Towards Hybrid Honeynets via Virtual Machine Cloning and Introspection

•

1 j'aime•2,965 vues

Tamas K Lengyel

Network and System Security 2013

Ingénierie

Towards Hybrid
Honeynets via Virtual
Machine Introspection
and Cloning
Tamas K Lengyel
University of Connecticut

The limitations
Low-interaction honeypots:
● "Artificial" attack surface
● Limited information about the attacks
● Easily identified
High-interaction honeypots:
● Complexity
● Maintenance
● High risk

Hybrid honeypot
Robin Berthier, 2006: Advanced honeypot architecture for network threats
quantification
Primarily use the Low
interaction honeypot and
utilize a High interaction
honeypot when something
"interesting" is happening.
How do you define
"interesting"?

VMI-Honeymon http://vmi-honeymon.sf.net
● Fidelity via Virtual Machine Introspection
○ LibVMI
○ Volatility
○ LibGuestFS
● Scalability via Virtual Machine Cloning
○ QEMU copy-on-write disk
○ Xen copy-on-write RAM

Issues: clone routing
Clones share IP and MAC address!
○ Post-cloning in-guest network reconfiguration should
be avoided
○ Separate bridge/VLAN required for each clone to
avoid collision
○ Honeybrid requires extra setup (iptables rules,
routing tables & ip marks) to be able to route clones

Memsharing results
6207 attack sessions on clone HIHs in two
weeks (single IP address)
Windows XP SP3 x86 (128MB RAM) Windows 7 SP1 x86 (1GB RAM)

Memsharing results
Projected memory savings via CoW RAM
Windows XP SP3 x86 Windows 7 SP1 x86

Future work
● Clone routing using Open vSwitch &
OpenFlow
● Auto-balloon number of HIHs
● Mix Linux and Windows HIHs with additional
software packages installed
● Test large-scale deployment (/24)
● Zazen IDS!

Recommandé

Virtual Machine Introspection in a Hyberid Honeypot ArchitectureTamas K Lengyel

Malware Collection and Analysis via Hardware VirtualizationTamas K Lengyel

CyberSEED: Virtual Machine Introspection to Detect and ProtectTamas K Lengyel

Building a Cyber Range - Kevin CardwellEC-Council

A Distributed Malware Analysis System Cuckoo SandboxAndy Lee

How to detect side channel attacks in cloud infrastructuresPasquale Puzio

Guest Agents: Support & ImplementationMirantis

Secure and Simple Sandboxing in SELinuxJames Morris

Recommandé

Virtual Machine Introspection in a Hyberid Honeypot ArchitectureTamas K Lengyel

Malware Collection and Analysis via Hardware VirtualizationTamas K Lengyel

CyberSEED: Virtual Machine Introspection to Detect and ProtectTamas K Lengyel

Building a Cyber Range - Kevin CardwellEC-Council

A Distributed Malware Analysis System Cuckoo SandboxAndy Lee

How to detect side channel attacks in cloud infrastructuresPasquale Puzio

Guest Agents: Support & ImplementationMirantis

Secure and Simple Sandboxing in SELinuxJames Morris

Directions in SELinux NetworkingJames Morris

BSides Algiers - Metasploit framework - Oussama ElhamerShellmates

Vulnerabilities assessment of windows hyperBank Alfalah Limited

Linux Kernel Security: Adapting 1960s Technology to Meet 21st Century ThreatsJames Morris

BlueHat v17 || Dyre to Trickbot: An Inside Look at TLS-Encrypted Command-And-...BlueHat Security Conference

ExploitsTylor Shellenberger

Have You Driven an SELinux Lately? - An Update on the SELinux Project - OLS ...James Morris

Linux Kernel Security Overview - KCA 2009James Morris

computer virusesupenthira I

Adding Extended Attribute Support to NFSJames Morris

Csw2016 wang docker_escapetechnologyCanSecWest

Introduction to BlockchainAalok Singh

BlueHat v17 || Dangerous Contents - Securing .Net Deserialization BlueHat Security Conference

BlueHat v17 || Don't Let Your Virtualization Fabric Become the Attack Vector BlueHat Security Conference

