7 ms·

I run a honeypot software company, with our customers being mid-large enterprises. While the case presented here is certainly interesting, it's actually fairly

I run a honeypot software company, with our customers being mid-large enterprises. While the case presented here is certainly interesting, it's actually fairly uncommon for companies to run internet-facing honeypots, mostly due to it being a huge resource sink, and it's fairly difficult to learn anything truely useful from observing attacks coming from (mostly) bots. The more interesting use case for most is planting these in your network internals, which gives an added benefit of early, high-fidelity threat detection in addition to the "threat intelligence" bonuses. It's not completely trivial to set up, but can be a reasonably quick way to build good detection capability into even very disparate environments. A vast majority of organizations still lack good situational awareness of their infrastructures and this is one way of improving on that.

wwv25 6y ago
Did you plant internally to detect malicious actors from within the organization or as a way to definitively detect external actors who have presumably entered the network through an exploit?
- faeyanpiraat 6y ago
  Why not both?
  - mosselman 6y ago
    You are probably right, but ‘both’ is the easy answer I’d think. The question really was what the intention is, not the effect. Catching attacks from within the organisation might just be a side-effect of catching remote hackers for example. The effect is then ‘both’, but the intention is the latter. Why the question deserves a better answer than “why not both” is that the reasoning behind using internal honeypots is interesting. Which arguments speak for it, which against. So let’s not kill this question thread with a too shallow answer.
- waihtis 6y ago
  Both are viable. It depends a bit on industry; pharma companies, say, are quite concerned about internal threats whereas financial and retail are more likely targets of external actors. You do need to consider the type of honeypot used - asking the question "what is the goal the adversary has" is a good question to ask and optimizing you honeypots based on that is a smart thing. An internal threat is going to look for specific types of assets, and you need to build honeypots (or decoys, as the modern lingo calls them) that look like those assets.
SCHiM 6y ago
I'm wondering, given how threat actors normally behave when intruding into networks, do you also have honey user credentials in the network? I don't imagine you're catching many serious attackers just by exposing fake servers vulnerable to MS17 for example. Could you explain more about your strategies and which types of attackers you can say you'd catch with surety?
- merlinscholz 6y ago
  Internal honeypots as early warning system are called Canaries. Usually they run on a just slightly outdated and vulnerable software version, so that an attacker does not need credentials. One example would be emulating a forgotten file server with SMB1 enabled. The homepage of Thinkst Canary https://canary.tools/ https://canary.tools/ gives a good overview.
  - waihtis 6y ago
    Canaries has been pretty much replaced by decoys as the "official" term, as denoted by the MITRE SHIELD framework: https://shield.mitre.org/matrix/ https://shield.mitre.org/matrix/
    - qwantim1 6y ago
      Canary (in a coal mine) makes more sense to me if the goal is an early warning system.
- waihtis 6y ago
  > I'm wondering, given how threat actors normally behave when intruding into networks, do you also have honey user credentials in the network? Yes, for some types of honeypots credentials can be useful. Although it bears to keep in mind that the more accessible you make your honeypots, credentials, and other "detection elements", to more you open yourself to false alarms. Some vendors in our space plant credentials to every endpoint and I've heard mostly negative results (legitimate users clicking stuff out of curiousity, which completely destroys the key benefit of using honey/deception things.) > I don't imagine you're catching many serious attackers just by exposing fake servers vulnerable to MS17 for example.Could you explain more about your strategies and which types of attackers you can say you'd catch with surety? One use case we suggest is tying your honeypot strategy with your existing internal vulnerability & threat management, in practice for example circulating the types of honeypots you have to reflect acute, high-value vulnerabilities - or for slightly more advanced orgs who are on top of their threat intelligence, they could actively plant honeypots that match asset types threat actors in their industry space have been known to target. Tie that with creds, integrations and such where applicable and you have a pretty decent palette for catching events that also bear useful and timely security telemetry.
justinclift 6y ago
Hopefully one of your honeypots simulates NetBackup. eg the Veritas (was Symantec) software That should be reasonably easy to simulate, and (I'm guessing) Netbackup infrastructure would be significantly interesting to any hacker once they've popped an org.
- waihtis 6y ago
  To be frank I haven't heard of such scenarios from any direct sources. If you're thinking ransomware here then it's usually fairly automated and takes a shotgun approach for propagation, and trying to extend your breach to also manipulate any potential backup software would significantly increase the cost of the attack. That being said - I could easily see this as a future trend (targeting backups) and it is not remotely a bad idea.
  - justinclift 6y ago
    Ahhhh. Hadn't thought of the ransomware aspect at all, but it's a good point. ;) With NetBackup (and probably other "Enterprise Backup" software too) the NetBackup master servers have ~root level access to pretty much every server in an Enterprise. Or at least, every server being backed up. Which is likely to be everything important. ;) NetBackup master servers also have the capability to run commands (as root) remotely on systems-they-back-up, and have those commands not be logged by the auditing on the systems (or anywhere really). To my mind, that seems like a handy thing for hackers to target. ;)
    - waihtis 6y ago
      I get a feeling this could be the next Solarwinds..
GordonS 6y ago
Nice, your software looks pretty polished! Have you published any kind of best practices guides for using decoys, or alternatively are you aware of any other good guides? I've seen decoys mentioned in infosec Twitter quite a few times recently (I think more about OSS ones), and I'd like to learn more about how they are generally actually used, what the expectations are etc.
- waihtis 6y ago
  We haven't so far.. Mitre SHIELD (shield.mitre.org) lays out the different types of capabilities there are in this domain but doesn't have a lot of practical how-to advice which is what I think you're more after. If you think it would be helpful I can send you our "product guide" which touches a bit on the decoy best practices. If this sounds useful message me at simo@[the domain in my profile] and I'll send it over. I might actually write something about it online also, sounds like it could be useful knowledge for many.
TazeTSchnitzel 6y ago
A fun example of a honeypot was that placed by Cliff Stoll in 1986 on a computer system at Lawrence Berkeley when trying to get a repeated attacker to stay on the line long enough to be traced, as described in The Cuckoo's Egg and portrayed in this PBS NOVA recreation: https://www.youtube.com/watch?v=hTx9h3Sm29I https://www.youtube.com/watch?v=hTx9h3Sm29I
- davidyliuliu 6y ago
  hahahah the intro of the video is hilarious
  - cptskippy 6y ago
    Back in the day if you were watching PBS and saw the WGBH logo you knew it was going to be good.
    - cbm-vic-20 6y ago
      It's also the reason I will never forget the ZIP Code for Allston.
  - garaetjjte 6y ago
    Everything this guy does is hilarious and entertaining. See later talk about this event: https://www.youtube.com/watch?v=1h7rLHNXio8 https://www.youtube.com/watch?v=1h7rLHNXio8 And he drives RC forklift under his house to store Klein bottles he's selling! https://www.youtube.com/watch?v=-k3mVnRlQLU https://www.youtube.com/watch?v=-k3mVnRlQLU
- e12e 6y ago
  Wait, "stay on the line long enough" was an actual thing? I guess that means shorter calls were free, as they could not be documented/invoiced?
  - deleted 6y ago
    [deleted]
hcrisp 6y ago
There was a recent WSJ article I submitted recently that details how companies such as Land O' Lakes are doing just that -- honeypots on internal networks. https://news.ycombinator.com/item?id=25741589 https://news.ycombinator.com/item?id=25741589
- waihtis 6y ago
  Seems there's a bit of love going around for deception lately, always good to see some implementation stories going mainstream.
varispeed 6y ago
Do all employees know about honeypots or just a select few?
- waihtis 6y ago
  Just a select few usually, from within the security team. of course this applies for boilerplate big company deployment. I could see use cases where you would involve others like IT or dev in the deception process..

