Honeypot

Systems set up with limited security, also known as honeypots, act as enticement for an attacker.

Recent research reveals that a honeypot can imitate all aspects of a network, including its web servers, mail servers, and clients.
Honeypots are intentionally set up with low security to gain the attention of DDoS attackers and serve as a means for gaining information about attackers, attack techniques, and tools by storing a record of the system activities.
DDoS attackers attracted by a honeypot install handlers or agent code within the honeypot.
This avoids compromising systems that are more sensitive.
Honeypots not only protect the actual system from attackers but also keep track of details on the attackers’ activities by recording the activity information.
Consequently, the honeypot owner can keep a record of the handler and/or agent activity.
Users can employ this knowledge to defend against any future DDoS installation attacks.
A defense-in-depth approach with Internet Protocol Security (IPSec) can be used at different network points to divert suspicious DoS traffic to several Honeypot.

A honeypot is a computer system on the Internet intended to attract and trap those who attempt unauthorized or illicit utilization of the host system to penetrate an organization’s network.

It is a fake proxy run to frame attackers by logging traffic through it and then sending complaints to the victims’ ISPs.
It has no authorized activity or production value, and any traffic to it is likely a probe, attack, or compromise.
Whenever there is any interaction with a honeypot, it is most likely to be malicious.
Honeypots are unique; they do not solve a specific problem.
Instead, they are a highly flexible tools with many different security applications.
Honeypots help in preventing attacks, detecting attacks, and information gathering and research.
A honeypot can log port access attempts or monitor an attacker's keystrokes; these could be early warnings of a more concerted attack.
It requires a considerable amount of effort to maintain a honeypot.

There are two different types of honeypots

Low-interaction honeypots

Low-interaction honeypots emulate only a limited number of services and applications of a target system or network. If the attacker does something that the emulation does not expect, the honeypot will simply generate an error. They capture limited amounts of information, i.e., mainly transactional data, and some limited interactions. These honeypots cannot be compromised completely. They are set to collect higher-level information about attack vectors such as network probes and worm activities. Some examples are tiny-ssh-honeypot, KFSensor, and Honeytrap. KFSensor is a low-interaction honeypot used to attract and identify penetrations. It implements vulnerable system services and Trojans to attract hackers. This honeypot can be used to monitor all TCP, UDP, and ICMP ports and services. KFSensor identifies and raises alerts about port scanning and DoS attacks. A honeytrap is a low-interaction honeypot used to observe attacks against TCP and UDP services. It runs as a daemon and starts server processes dynamically on requested ports. Attackers are tricked into sending responses to the honeytrap server process. The data that is received by the honeypot is concatenated into a string and stored in a database file. This string is called the attack string. Honeytraps parse attack strings for a command requesting the server to download a file from another host in the network. If such a command is detected, the server tries to access the corresponding file automatically. It supports only FTP and TFTP protocols. It also identifies and logs HTTP_URIs.

High-interaction honeypots

nlike their low-and medium-interaction counterparts, high-interaction honeypots do not emulate anything; they run actual vulnerable services or software on production systems with real OS and applications. These honeypots simulate all services and applications of a target network. They can be completely compromised by attackers to gain full access to the system in a controlled area. They capture complete information about an attack vector such as attack techniques, tools, and intent. The honeypotized system is more prone to infection, as attack attempts can be carried out on real production systems. A Honeynet is a prime example of a high-interaction honeypot. It is neither a product nor a software solution that a user installs. Instead, it is an architecture—an entire network of computers designed to attack. The idea is to have an architecture that creates a highly controlled network with real computers running real applications, in which all activities are monitored and logged. “Bad guys” find, attack, and break into these systems through their own initiative. When they do, they do not realize that they are in a honeynet. Without the knowledge of the attackers, all their activities and actions, from encrypted SSH sessions to email and file uploads, are captured by inserting kernel modules into their systems. At the same time, the honeynet controls the attacker's activity. Honeynets do this by using a honeywall gateway, which allows inbound traffic to the victim’s systems but controls the outbound traffic using intrusion prevention technologies. This gives the attacker the flexibility to interact with the victim’s systems but prevents the attacker from harming other non-honeynet computers.

Types of Honeypots

Pure Honeypots

Pure honeypots emulate the real production network of a target organization. They cause attackers to devote their time and resources toward attacking the critical production system of the company. Attackers uncover and discover vulnerabilities and trigger alerts that help network administrators provide early warnings of attacks, thus reducing the risk of an intrusion.

Honeypots Based on Deployment Strategy

Production Honeypots:
- Production honeypots are deployed inside the production network of the organization along with other production servers.
- Although such honeypots improve the overall state of security of the organization, they effectively capture only a limited amount of information related to the adversaries.
- These honeypots fall under the low-interaction honeypot category and are extensively employed by large organizations and corporations.
- As production honeypots are deployed internally, they also help to identify internal flaws and attackers within an organization.
Research Honeypots:
- Research honeypots are high-interaction honeypots primarily deployed by research institutes, governments, or military organizations to gain detailed knowledge about the actions of intruders.
- By using such honeypots, security analysts can obtain in-depth information about how an attack is performed, vulnerabilities exploited, and attack techniques used by the attackers.
- This analysis helps improve attack prevention, detection, and security mechanisms, and develop more secure network infrastructures.
- Drawback: Research honeypots do not contribute directly to the security of the company. They are more suited for organizations looking to improve research and threat intelligence capabilities.

Honeypots Based on Deception Technology

Malware honeypots are used to trap malware campaigns or malware attempts over the network infrastructure.
These honeypots are simulated with known vulnerabilities, such as outdated APIs and vulnerable SMBv1 protocols, and they emulate different Trojans, viruses, and backdoors that encourage adversaries to perform exploitation activities.
These honeypots lure attackers or malware into performing attacks, allowing identification of attack patterns, malware signatures, and threat actors.

Database Honeypots:
- Database honeypots employ fake databases that are vulnerable to database-related attacks like SQL injection and database enumeration.
- These fake databases trick attackers into thinking they contain sensitive information such as credit card details or employee databases.
- By analyzing the attacks on these fake databases, attackers' tactics, techniques, and procedures (TTPs) can be identified effectively.

Spam Honeypots:
- Spam honeypots specifically target spammers who abuse vulnerable resources like open mail relays and open proxies.
- These honeypots consist of mail servers that deliberately accept emails from any random source on the Internet, providing crucial information about spammers and their activities.

Email Honeypots:
- Email honeypots, also known as email traps, are fake email addresses used to attract malicious emails.
- These fake email IDs are distributed across the open Internet and dark web to lure threat actors into performing malicious activities.
- By monitoring the incoming emails, administrators can identify deception techniques and warn internal employees to avoid falling for email traps.

Spider honeypots, also known as spider traps, are designed to trap web crawlers and spiders.
Many threat actors use web crawling to extract important information from web applications, such as URLs, contact details, and directory information.
Spider honeypots emulate fake websites and trap such crawlers, allowing threat actors attempting to perform web crawling to be identified and blacklisted.

Bait and switch honeypots actively participate in security mechanisms that are employed to respond quickly to incoming threats and malicious attempts.

They redirect all malicious network traffic to a honeypot after any intrusion attempt is detected.
An attacker can identify the presence of such honeypots by looking at specific TCP/IP parameters such as the Round-Trip Time (RTT), the Time To Live (TTL), and the TCP timestamp.

Tools

KFSensor: https://www.kfsensor.net
Valhala Honeypot: https://sourceforge.net
Cowrie: https://github.com
HoneyHTTPD: https://github.com
StingBox: https://www.stingbox.com