Introduction to ethereum_publicantitree

Matriux blueInMobi Technology

Cloud Security with LibVMITamas K Lengyel

Virtual Machine Introspection with XenTamas K Lengyel

Scalability, Fidelity and Stealth in the DRAKVUF Dynamic Malware Analysis SystemTamas K Lengyel

Pitfalls of virtual machine introspection on modern hardwareTamas K Lengyel

Stealthy, Hypervisor-based Malware AnalysisTamas K Lengyel

CrySys guest-lecture: Virtual machine introspection on modern hardwareTamas K Lengyel

Contenu connexe

Tendances

Directions in SELinux NetworkingJames Morris

BSides Algiers - Metasploit framework - Oussama ElhamerShellmates

Vulnerabilities assessment of windows hyperBank Alfalah Limited

Linux Kernel Security: Adapting 1960s Technology to Meet 21st Century ThreatsJames Morris

BlueHat v17 || Dyre to Trickbot: An Inside Look at TLS-Encrypted Command-And-...BlueHat Security Conference

ExploitsTylor Shellenberger

Have You Driven an SELinux Lately? - An Update on the SELinux Project - OLS ...James Morris

Linux Kernel Security Overview - KCA 2009James Morris

computer virusesupenthira I

Adding Extended Attribute Support to NFSJames Morris

Csw2016 wang docker_escapetechnologyCanSecWest

Introduction to BlockchainAalok Singh

BlueHat v17 || Dangerous Contents - Securing .Net Deserialization BlueHat Security Conference

BlueHat v17 || Don't Let Your Virtualization Fabric Become the Attack Vector BlueHat Security Conference

Introduction to ethereum_publicantitree

Matriux blueInMobi Technology

Tendances (16)

Directions in SELinux Networking

BSides Algiers - Metasploit framework - Oussama Elhamer

Vulnerabilities assessment of windows hyper

Linux Kernel Security: Adapting 1960s Technology to Meet 21st Century Threats

BlueHat v17 || Dyre to Trickbot: An Inside Look at TLS-Encrypted Command-And-...

Exploits

Have You Driven an SELinux Lately? - An Update on the SELinux Project - OLS ...

Linux Kernel Security Overview - KCA 2009

computer viruses

Adding Extended Attribute Support to NFS

Csw2016 wang docker_escapetechnology

Introduction to Blockchain

BlueHat v17 || Dangerous Contents - Securing .Net Deserialization

BlueHat v17 || Don't Let Your Virtualization Fabric Become the Attack Vector

Introduction to ethereum_public

Matriux blue

En vedette

Cloud Security with LibVMITamas K Lengyel

Virtual Machine Introspection with XenTamas K Lengyel

Scalability, Fidelity and Stealth in the DRAKVUF Dynamic Malware Analysis SystemTamas K Lengyel

Pitfalls of virtual machine introspection on modern hardwareTamas K Lengyel

Stealthy, Hypervisor-based Malware AnalysisTamas K Lengyel

CrySys guest-lecture: Virtual machine introspection on modern hardwareTamas K Lengyel

31c3 Presentation - Virtual Machine IntrospectionTamas K Lengyel

Virtual Machine Introspection with Xen on ARMTamas K Lengyel

En vedette (8)

Cloud Security with LibVMI

Virtual Machine Introspection with Xen

Scalability, Fidelity and Stealth in the DRAKVUF Dynamic Malware Analysis System

Pitfalls of virtual machine introspection on modern hardware

Stealthy, Hypervisor-based Malware Analysis

CrySys guest-lecture: Virtual machine introspection on modern hardware

31c3 Presentation - Virtual Machine Introspection

Virtual Machine Introspection with Xen on ARM

Similaire à Towards Hybrid Honeynets via Virtual Machine Cloning and Introspection

Identify and defend botmaster in a networkvicky Amr

XS Boston 2008 XenLoopThe Linux Foundation

Botnets & DDoS IntroductionKae Hsu

How to hack a telecom and stay aliveqqlan

Sergey Gordeychik - How to hack a telecom and stay aliveDefconRussia

How to hack a telecommunication company and stay alive. Sergey GordeychikPositive Hack Days

Decentralized mining Pools: Security and AttacksAlexei Zamyatin

Research Inventy : International Journal of Engineering and Scienceresearchinventy

