this eventually is used (and I hope to God it's not) there would have to be all kinds of of legislation defining "good" worm and "bad" worms.
Can you imagine the government sitting aournd trying to do this?
Also, who decides what is removed? What's to keep someone from saying, "downloading mp3s is illegal, we are going to write a "good" worm to remove mp3s without drm?" Sure that is a bit extreme but this would cause more problems then it's worth.
Not everything is analogous to cars. Car analogies rarely work.
The Internet in general is an attractive nuisance to script kiddies.
I work for a large UK ISP and we have had honeypots in use since the blaster outbreak - they work well.
If a user is infected and randomly attacks IPs within our network, they eventually hit one of the honeypots. The honeypots flag their account and when they next reconnected they are sent to a 'walled garden' - a dummy DNS RADIUS community where they can only get one webpage, that advises them that they have a virus and provides a download section for removal tools. When they have downloaded all necessary patches, they are automatically removed from the walled garden (using apache logs and RADIUS trace IPs to link the download with their account) and allowed back on the network.
There's no legal issues involved with us - we are a residential ISP and stuff like this is covered in T&Cs.
Overall a very good article. The article could have touch upon the ability for honeypot to help create IDS signature. At current technology level, IDS are mostly still signature based and early detection with honeypot to help with creating IDS signature is very important.
For active countermeasure (or attack), this has to be done VERY carefully. Remember Max Vision? It's good to fix your own machines, and make sure you only attack and fix yours. Access to unauthorized machines are almost always illegal. If one of your boxes got hacked, the incident response team should get involved and do their investigation, auto-patching without investigation can be a risky thing because you just don't know the extend of the problem. When you fix it, the hacker could have backdoor installed on your box.
I wrote about that too. Mine is implemented using a simple Servlet.
A programmer is a machine for converting coffee into code.
To be perfectly honest, there's no legislation to go after the "Joe Average Infected Computer User" for spreading the original worm. What makes you think they'd be all set to jump on (supposed) "White Hats" with systems that only respond to attacks in an effort to stem them (technically "illegal" or not)?
Before I had a webserver up-n-running doing useful stuff, I had Code Red Vigilante running on port 80; it felt good knowing that machines that had tried to infect me were being warned that they were infected... you know, trying to be a good netizen and enlighten my fellow surfer.
Of course, I was able to do that because I could look through the Java code I was installing and determine exactly what that code was doing (ie, not fall victim to a socially engineered attack where I mistakenly INSTALL someone's worm code on my computer!)
No... the real question won't be how this all gets sorted out legally; we'll figure out how to use technology to stop this crap before any law gets passed to "protect me."
The real question will be how do we protect the average person in the interim without making them easily exploitable targets for malicious anti-worm code that is, in essence, a socially-engineered worm attack in its own right.
Diplomacy is the art of saying, "Nice doggie!" until you can find a rock.
If you actively update the "defense boxes" with all the latest exploits and then configure it to use it's full arsenal to take down any attacking hosts (e.g. by making all exploits simply turn off networking on the target machine), then you'll have a very high success rate indeed. Then only worms exploiting previously unknown holes on otherwise fully patched machines will be able to run unchecked. This raises the bar for worm writers by an order of magnitude... or two.
Note that I'm suggesting that the "counter attack" would be simply disable networking on the infected host. This is easier to get right than any sort of complex cleanup, thus lowering the odds that you'll break the infected machine. Also, a machine which keeps dropping off the network will eventually get attended to by a technician, who will hopefully disinfect and patch it properly.
This would also have the beneficial side-effect that worm authors would be forced to close the holes they exploit in order for their worms to live. This would suddenly mean that worms and viruses would be competing against each other instead of coexisting peacefully.
Frankly I hope someone writes such a thing and a government body or group of white hats simply deploys it. Or both. Then the internet will finally have an immune system.
Host your own websites, anywhere!
We got caught out by Welchia by someone kindly connecting an infected laptop directly into the network behind the firewalling. Ironically this was possible due to a mistake in SMS package deployment (was done hastily - my fault).
My solution was to deploy honeypot windows machines running snort which reported into a central SQL server database.
Using Windows scripting host, I then wrote a script that ran periodically on a network management workstation which queried the database, creamed off the last machine that was an infector and using the wonderful free PS Tools from Sysinternals automatically determined what OS the machine was running (PSInfo), updated its antivirus signatures (PSExec), de-wormed the machine using the Symantec "FixWelch" utility (again using PSExec), decided if the machine was up to service pack spec (data from PSInfo) and if not service packed it (PSExec) then applyed the patches to prevent re-infection (PSExec).
All worked a treat.
I'm kind of glad we got hit because as a result I can now insist machines get patched (previously people would complain about a "box on the screen" (SMS installer)) while also being able to remove machine admin rights across the board and ban any machines that are not ours from being connected on pain of a disciplinary offence.
A lot of work but ultimately, I WIN. MOO HAR HAR!!
I have recently begun beta testing of an extended-functionalty version of my original Open Source application, LaBrea, mentioned in the article. The new software, known as LaBrea Sentry, uses the same methods of trapping and holding connection attempts by worms and scanners. It also proactively defends real machines from attack from those same worms and scanners as well as communicating all log information to a central server which provides updated "Bad Guy" lists to the entire network of Sentry boxes. Scanning IPs that make it onto the "Bad Guy" list are blocked from access to all monitored networks while they continue to scan. (And before you even ask, yes, there are many safeguards on the system to prevent spoofing...)
In initial tests, the system knocked down 94.7% of the scripted, scanning attacks against a live webserver, BEFORE those attacks ever made it to the server or IDS logs. That's what it's designed for: not to replace firewalls or IDS systems, but to simply cut down on all of the crap that they see...
Note: There seems to be a great deal of confusion about the "countermeasures" mentioned in the article. In the case of both LaBrea and LaBrea Sentry, these are "passive" countermeasures, consisting of trapping or tarpitting connection attempts. I agree that the idea of "actively" attempting to patch a machine is frought with legal issues.
More information on LaBrea Sentry can be found here.