Instructor: Honeypots. 2 2
In this lesson, we're going to start talking about honeypots 3 3
and active defense. 4 4
Honeypots are probably the most well-known form 5 5
of active defense, although there are several other types. 6 6
Now, when we talk about defense, 7 7
you probably have heard the old saying, 8 8
"The best defense is a good offense." 9 9
Now, what does that mean? 10 10
Well, this was actually a saying from a boxer 11 11
back in the 1930s named Jack Dempsey. 12 12
And his idea was if you have a really good offense 13 13
and you're hitting the other guy over and over 14 14
and over again, you're going to bloody him up to the point 15 15
where he gets tired and gives up on you. 16 16
That's the idea of the best defense being a good offense. 17 17
Now, does that really apply to our networks? 18 18
Well, maybe or maybe not. 19 19
But in this lesson, we are going to focus on active defense 20 20
because that is one of the objectives 21 21
underneath your CYSA+ exam. 22 22
Now, when we talk about active defense, 23 23
we're talking about the practice of responding to a threat 24 24
by destroying or deceiving the threat actor's capabilities. 25 25
Now, what this really means 26 26
is that we have an engagement with the adversary. 27 27
That's what active defense is all about. 28 28
You're going to hit me, well, I'm going to hit you back 29 29
or you're going to try breaking into my network, 30 30
I'm going to let you in but I'm going to put you 31 31
in this other area that's a decoy. 32 32
That's the idea of active defense. 33 33
For instance, I might want to set up something 34 34
that is essentially bait for an attacker. 35 35
I set up an area of my network that is exposed 36 36
to the internet and I don't patch my servers 37 37
and I put false information on that stuff. 38 38
That all looks like a very attractive target to an attacker. 39 39
And so they may go and grab that. And I'm luring them in. 40 40
Well, that concept is actually called a honeypot. 41 41
A honeypot is essentially a host or a server 42 42
that is set up with the purpose of luring attackers 43 43
away from your actual network components 44 44
that you care about and instead allowing them 45 45
to start attacking this other area. 46 46
When they do this, it allows you to discover 47 47
attack strategies and weaknesses 48 48
in different security configurations 49 49
and learn from their attack methods 50 50
because as you watch them doing things, you're going to see, 51 51
oh, when they first break in, then they try to pivot 52 52
or then they try to escalate privileges 53 53
or then they try to do X, Y, Z. 54 54
And by being able to gather that information, 55 55
you can learn about your adversary. 56 56
Now, in addition to a honeypot, which is a single host 57 57
or server, you might have a honeynet. 58 58
And this is an entire network that's set up to entice 59 59
an attacker and it looks really juicy, 60 60
like it's a real company's network. 61 61
Now, often these honeynets are set up 62 62
by internet security companies 63 63
because they want to use that to allow 64 64
their security teams to analyze an attacker's behavior. 65 65
Now, what's a good example of this? 66 66
Let's say I went ahead and said, 67 67
"I have this wonderful database." 68 68
So then set up a database server. 69 69
I'm going to put some fake information in the database server 70 70
and I'm going to expose it to the internet. 71 71
Now, inside of that database, I have a lot of meaningless 72 72
or unhelpful information but the attacker doesn't know that. 73 73
They just see there's a database with a lot 74 74
of important financial records 75 75
because that's what I made it look like. 76 76
And so as they go in there and they start attacking 77 77
that database and they start getting into there, 78 78
I can start seeing what they're doing and figure out 79 79
what their techniques are and then use that to better harden 80 80
the rest of my network against that type of an attack. 81 81
That's the idea of using a honeypot or a honeynet. 82 82
Now, one of the reasons why security researchers 83 83
set up these big honeynets is to learn about new techniques 84 84
because when they learn about techniques, 85 85
they can try to attribute them back to the actor. 86 86
When we talk about attribution, 87 87
we're talking about the ability to do identification 88 88
and publication of an attacker's methods, techniques, 89 89
and tactics as useful threat intelligence. 90 90
For instance, if you look at FireEye, 91 91
they do this all the time. 92 92
You can go look in a report on a APT 28 for instance 93 93
and they'll tell you they believe this is attributed 94 94
to APT 28, these types of malware 95 95
