PyConZA 2015: "OpenCanary: a new Python-based honeypot" by Azhar Desai

Honeypots: a great idea tempered by over a decade of glorious misapplication resulting in a slow relegation to the realm of academia and slightly dubious research. But it doesn’t have to be that way. In August 2015 we released OpenCanary, the Open Source version of our commercial Python-based honeypot.

Traditional honeypots aim to reveal attacker tools, techniques and procedures, by entrapping attackers through emulation (or instrumentation) of common protocols and services. They are typically installed standalone, and seldom updated. We argue that this honeypot approach is outdated; current organisations struggle far more with identifying breaches than identifying the version of some generic rootkit installed post-breach.

OpenCanary changes that, treating the honeypot as an internal distributed sensor rather than a standalone alert generator. Each event reported is a high-quality indicator of investigation-worthy activity, and each OpenCanary instance feeds event data to a correlator which produces single alerts even in the face of network-wide scans. With such a high signal-to-noise ratio, every alert requires investigation. This is in contrast to the stream of alerts produced by tools such as anti-virus, network IDS or traditional honeypots.

OpenCanary wound up relying on Python for the majority of the code. The Python eco-system provided support that sped up development and, more importantly, deployment. However it didn’t take us the full distance.

In this talk, we provide a brief background on honeypots, discuss the design of OpenCanary, delve into the challenges experienced and our plans for the project. Along the way, we’ll demo the trivially installable OpenCanary, configure a few fake services and provide an outsider’s view of developing in Python.

Transcript

1. OpenCanary a new python-based honeypot azhar@thinkst.com | @azhrdesai
2. Introduction
3. The Plan
4. in the security community
5. struct.pack (wonderful stdlib functions) sqlmap (tool for exploiting sql injections) scapy (library for packet manipulation) plugin language for IDA & GDB (reverse engineering) Innuendo (framework for developing implants)
6. at Thinkst
7. The rise and fall of honeypots
8. “I was wondering how much effort this was worth….. It was fun to lead this guy on, but whats the goal?” “Though the Jail was an interesting and educational exercise, it was not worth the effort. It is too hard to get it right, and never quite secure.”
9. “Dedicated to learning the black-hat community’s tools, tactics, and motives and then sharing any lessons learned” https://www.honeynet.org/
10. http://seclists.org/honeypots/ 300 600 900 1200 2002 2003 2004 2005 2006 2007 2008 2009 2010 2011 2012 2013
11. Why did honeypots stumble?
12. Research pitched with wrong criteria Honeypots got a bad rep judged by the wrong criteria Back then we didn’t know/understand those hackers Other security tech sells better, especially “preventative” ones Defense too busy fighting fires
13. We still want to know when something bad happens on a network
15. Focus on the narrower use- case as a canary Image: Didier Descouens [CC BY-SA 4.0], via Wikimedia Commons
16. OpenCanary http://opencanary.org
17. OpenCanary daemons report to a single correlator Runs on Twisted pip installable Mostly pure python 15 services 3.5k loc
18. It’s not python all the way
20. Demo
21. Modules TCP FTP SSH Telnet SMB MSSQL UDP SIP SNMP TFTP NTP Portscanning MySQL RDP Git VNC HTTP HTTP Proxy
23. But … surely, we can fingerprint them? difficult to deploy (and update)? increased risk?
24. Will OpenCanary go the way of other honeypots?
25. honeyd http://www.honeyd.org/release.php Kippo https://github.com/desaster/kippo/commits/ Kojoney http://sourceforge.net/projects/kojoney/files/ conpot https://pypi.python.org/pypi/Conpot artemisa http://sourceforge.net/projects/artemisa/files/ delilah https://github.com/Novetta/delilah Elastichoney https://github.com/jordan-wright/elastichoney mhn https://github.com/threatstream/mhn/commits/ Glastopf https://github.com/mushorg/glastopf/commits/ Dionaea http://src.carnivore.it/dionaea Amun http://amunhoney.sourceforge.net Honeytrap http://src.carnivore.it/honeytrap/log/ Wordpot https://github.com/gbrindisi/wordpot/commits/ Shockpot https://github.com/threatstream/shockpot/ Artillery https://github.com/trustedsec/artillery/commits/ Decoy Server http://www.symantec.com/region/reg_eu/ Nepenthes http://src.carnivore.it/nepenthes/log/ Tom’s Honeypot http://labs.inguardians.com/tomshoneypot.html ..
26. https://canary.tools
27. Canary Migration Patterns
28. Canary Migration Patterns
29. A little python, and a little elbow grease and you really can push tech out there…
30. Day-to-day problem solving!
31. Faking MSSQL server login
32. https://msdn.microsoft.com/en-us/library/ee301956(v=sql.105).aspx Figure1: Communication flow in the TDS 4.2 protocol
33. “I’m a MSSQL client (and I support encryption)”
34. “I’m a MSSQL server (and I support encryption)”
35. “ƒJe#4Hêfa;3æIho”
36. “..I support encryption” “…”
38. Fooling Nmap
39. Nmap OS Detection sends 16 probe packets (TCP, UDP, ICMP) runs > 100 tests on the responses match test results with database of OS results
40. NFQueue iptables -A INPUT -j NFQUEUE --queue-num 0
43. DNS Tunneling
45. $ host thinkst.com thinkst.com has address 176.9.123.248
46. $ host my.first.message.canary.tools my.first.message.canary.tools has address 8.8.8.8
47. $ host -t txt hello.canary.tools hello.canary.tools descriptive text “Hi there”
48. aaa.bbb.ccc.111.222…canary.tools Message Label Domain
49. Problem Solution Cleartext messages Encryption (NaCl) Limitation on chars in labels Base 32 encoding (modified) DNS Caching Lower TTL & append random data Limit size of domain name Chunk message into packets Repeated queries Add packet IDs
50. If all that sounds fun come join in
51. Parting Thoughts If keen, jump in — opencanary is being used out there Our other canary-project is http://canarytokens.org Plenty of security problems are waiting for you to solve
52. Questions azhar@thinkst.com | research@thinkst.com
53. Postscript
54. This isn’t new http://cc.thinkst.com/searchMore/honeypot/
55. Canarytokens http://canarytokens.org Available under BSD license https://github.com/thinkst/canarytokens https://github.com/thinkst/ canarytokens-docker follow @thinkstcanary for new channels
56. Some (distant) History This isn’t new JP 3-13.4 bereford cliff stoll honeynet project http://jfsc.ndu.edu/Portals/72/Documents/JC2IOS/ Additional_Reading/1C3-JP_3-13-4_MILDEC.pdf
57. http://www.rumint.org/gregconti/publications/201501_ShmooCon_Deception_Final.pptx