Modeling Malware-driven Honeypots Gerardo Fernndez, Ana Nieto and - PowerPoint PPT Presentation

TRUSTBUS 2017 Modeling Malware-driven Honeypots Gerardo Fernández, Ana Nieto and Javier Lopez {gerardo,nieto,jlm}@lcc.uma.es Network, Information and Computer Security (NICS) Lab University of Malaga, Spain TrustBus 2017, August 30 th 2017

Content 1 1. Honeypots, objectives and limitations 2. Malware Intelligence 3. Hogney Architecture 4. Study Case: Mirai 5. Conclusions Lyon, August 30th, 2017 TRUSTBUS 2017

Honeypots 2 § Honeypots: what are they used for ? – All traffic received in them are considered suspicious. – Replicate live services of the production environment: showing a footprint similar to that of the services offered in the production network. – Research environments: showing a configuration of honeypots that enables attacks to be captured, to later analyse new techniques used. Lyon, August 30th, 2017 TRUSTBUS 2017

Honeypots 3 § Honeypots: what are they used for ? – All traffic received in them are considered suspicious. – Replicate live services of the production environment: showing a footprint similar to that of the services offered in the production network. – Research environments: showing a configuration of honeypots that enables attacks to be captured, to later analyse new techniques used. § Limitations : – General purpose: hard to unleashed all stages of malware behaviour – Specific to protocols/applications: + reduced visibility – Specialized in predetermined attacks: + reduced visibility – Adaptive honeypots: usually combine previous techniques inheriting these problems Lyon, August 30th, 2017 TRUSTBUS 2017

Honeypots 4 § Honeypots: what are they used for ? – All traffic received in them are considered suspicious. – Replicate live services of the production environment: showing a footprint similar to that of the services offered in the production network. – Research environments: showing a configuration of honeypots that enables attacks to be captured, to later analyse new techniques used. § Limitations : – General purpose: hard to unleashed all stages of malware behaviour – Specific to protocols/applications: + reduced visibility – Specialized in predetermined attacks: + reduced visibility – Adaptive honeypots: usually combine previous techniques inheriting these problems Lyon, August 30th, 2017 TRUSTBUS 2017

Honeypots 5 § Nowadays, there are myriad of honeypots available... Nepenthes HoneyBOT Cowrie Dionaea HoneyTrap Kippo Conpot LaBrea Lyon, August 30th, 2017 TRUSTBUS 2017

Honeypots 6 § Nowadays, there are myriad of honeypots available... Nepenthes HoneyBOT Cowrie Dionaea IoTPOT Glastopf H o elastichoney n e y S i n k HoneyTrap Kippo Conpot LaBrea Lyon, August 30th, 2017 TRUSTBUS 2017

Honeypots 7 § Nowadays, there are myriad of honeypots available... Nepenthes HoneyBOT Cowrie Dionaea IoTPOT Why not offer them... Glastopf H “à la carte” ? o elastichoney n e y S i n k HoneyTrap Kippo Conpot LaBrea Lyon, August 30th, 2017 TRUSTBUS 2017

Malware Intelligence 8 We use the term malware intelligence to refer to information § regarding the behaviour and propagation of malware. – Which OS is targeted ? – What components are attacked? – Who communicates with? – What activity is performed? – Who created and launched ? Lyon, August 30th, 2017 TRUSTBUS 2017

Malware Intelligence 9 We use the term malware intelligence to refer to information § regarding the behaviour and propagation of malware. – Which OS is targeted ? – What components are attacked? – Who communicates with? – What activity is performed? – Who created and launched ? Depending on the information requested, different types of malware § intelligence services can be used. We classify them in three levels : – L1 : information about IP and URLs – L2 : information about files: processor, O.S., applications affected, etc. – L3 : intelligence information sharing services (files, URLs, domains, C2 nodes, etc.) Lyon, August 30th, 2017 TRUSTBUS 2017

Malware Intelligence 10 L1 Lyon, August 30th, 2017 TRUSTBUS 2017

Malware Intelligence 13 < response > L3 < Event > < date >2016-12-07</ date > < info >Locky 2016-12-07 : "Card Receipt" - "CARD123 456789.docm"</ info > < published >1</ published > < Attribute > < type >ip-dst</ type > < category >Network activity</ category > < value >91.142.90.46</ value > < RelatedAttribute > < Attribute > < info >"Emailing: MX62EDO 08.12.2016" - "MX62EDO 08.12.2016.docm"</ info > < value >91.142.90.46</ value > </ Attribute > </ RelatedAttribute > </ Attribute > < Attribute > < type >url</ type > < category >Payload delivery</ category > < value >http://wahanaputrayudha.com/hfycn33</ value > </ Attribute > < Attribute > < type >md5</ type > < category >Payload delivery</ category > < value >b923db309a973d7229a1e77352e89486</ value > </ Attribute > < Tag >< name >misp-galaxy:ransomware=”Locky"</ name ></ Tag > </ Event > </ response > Lyon, August 30th, 2017 TRUSTBUS 2017