Windows server 8 hyper v networking (aidan finn)hypervnu

The Future of Internet Exchange Points - NANOG 47Richard Steenbergen

How to Hack a Telecom and Stay AlivePositive Hack Days

Neutron-to-Neutron: interconnecting multiple OpenStack deploymentsThomas Morin

WirelessconnectFirman Indrianto

Botnet and its Detection Techniques SafiUllah Saikat

Honeypot honeynetSina Manavi

Windows Server 8 Hyper V NetworkingAidan Finn

Cooperative Mining by Stephen Reed (Bitcoin Proof-of-Stake Co-operative Project)Hashers United

"One network to rule them all" - OpenStack Summit Austin 2016Phil Estes

Similaire à Towards Hybrid Honeynets via Virtual Machine Cloning and Introspection (18)

Identify and defend botmaster in a network

XS Boston 2008 XenLoop

Botnets & DDoS Introduction

How to hack a telecom and stay alive

Sergey Gordeychik - How to hack a telecom and stay alive

How to hack a telecommunication company and stay alive. Sergey Gordeychik

Decentralized mining Pools: Security and Attacks

Research Inventy : International Journal of Engineering and Science

Windows server 8 hyper v networking (aidan finn)

The Future of Internet Exchange Points - NANOG 47

How to Hack a Telecom and Stay Alive

Neutron-to-Neutron: interconnecting multiple OpenStack deployments

Wirelessconnect

Botnet and its Detection Techniques

Honeypot honeynet

Windows Server 8 Hyper V Networking

Cooperative Mining by Stephen Reed (Bitcoin Proof-of-Stake Co-operative Project)

"One network to rule them all" - OpenStack Summit Austin 2016

Plus de Tamas K Lengyel

Estimating Security Risk Through Repository MiningTamas K Lengyel

OffensiveCon2022: Case Studies of Fuzzing with XenTamas K Lengyel

Pitfalls and limits of dynamic malware analysisTamas K Lengyel

VM Forking and Hypervisor-based Fuzzing with XenTamas K Lengyel

VM Forking and Hypervisor-based fuzzingTamas K Lengyel

BSides Denver: Stealthy, hypervisor-based malware analysisTamas K Lengyel

Hacktivity 2016: Stealthy, hypervisor based malware analysisTamas K Lengyel

Anti-evil maid with UEFI and XenTamas K Lengyel

Troopers15 Lightning talk: VMI & DRAKVUFTamas K Lengyel

Hacktivity2014: Virtual Machine Introspection to Detect and ProtectTamas K Lengyel

Dfrws eu 2014 rekall workshopTamas K Lengyel

Plus de Tamas K Lengyel (11)

Estimating Security Risk Through Repository Mining

OffensiveCon2022: Case Studies of Fuzzing with Xen

Pitfalls and limits of dynamic malware analysis

VM Forking and Hypervisor-based Fuzzing with Xen

VM Forking and Hypervisor-based fuzzing

BSides Denver: Stealthy, hypervisor-based malware analysis

Hacktivity 2016: Stealthy, hypervisor based malware analysis

Anti-evil maid with UEFI and Xen

Troopers15 Lightning talk: VMI & DRAKVUF

Hacktivity2014: Virtual Machine Introspection to Detect and Protect

Dfrws eu 2014 rekall workshop

Dernier

Processing & Properties of Floor and Wall Tiles.pptxpranjaldaimarysona

MANUFACTURING PROCESS-II UNIT-2 LATHE MACHINESIVASHANKAR N

(ANJALI) Dange Chowk Call Girls Just Call 7001035870 [ Cash on Delivery ] Pun...ranjana rawat

Extrusion Processes and Their Limitations120cr0395

HARMONY IN THE NATURE AND EXISTENCE - Unit-IVRajaP95

(MEERA) Dapodi Call Girls Just Call 7001035870 [ Cash on Delivery ] Pune Escortsranjana rawat

UNIT-II FMM-Flow Through Circular Conduitsrknatarajan

Introduction and different types of Ethernet.pptxupamatechverse

VIP Call Girls Service Hitech City Hyderabad Call +91-8250192130Suhani Kapoor

UNIT - IV - Air Compressors and its Performancesivaprakash250

Call for Papers - Educational Administration: Theory and Practice, E-ISSN: 21...Christo Ananth