wwv25 6y ago

Did you plant internally to detect malicious actors from within the organization or as a way to definitively detect external actors who have presumably entered the network through an exploit?

faeyanpiraat 6y ago
Why not both?
- mosselman 6y ago
  You are probably right, but ‘both’ is the easy answer I’d think. The question really was what the intention is, not the effect. Catching attacks from within the organisation might just be a side-effect of catching remote hackers for example. The effect is then ‘both’, but the intention is the latter. Why the question deserves a better answer than “why not both” is that the reasoning behind using internal honeypots is interesting. Which arguments speak for it, which against. So let’s not kill this question thread with a too shallow answer.
waihtis 6y ago
Both are viable. It depends a bit on industry; pharma companies, say, are quite concerned about internal threats whereas financial and retail are more likely targets of external actors. You do need to consider the type of honeypot used - asking the question "what is the goal the adversary has" is a good question to ask and optimizing you honeypots based on that is a smart thing. An internal threat is going to look for specific types of assets, and you need to build honeypots (or decoys, as the modern lingo calls them) that look like those assets.

SCHiM 6y ago

I'm wondering, given how threat actors normally behave when intruding into networks, do you also have honey user credentials in the network? I don't imagine you're catching many serious attackers just by exposing fake servers vulnerable to MS17 for example. Could you explain more about your strategies and which types of attackers you can say you'd catch with surety?

