Honeypots: the trap is set. (Database And Network Intelligence).

A honeypot is used for internet and computer security. It is a resource that is designed to be attacked and compromised to gain more information about the hacker, such as attack techniques and the motives for breaking in. A honeypot can also be used to divert an attacker from one's production network allowing time for the administrator to react. One of the main goals of a honeypot is educational: to allow one to research hacker activity.

Honeypot Basics

In the information security arena, many professionals are fascinated by honeypot because observers can see real live information about an attack and not just hear about it. Many of us hear of websites being defaced or a bank being hacked into, but how many of us actually know how they got in and exactly what was done?

With honeypots, one can determine how an attacker broke in and exactly what they did. Lance Spitzner, founder of the Honeynet Project, defines the term "honeypot" as follows: "A honeypot is a resource whose value is being attacked or compromised. This means that a honeypot is expected to get probed, attacked and potentially exploited. Honeypots do not fix anything. They provide us with additional, valuable information."

Essentially a honeypot is a tool to gather information, learn about malicious activities and to see trends in this type of activity. It is a system designed to be probed and attacked. To gain knowledge requires monitoring and gathering data to and from these systems. Without this, the honeypot tool is useless.

Types of Honeypots

Marty Roesch, creator of Snort, distinguishes between two categories of honeypots: production honeypots and research honeypots. A production honeypot is used to mitigate risk in an organization. A research honeypot is used to gather as much information as possible so that one can learn from it. Some people argue that these devices do not add security value; however, I differ with this. If a honeypot provides 15 to 20 minutes of extra time for an administrator to react so that he can protect his production network, then there is value right there. If a new exploit is learned by using a honeypot, this is also of benefit to information security because appropriate countermeasures can be developed to defend against this new attack.

How can honeypots add security to an organization?

A honeypot is a tool intended to be compromised. All traffic to and from the honeypot is suspicious because there are no production applications on this system. Few logs should be produced on the honeypot unless the honeypot is under heavy attack. Logs should be easy to read and understand. Once a production honeypot is probed or attacked, an administrator can place preventive controls on his `real' production network.

Classes of Honeypots

In addition to their type, honeypots can also be categorized by class. There are different classes of honeypots: low involvement and high involvement. A low involvement honeypot provides a number of fake services such as HTTP (Hyper Text Transfer Protocol) or SMTP (Simple Mail Transfer Protocol). Low involvement honeypots allow hackers to connect to services, but do nothing else. With this type of honeypot a hacker usually cannot gain operating system access and therefore poses no threat.

A high involvement honeypot produces genuine services and vulnerabilities by providing a real operating system for the attacker to interact with. This class of honeypot is designed to be compromised so that realistic data can be collected. The difficulty in high involvement honeypots is they must be tightly controlled. A compromised system can become a host to begin an attack on another system. An example of a high involvement honeypot is a personal computer running Windows 2000 server with no service packs and Internet Information Server running as a web server.

Honeynets

Honeynets are a group of honeypots made to simulate a real live network. There is added value in honeynets as they provide more data and are more attractive to hackers. However, the set-up and maintenance of honeynets are a little more advanced. A honeynet may include many servers, a router and a firewall. A honeynet may be identical to your production network or it may be a research lab. Nonetheless, honeynets allow for a more real environment for a hacker to attack. The logs gathered from a honeynet may be more difficult to comprehend as data will be gathered from many systems, however it may also prove to be very important data as you may learn of more attacks.

Available Honeypots

There are a number of free and commercially available honeypots on the market today. Their functionalities differ as well as their ease of use.

ManTrap 

ManTrap is a commercially available product from Recourse Technologies based in California, USA. The software runs on top of the Solaris 2.x, 7 and 8 operating systems. The main concept of ManTrap is so-called cages. A cage is a copy of the host operating system that is connected to a network interface card. On a single machine, ManTrap supports up to four interface cards. Each operating system is run within the cages to provide a real live system. ManTrap is run on one system; however, because each operating system is bound to each network card and has its own unique IP address, it is presented to the network as four different systems, acting like a honeynet.

Deception Toolkit

The Deception Toolkit (DTK) is a set of freeware tools that allows one to create his own honeypot on Linux systems. DTK works by creating the appearance of a highly vulnerable system and providing known responses to make it seem as though they are attacking a real system.

Specter

Specter is a commercially available honeypot from NeoWorx. Specter simulates a complete machine and-allows an attacker to interact with the machine as if it were a real production system. Specter simulates services such as HTTP, SMTP and FTP allowing responses to a would-be hacker while at the same time tracking and logging every move made. The logs for Specter are stored locally and, since there is no interaction with the operating system actually hosting the Specter software, the logs should remain intact, as the operating system should not be compromised.

Specter can also track down the originator of an attack at the same time an attack is occurring with the use of WHOIS and trace routes. Specter puts its network interface into promiscuous mode, quietly gathering all the data that enters the system. It can emulate a wide variety of operating systems such as Windows 9x, Windows NT, Windows 2000, Linux, Solaris, and many other flavours of Unix. The Specter software runs on Windows NT and Windows 2000.

BOF--BackOffice Friendly

BackOffice friendly, or BOF, as it is commonly known, is a freely available low-involvement honeypot created by the developers of Network Flight Recorder (NFR), a commercially available IDS. BOF is a very simple honeypot that runs on most Windows-based operating systems and emulates services. BOF works by emulating services such as HTTP, TELNET, FTP and IMAP2, and logs to screen any connections that have been made to those ports. It logs the source IP address and also the attempted service.

Home Grown Honeypots

This type of honeypot is created using standard hardware and software. Special configurations are required to be implemented such as remote logging and keystroke capturing. An example of a home grown honeypot is a PC, running RedHat linux, with Apache and Sendmail installed to its default configurations. All logging on the system would be sent remotely to a syslog server and the shell would be modified to capture all keystrokes.

Comment

The cost of honeypots ranges from versions available as freeware to commercial products on the market that can cost up to $10,000. In my opinion, the best and most effective honeypot is a home grown honeypot. However, the honeypot must be well designed and created. Correctly done, with the proper controls put into place, a home grown honeypot or honeynet can create your best data and can also be an important resource in defending your domain. There is ample assistance on the Internet, as discussions on this topic are growing everyday.

CyberGuard Europe Ltd are exhibiting at Infosecurity Europe, at the Grand Hall at Olympia from 29th April - 1st May 2003. www.infosec.co.uk