(RIA) Call Girls Bhosari ( 7001035870 ) HI-Fi Pune Escorts Serviceranjana rawat

HARDNESS, FRACTURE TOUGHNESS AND STRENGTH OF CERAMICSRajkumarAkumalla

APPLICATIONS-AC/DC DRIVES-OPERATING CHARACTERISTICSKurinjimalarL3

Porous Ceramics seminar and technical writingrakeshbaidya232001

Call Girls Service Nashik Vaishnavi 7001305949 Independent Escort Service NashikCall Girls in Nagpur High Profile

KubeKraft presentation @CloudNativeHooghlysanyuktamishra911

result management system report for college projectTonystark477637

Call Girls in Nagpur Suman Call 7001035870 Meet With Nagpur EscortsCall Girls in Nagpur High Profile

SPICE PARK APR2024 ( 6,793 SPICE Models )Tsuyoshi Horigome

Dernier (20)

Processing & Properties of Floor and Wall Tiles.pptx

MANUFACTURING PROCESS-II UNIT-2 LATHE MACHINE

(ANJALI) Dange Chowk Call Girls Just Call 7001035870 [ Cash on Delivery ] Pun...

Extrusion Processes and Their Limitations

HARMONY IN THE NATURE AND EXISTENCE - Unit-IV

(MEERA) Dapodi Call Girls Just Call 7001035870 [ Cash on Delivery ] Pune Escorts

UNIT-II FMM-Flow Through Circular Conduits

Introduction and different types of Ethernet.pptx

VIP Call Girls Service Hitech City Hyderabad Call +91-8250192130

UNIT - IV - Air Compressors and its Performance

Call for Papers - Educational Administration: Theory and Practice, E-ISSN: 21...

(RIA) Call Girls Bhosari ( 7001035870 ) HI-Fi Pune Escorts Service

HARDNESS, FRACTURE TOUGHNESS AND STRENGTH OF CERAMICS

APPLICATIONS-AC/DC DRIVES-OPERATING CHARACTERISTICS

Porous Ceramics seminar and technical writing

Call Girls Service Nashik Vaishnavi 7001305949 Independent Escort Service Nashik

KubeKraft presentation @CloudNativeHooghly

result management system report for college project

Call Girls in Nagpur Suman Call 7001035870 Meet With Nagpur Escorts

SPICE PARK APR2024 ( 6,793 SPICE Models )

Towards Hybrid Honeynets via Virtual Machine Cloning and Introspection

1. Towards Hybrid Honeynets via Virtual Machine Introspection and Cloning Tamas K Lengyel University of Connecticut

2. The role of the honeypot

3. The limitations Low-interaction honeypots: ● "Artificial" attack surface ● Limited information about the attacks ● Easily identified High-interaction honeypots: ● Complexity ● Maintenance ● High risk

4. Hybrid honeypot Robin Berthier, 2006: Advanced honeypot architecture for network threats quantification Primarily use the Low interaction honeypot and utilize a High interaction honeypot when something "interesting" is happening. How do you define "interesting"?

5. Hybrid honeynet

6. VMI-Honeymon http://vmi-honeymon.sf.net ● Fidelity via Virtual Machine Introspection ○ LibVMI ○ Volatility ○ LibGuestFS ● Scalability via Virtual Machine Cloning ○ QEMU copy-on-write disk ○ Xen copy-on-write RAM

7. Issues: clone routing Clones share IP and MAC address! ○ Post-cloning in-guest network reconfiguration should be avoided ○ Separate bridge/VLAN required for each clone to avoid collision ○ Honeybrid requires extra setup (iptables rules, routing tables & ip marks) to be able to route clones

8. Network overview

9. Clone initiated routing

10. Memsharing results 6207 attack sessions on clone HIHs in two weeks (single IP address) Windows XP SP3 x86 (128MB RAM) Windows 7 SP1 x86 (1GB RAM)

11. Memsharing results Projected memory savings via CoW RAM Windows XP SP3 x86 Windows 7 SP1 x86

12. Future work ● Clone routing using Open vSwitch & OpenFlow ● Auto-balloon number of HIHs ● Mix Linux and Windows HIHs with additional software packages installed ● Test large-scale deployment (/24) ● Zazen IDS!

13. Thank you! Questions?