Help Perfect The Cracker Antfarm With honeyd

Niels Provos would like you to help create the perfect lure for crackers. In the style of similar challenges presented by the Honeynet Project, Provos, a doctoral candidate at CITI (a research institute at the University of Michigan) has announced a public competition for contributions to his honeyd project, which the project page describes as "a small daemon that creates virtual hosts on a network." Honeyd does more than that terse description implies, though: read on to see how you can contribute to creative cracker snaring.

Behind door number three ...

Rather than wait for production systems to be cracked, honeypot makers arrange sting operations: they set up as traps intentionally tempting target machines loaded with tools to observe any break-ins.

Though the projects' names (and their rosters of hackers) are confusingly similar, honeyd is distinct from the Honeynet Project. Both are concerned with watching intruders' behavior for analysis and, in the long run, preventing their exploits, but the projects vary in their scope. Honeyd offers specific software tools to effect the appearance of a crackable box (and can simulate thousands of crackable machines at once); the Honeynet Project is broader, and uses honeyd within its larger framework of studying cracker attacks.

"Honeyd creates virtual honeypots that simulate operating system characteristics to such a degree that it fools fingerprinting tools like nmap or xprobe," says Provos. "As such it is a virtual honeypot that may be used for all kinds of purposes -- network sensors, decoys, et cetera. As the Honeynet project investigates interesting honeypot technologies, Honeyd got me involved with the [Honeynet Project] and is my contribution."

The competition Provos is organizing is in turn a chance for others to contribute to his honeypot tool; a variety of prizes (including a trip to CanSecWest/core03) will go to the programmers who provide the best improvements to the current version (0.5) of honeyd. He's hoping to field contributions to upgrade the user interface, better analyze information captured as intruders try to break in, provide simulated P2P programs, and more. Though there's a list of suggestions on the site, anything to more effectively mimic genuine target machines is welcome.

License requirements are friendly to open source programmers: "Source code features to be integrated into Honeyd need to be covered by a BSD-like license. Service emulations and graphical user interface [submissions] may be either BSD-like or GPL."

Though the honeynet.org page says that Provos is sponsoring the challenge, he says others (like Honeynet Project lead Lance Spitzer) have put up the prizes. "As I am still a poor student, I anticipate that my only financial expenses are going to be shipping costs."

What inspired the idea of a contest, rather than simply waiting for code to roll in from interested hackers? "The Honeynet project has held very successful challenges in the past," says Provos. "Additionally, Lance Spitzer and Marcus Ranum have been giving tutorials on honeypots and noticed that all the participants really enjoyed working with Honeyd. As a result, Lance encouraged me to hold this challenge."

What's in it for them?

Spitzer, one of the challenge judges, lists a few things he'd like to see come out of this contest. "All the plumbing and features are there for developing your own honeypots. I would love to see these capabilities extended and making it easier to use. For example, it would be great [to see] new emulated services added, a port to Windows, and a GUI to make it easier to use."

Spitzer has recently published a book about honeynets as well, so he has a good reason to want some attention focused on this sort of calculated intruder watching.

"I am most interested in the balance of getting realism with as little risk of abuse," says Job de Haas, another judge for the competition and CEO of security consulting firm ITSX. "The idea is to build simulated services, but you want to end the realism where it starts to undermine the security of the system beyond control." De Haas says that one of the system's weak points right now is that it's simply difficult for new users to know where to begin. "Hopefully lots of useful examples will come out of the challenge, to make it easier to get started."

I send you this file to ask your advice about breaking in.

Code submissions from hundreds of contributors (all of them savvy enough about cracking to contribute in the first place) raise the prospect of at least a few of them trying to sneak in their own malware to subvert the competition, but the organizers discount the possibility of a backdoor or other crack being submitted.

While it's unlikely that malicious code would make it far, Provos says that to be on the safe side (and make sure it doesn't hurt his working environment), "Personally, I run all new code under a systrace sandbox, and before new code gets integrated into the official honeyd source code it has to pass a source code audit."

Similarly, De Haas says that he's not worried about malicious code, but is "alert that someone might try. Generally we're quite used to dealing with untrusted code. On the other hand I don't consider myself unhackable, it can always happen. You mostly try to minimize the damage it can do."

"Generally the community is very good about this." says Spitzner. "While I doubt this would happen, you do have to be concerned about it. Fortunately, the judges we have (except for me :) are outstanding at code review."

---

Further reading: We've mentioned the Honeynet Project a few times before -- here's one story from July 2001 and other from July 2002; a search on "honeynet" will yield several more.

Hmmm...?

[Anonymous Coward]

For example, it would be great [to see] new emulated services added, a port to Windows, and a GUI to make it easier to use.

...how many people that set up honeypots use Windows or need a GUI?

Furthermore, how many developers that make these kind of tools want to cater to the Windows/GUI crowd?

Re:Hmmm...?

[srmalloy]

...how many people that set up honeypots use Windows or need a GUI?

You're right; who needs a honeypot when you can just set up a Windows system, which is automatically a hack magnet?

Seriously, though, having a Windows honeypot would be useful simply because of the enormous variety of attacks directed at Windows systems. Having a system designed to attract and log attacks would give more information than trying to examine the post-mortem data after a Windows box has been 'H4C|20R3D'.

Re:Is it easy to tell that you're in a honey pot?

[sporty]

I'd wager you can..

Audit a live system somewhere, where people "live" to copy everything that isn't "sensitive". Then fake the sensitive info, like passwords, card numbers and names.

That is how you do final tests before production. You make a system so lifelike, it is infaliable.. or nealy so.

Re:Is it easy to tell that you're in a honey pot?

[TopShelf]

That's an interesting point - you'd need to create output files with varying dates and times (to look like production data), log files, etc. I would think one idea would be to take a snapshot of your live environment at a given time, then create a honeypot when needed that alters file create/mod dates appropriately. Not easy, but it's a thought...

Re:Is it easy to tell that you're in a honey pot?

[fudgefactor7]

Couldn't you just write a script (or something) to "touch" random files? That would change the dates. Then add a bunch of fake users (some disabled, naturally, as that's a nice target.) That might work.

Mirror Pro Al Qaeda Sites.

[cybermage]

and find out how the NSA/CIA hack boxes.

Re:Is it easy to tell that you're in a honey pot?

[martyros]

It depends on what your goal is. If you're looking to collect new exploits, well, it's pretty easy to make things seem real on the outside. The earlier versions of honeyd (if I recall correctly from my conversations with Neils) didn't actually allow an attacker to get very far with an attack, because they didn't run any actual services, just a fake thing that mimicked a service. The purpose wasn't to actually entrap and convict hackers, or to observe their modes of operation and so on; but to collect information about new attacks (for signature detectors in firewalls) and to hide your real system in among a bunch of fakes.

If you're looking to actually observe crackers "in the wild", you have to make your system look reasonably real; while at the same time making sure the attackers can't do any real damage from your machine (else you may be implicated in their crimes). The Honeynet project has a lot of good tips and tricks on this sort of thing. For example, not allowing more than 10 outgoing connections (so that it can't be used to scan or launch a DDOS attack), and putting a message in motd saying, "The network is acting kind of flaky, we're working on it, blah blah blah."

In fact, making a realistic honeypot is essentially just social engineering... hmm...