and these are the common techniques they use 96 96
and these are the common tactics they use 97 97
and this is who we think they are. 98 98
We think they are part of the Russian Federation 99 99
or we think they are part of China or we think they are part 100 100
of the US or whoever it is they think they are. 101 101
That is what attribution does. 102 102
Now, in addition to dealing with things 103 103
like honeynets and honeypots and attribution, 104 104
we also can do other strategies like annoyance strategies. 105 105
Now, annoyance strategies often will rely 106 106
on obfuscation techniques. 107 107
These are things where we're basically trying to annoy 108 108
our attacker and waste their time. 109 109
So for instance, we might put in bogus DNS entries 110 110
so when they look at our DNS records, 111 111
they see that we have a mail server and a SharePoint server 112 112
and a file server and a web server. 113 113
And we may not have any of those servers up 114 114
but we can give bogus DNS entries 115 115
so they think there's something else there 116 116
and so they'll waste their time trying to find it. 117 117
Then we can also have things like web servers 118 118
with decoy directories. 119 119
So I have a web server up 120 120
and I have all my juicy information 121 121
in a file called Confidential. 122 122
No, I don't because I don't want somebody 123 123
to see that 'cause they see confidential, 124 124
they're going to try to get into it, right? 125 125
But I might put decoy directories like confidential, 126 126
important, financial, and that way attackers 127 127
might try to go for those and waste their time 128 128
'cause if they're wasting their time on stuff 129 129
I don't care about, hopefully they're not using their time 130 130
against stuff I actually do care about. 131 131
And then the other thing we can do 132 132
is we can use port triggering and spoofing. 133 133
There's a lot of techniques out there 134 134
where when you see traffic come in on port X, 135 135
have this action occur. 136 136
And so you might have something like they connect on port 25 137 137
to try to get into your SMTP server 138 138
and you're not really running an SMTP server. 139 139
Instead, you're going to send that over to port 80 140 140
and give them some other kind of message back. 141 141
So again, you're wasting their time. 142 142
Now, another thing you can do is what's known as hack back. 143 143
And this is something I don't really encourage you to do. 144 144
Most organizations are not going to allow you to do hack back 145 145
unless you work for maybe a three-letter agency 146 146
or a military component or some other nation-state 147 147
because when you're hacking back, 148 148
you are conducting offensive attacks. 149 149
Hack back is essentially using offensive 150 150
or counterattacking techniques to identify the attacker 151 151
and degrade their capabilities. 152 152
The idea here with hack back is maybe you have somebody 153 153
who is attacking your network and you identify 154 154
that their command and control is at this particular IP. 155 155
Well, you can start doing a denial of service 156 156
against their IP to get them to stop 157 157
doing the attack against you. 158 158
That's the idea of a hack back. 159 159
Now, can you do this legally? 160 160
Mm, maybe, it depends where you live because these things 161 161
all are in different laws based on the city, the state, 162 162
the country, or the region of the world that you live in. 163 163
And so you have to look into that because there are many 164 164
legal and reputational implications 165 165
that you have to consider and mitigate 166 166
before you can use some of these active defense strategies, 167 167
especially hack back. 168 168
For instance, hack back is considered an offensive maneuver. 169 169
As I said, you are attacking somebody. 170 170
So in the United States, you could actually go to jail 171 171
for that because you are breaking the law. 172 172
It is illegal to do hacking. 173 173
And so if you are hacking back against somebody 174 174
who is hacking you, that doesn't make 175 175
two wrongs make a right here. 176 176
You could still go to jail for that. 177 177
So keep that in mind. 178 178
Remember where you are and the laws in your area 179 179
and the laws of the server that you're actually attacking 180 180
because just 'cause you're in the United States, 181 181
that server may be someplace else 182 182
and then it's affected by those laws and regulations. 183 183
So again, the best practice is really not to do hack back. 184 184
But again, it is one of those things that's covered 185 185
in your textbook so I wanted to bring it up here.