merlinscholz 6y ago
Internal honeypots as early warning system are called Canaries. Usually they run on a just slightly outdated and vulnerable software version, so that an attacker does not need credentials. One example would be emulating a forgotten file server with SMB1 enabled. The homepage of Thinkst Canary https://canary.tools/ https://canary.tools/ gives a good overview.
- waihtis 6y ago
  Canaries has been pretty much replaced by decoys as the "official" term, as denoted by the MITRE SHIELD framework: https://shield.mitre.org/matrix/ https://shield.mitre.org/matrix/
  - qwantim1 6y ago
    Canary (in a coal mine) makes more sense to me if the goal is an early warning system.
waihtis 6y ago
> I'm wondering, given how threat actors normally behave when intruding into networks, do you also have honey user credentials in the network? Yes, for some types of honeypots credentials can be useful. Although it bears to keep in mind that the more accessible you make your honeypots, credentials, and other "detection elements", to more you open yourself to false alarms. Some vendors in our space plant credentials to every endpoint and I've heard mostly negative results (legitimate users clicking stuff out of curiousity, which completely destroys the key benefit of using honey/deception things.) > I don't imagine you're catching many serious attackers just by exposing fake servers vulnerable to MS17 for example.Could you explain more about your strategies and which types of attackers you can say you'd catch with surety? One use case we suggest is tying your honeypot strategy with your existing internal vulnerability & threat management, in practice for example circulating the types of honeypots you have to reflect acute, high-value vulnerabilities - or for slightly more advanced orgs who are on top of their threat intelligence, they could actively plant honeypots that match asset types threat actors in their industry space have been known to target. Tie that with creds, integrations and such where applicable and you have a pretty decent palette for catching events that also bear useful and timely security telemetry.

justinclift 6y ago

Hopefully one of your honeypots simulates NetBackup. eg the Veritas (was Symantec) software That should be reasonably easy to simulate, and (I'm guessing) Netbackup infrastructure would be significantly interesting to any hacker once they've popped an org.

waihtis 6y ago
To be frank I haven't heard of such scenarios from any direct sources. If you're thinking ransomware here then it's usually fairly automated and takes a shotgun approach for propagation, and trying to extend your breach to also manipulate any potential backup software would significantly increase the cost of the attack. That being said - I could easily see this as a future trend (targeting backups) and it is not remotely a bad idea.
- justinclift 6y ago
  Ahhhh. Hadn't thought of the ransomware aspect at all, but it's a good point. ;) With NetBackup (and probably other "Enterprise Backup" software too) the NetBackup master servers have ~root level access to pretty much every server in an Enterprise. Or at least, every server being backed up. Which is likely to be everything important. ;) NetBackup master servers also have the capability to run commands (as root) remotely on systems-they-back-up, and have those commands not be logged by the auditing on the systems (or anywhere really). To my mind, that seems like a handy thing for hackers to target. ;)
  - waihtis 6y ago
    I get a feeling this could be the next Solarwinds..

GordonS 6y ago

Nice, your software looks pretty polished! Have you published any kind of best practices guides for using decoys, or alternatively are you aware of any other good guides? I've seen decoys mentioned in infosec Twitter quite a few times recently (I think more about OSS ones), and I'd like to learn more about how they are generally actually used, what the expectations are etc.

waihtis 6y ago
We haven't so far.. Mitre SHIELD (shield.mitre.org) lays out the different types of capabilities there are in this domain but doesn't have a lot of practical how-to advice which is what I think you're more after. If you think it would be helpful I can send you our "product guide" which touches a bit on the decoy best practices. If this sounds useful message me at simo@[the domain in my profile] and I'll send it over. I might actually write something about it online also, sounds like it could be useful knowledge for many.

TazeTSchnitzel 6y ago

A fun example of a honeypot was that placed by Cliff Stoll in 1986 on a computer system at Lawrence Berkeley when trying to get a repeated attacker to stay on the line long enough to be traced, as described in The Cuckoo's Egg and portrayed in this PBS NOVA recreation: https://www.youtube.com/watch?v=hTx9h3Sm29I https://www.youtube.com/watch?v=hTx9h3Sm29I

davidyliuliu 6y ago
hahahah the intro of the video is hilarious
- cptskippy 6y ago
  Back in the day if you were watching PBS and saw the WGBH logo you knew it was going to be good.
  - cbm-vic-20 6y ago
    It's also the reason I will never forget the ZIP Code for Allston.
- garaetjjte 6y ago
  Everything this guy does is hilarious and entertaining. See later talk about this event: https://www.youtube.com/watch?v=1h7rLHNXio8 https://www.youtube.com/watch?v=1h7rLHNXio8 And he drives RC forklift under his house to store Klein bottles he's selling! https://www.youtube.com/watch?v=-k3mVnRlQLU https://www.youtube.com/watch?v=-k3mVnRlQLU
e12e 6y ago
Wait, "stay on the line long enough" was an actual thing? I guess that means shorter calls were free, as they could not be documented/invoiced?
- deleted 6y ago
  [deleted]

hcrisp 6y ago

There was a recent WSJ article I submitted recently that details how companies such as Land O' Lakes are doing just that -- honeypots on internal networks. https://news.ycombinator.com/item?id=25741589 https://news.ycombinator.com/item?id=25741589

waihtis 6y ago
Seems there's a bit of love going around for deception lately, always good to see some implementation stories going mainstream.

varispeed 6y ago

Do all employees know about honeypots or just a select few?

waihtis 6y ago
Just a select few usually, from within the security team. of course this applies for boilerplate big company deployment. I could see use cases where you would involve others like IT or dev in the deception process..