Detecting Attacks with Honeypot System

Število varnostnih incidentov, ki se zgodijo na spletu ali preko njega, vse bolj narašča. Napadalci, ki ogrožajo produkcijske sisteme, namreč z veliko vnemo odkrivajo vedno nove ranljivosti in nove načine za njihovo zlorabo in izkoriščanje. V želji, da bi spoznali več o vzorcih napadov in vedênju napadalcev, se je na področju varovanja informacijskih tehnologij razvil koncept elektronskih vab, imenovan honeypot. Na omrežje se ga postavi samo zato, da ga je mogoče napasti in ogroziti. Pri tem sistemske pravice napadalca oziroma avtomatiziranih skript v resnici niso takšne, kot se sprva zdi, preden tak vdiralec ugotovi, da se je znašel v pasti, pa lahko honeypot zabeleži vso njegovo neavtorizirano dejavnost v datoteke, do katerih pa napadalec nima dostopa. Koncept delovanja tovrstne tehnologije je zato izrednega pomena za zaznavanje in odkrivanje novih groženj, saj je za razliko od sistemov za zaznavanje in preprečevanje napadov in od požarnih zidov sposoben zaznavati tudi napredne trajne grožnje (APT). Tehnologija honeypot na varnostnem področju že zdaj veliko ponuja, še več pa obeta, vendar je splošni javnosti še neznana. Prav zato smo se odločili, da v okviru diplomske naloge raziščemo njeno delovanje in jo bolje spoznamo. V praksi smo to tehnologijo preizkusili s testiranjem honeypota Kippo SSH. Namen testiranja je bil uspešno vzpostaviti honeypot in ugotoviti, ali se napadi na produkcijske sisteme odvijajo dnevno. Poleg tega pa smo želeli preveriti tudi razlike med delovanjem honeypota v lokalnem omrežju in zunaj njega in skušali dokazati, da zabeleži honeypot zunaj lokalnega omrežja več napadov kot znotraj njega.The number of security breaches that happen on or through the internet, is growing. Attackers present a constant threat to production systems and they are vigorous and resourceful enough to always find new ways to compromise and exploit them. In the aim to learn more about attackers and attack patterns a new approach was proposed. The whole new concept was built around an idea which incorporated characteristics of a honeypot. It lures the attacker into a trap where it gives him tools to interact with in order to monitor his behaviour. Needless to say, the new technology goes by the same name. Honeypot. The only purpose of this kind of system is to be probed, attacked, compromised or exploited. In reality, attacker doesn\u27t have priviliges to do whatever he wants on the compromised system as it first seems. Honeypot also stores all events in log files for later examination. Therefore, it is very usefull when we come to terms of detecting new threats. The thing that distinguish honeypot from other detection and prevention system or firewalls is the ability to detect new generation attacks, i.e. Advanced Persistant Threats (APT). The topic is relatively unknown to the general public. For that reason we have decided to do some research about honeypot technology. Furthermore, we also made some testings with Kippo SSH honeypot, so we can put what we learned from literature to practice. The purpose was to successfully deploy a honeypot and do some testings on internal and external network. We were curious if the attacks will happen on regular everyday basis. Also, we asked ourselves if the honeypot, which was deployed on the external network, directly to the internet, is going to log more attacks then the one deployed on the local area