Hogney Architecture 16 Objective : to facilitate the analysis of the three stages of malware: § exploration, infection and execution of the payload. – Focusing on auto-propagated malware – Obtaining information before offering a honeypot – Integrating tools to capture evidence – Adapting services for unleashing all stages of malware Lyon, August 30th, 2017 TRUSTBUS 2017

Hogney Architecture 17 Objective : to facilitate the analysis of the three stages of malware: § exploration, infection and execution of the payload. – Focusing on auto-propagated malware – Obtaining information before offering a honeypot – Integrating tools to capture evidence – Adapting services for unleashing all stages of malware 3 main modules: § – Interception of connections – Configuration of trap services – Evidence monitoring Lyon, August 30th, 2017 TRUSTBUS 2017

Hogney Architecture 18 Objective : to facilitate the analysis of the three stages of malware: § exploration, infection and execution of the payload. – Focusing on auto-propagated malware – Obtaining information before offering a honeypot – Integrating tools to capture evidence – Adapting services for unleashing all stages of malware 3 main modules: § – Interception of connections – Configuration of trap services – Evidence monitoring Using… § – Low and medium interaction honeypot templates – Execution environments (real and virtual) for high interaction honeypots Lyon, August 30th, 2017 TRUSTBUS 2017

Hogney Architecture 19 Lyon, August 30th, 2017 TRUSTBUS 2017

Hogney Architecture 20 Lyon, August 30th, 2017 TRUSTBUS 2017

Modeling Malware-driven Honeypots Gerardo Fernndez, Ana Nieto and - PowerPoint PPT Presentation

TRUSTBUS 2017 Modeling Malware-driven Honeypots Gerardo Fernndez, Ana Nieto and Javier Lopez {gerardo,nieto,jlm}@lcc.uma.es Network, Information and Computer Security (NICS) Lab University of Malaga, Spain TrustBus 2017, August 30 th 2017

Intrusion Detection w ith Motivation Honeypots What is a honeypot? Types of honeypots

Data-driven COVID-19 modeling Data-driven COVID-19 modeling 1 Cyprien Neverov th August 28 ,

Nomadic Honeypots A Novel Concept for Smartphone Honeypots Steffen Liebergeld , Matthias Lange and

Hacking Attacks The power of IPv6 driven malware m-r Mane Piperevski IT Security Researcher

Intelligence Driven Malware Analysis (IDMA) Malicious Profiling 14 January 2015 Homeland

INTELLIGENT HONEYNET ACTIONABLE INFORMATION FROM HONEYPOTS INTELLIGENT HONEYNET ACTIONABLE

Honeypots Mathias Gibbens Harsha vardhan Rajendran April 22, 2012 Mathias Gibbens, Harsha

Malware What is malware? Malware: malicious software worm ransomware adware

Malware What is malware? Malware: malicious software worm ransomware adware

Android Malware Analysis on Attacks and Defense Android malware Android malware With the

Honeypots: Catching the Insider Threat Your Speaker ! President, Honeypot Technologies Inc. !

Overview Information-driven modeling of biomolecular complexes ! Introduction ! Information

Entrapment: Tricking Malware with Transparent, Scalable Malware Analysis Paul Royal

Getting started with malware analysis Judith van Stegeren Definitions Malware : any software that

GOODWARE DRUGS FOR MALWARE: ON-THE-FLY MALWARE ANALYSIS AND CONTAINMENT DAMIANO BOLZONI

Modeling Dynamics of and on Networks Simultaneously Theory-Driven and Data-Driven Approaches

Modeling metamorphism by abstract interpretation Roberto Giacobazzi 16.09.2010 - SAS2010

A CUCKOOS EGG IN THE MALWARE NEST ON-THE-FLY SIGNATURE-LESS MALWARE ANALYSIS, DETECTION AND

Malware Halting 1. Malware 2. Software diversity Part I: Method Development 3. Computer

Data-driven Photometric 3D Modeling for Complex Reflectances Boxin Shi (Peking University)

Natural Convec.on-Driven Propulsion MODELING AND SIMULATION OF

How does Malware Use RDTSC? A Study on Operations Executed by Malware with CPU Cycle Measurement

Towards High-Interaction Virtual ICS Honeypots-in-a-Box D ANIELE A NTONIOLI A NAND A GRAWAL N. O.

Test%Driven+Data+Modeling+With+Graphs + Twi7er:+@ianSrobinson+ #neo4j+ + Outline+