Camouflage and Obfuscation

In the configuration files for Glastopf and Kippo, you will find predefined Apache or SSHd versions, which attackers already know. It makes sense to modify the products to fit in with your enterprise. For example, if all of your production servers run on IIS, you will not want Glastopf to send an Apache banner.

Configuring a successful honeypot is a question of psychology. The simulated services are intended to tickle the attacker's fancy and entice them to stick around for a while, but if the presentation is all too obvious, attackers will quickly turn to a more rewarding target.

Networks from the Air

Low-interaction honeypots are not good enough to stop more intelligent attackers from becoming suspicious. Honeypots always require a compromise between hardware investment, monitoring precision, and transparency. Because running a complete honeypot network does not make business sense, virtualization technology offers a helpful alternative. Advanced honeypots can simulate whole networks made up of different computers. Remember that a network made up of full-fledged virtual machines can be very useful to an attacker under certain circumstances. Once a virtual machine is compromised, an attacker can leverage it like any other zombie, employing it for DoS attacks and other nefarious activities.

The Honeyd honeypot tool [5], developed by Niels Provos, positions itself as a hybrid that simulates multiple computers without the overhead of a classical hypervisor stack. This approach reduces the computational power requirement, and users benefit from the fact that attackers cannot hijack emulated machines.

Because the product is only available for the desktop versions of Debian, you will need to compile it for other systems. To do so, change to the /usr/src directory and run the commands shown in Listing 4.

From this point onward, you can launch the honeypot by typing the honeyd command. The parameter it expects is the network interface to use; on a Raspberry Pi, you can launch the daemon by typing sudo honeyd -i eth0.

Commissioning the Honeyd Network

Calling Honeyd directly launches honeypots with a set of not very useful default parameters. You will want to add a configuration file that contains additional information about the network topology you are simulating. The first example is the declaration of an admittedly fairly strange workstation, which you can implement using the following snippet:

create windows
set windows personality "OpenBSD 4.0 (x86)"
set windows uptime 1728650
set windows maxfds 35

The create command defines a new host entry that is accessible via its alias. Defining the personality tells Honeyd which operating system to simulate on the host. You will find the names of the individual operating systems in the nmap-os-db file. Note that all the tutorials also refer to this file as nmap.prints.

The tool simulates individual services using the files stored in the /scripts/ subdirectory, which describe the interaction between the server and client. Say you want to bind three different scripts to ports that are accessible via TCP; port 53 will simply be configured as an open UDP port:

add windows tcp port 80 "scripts/web.sh"
add windows tcp port 22 "scripts/test.sh"
add windows tcp port 23 "scripts/router-telnet.pl"
add windows udp port 53 open

Finally, the file declares all unused ports as closed. Assign an IP address of 192.168.3.137 to the system, and you are ready for action:

set windows ethernet "dell"
set windows default tcp action closed
bind 192.168.3.137 windows

On the web, you will find many virtual networks if you search for Honeyd configuration. You can use these networks as a source of inspiration for your honeynet. Prebuilt configuration files are passed into the program using the -f option; -p lets you write to a different trace file, whereas -d runs honeyd in the foreground:

./honeyd -d -p nmap.prints -f config.sample

Honeyd only collects statistics if you call it with the -c option. You can use the analysis scripts created by BruteForce Labs [6] to evaluate the results.

At this time, the honeypot is only accessible via the IP address assigned by the router. In the case of a virtual network, this configuration is not very useful because the attacker can only access the network via a single entry point. You can solve this problem by deploying a program called farpd:

sudo apt-get install farpd

Farpd will install on your single-board computer. After launching farpd with

sudo farpd -i interface

it manipulates the operating system protocol stack so that it fields any IP address requests via ARP from this point onward.

This behavior can cause problems in combination for VoIP systems, so farpd also supports a selective approach. The program can interpret restricting specifications such as 10.0.0.3, 10.0.0.0/16, and 10.0.0.5-10.0.0.15. Finally, the popular -d option in Honeyd tells a program to work in the foreground.