1
00:00:00,000 --> 00:00:04,980
About this final talk of the day, we, I think you submitted this as a CFP,

2
00:00:05,000 --> 00:00:07,780
which may have been like a little late, like may have been right on the dot,

3
00:00:07,880 --> 00:00:14,300
and I was like, and I think it was just right on the spot when all this crap was happening,

4
00:00:14,520 --> 00:00:21,860
with the PHA, WannaCry, and, you know, when I saw this talk, I was like,

5
00:00:22,540 --> 00:00:25,800
I talked to my, you know, the previous speaker was Eric, I was Eric,

6
00:00:25,800 --> 00:00:31,620
I was like, Eric, he runs Honey Pot, and I was like, we've got to talk to this guy,

7
00:00:31,720 --> 00:00:37,100
we've got to talk to this guy, and did you talk to Eric at all, the Honey Pot?

8
00:00:38,240 --> 00:00:42,460
And the Honey Pot, you know, that's been a part of us, that's been part of our village,

9
00:00:42,900 --> 00:00:47,300
and I was like, we've got to bring this in, I mean, we've got to bring this guy in,

10
00:00:47,460 --> 00:00:53,500
and without much ado, he's going to talk about a very, very relevant issue.

11
00:00:54,300 --> 00:00:55,780
Anyone doing policy here?

12
00:00:55,800 --> 00:00:58,660
By any chance, anyone like non-tech or doing policy?

13
00:00:59,080 --> 00:01:03,380
This will be a pretty good talk, especially for those,

14
00:01:03,540 --> 00:01:08,040
it's a good indoctrination of why the cyber security problem is so bad.

15
00:01:08,500 --> 00:01:11,060
And it is my pleasure to introduce you, Tan Kien Song.

16
00:01:13,560 --> 00:01:15,240
Thanks, Wing. Thank you very much.

17
00:01:17,300 --> 00:01:20,640
Can you guys hear me at the back, at the front? Should be fine, right?

18
00:01:21,280 --> 00:01:25,700
Okay. Hey, everyone, my name is Kien Song.

19
00:01:25,800 --> 00:01:26,800
You can call me Kien.

20
00:01:27,020 --> 00:01:31,380
Yeah, thank you very much today, to be having me here today,

21
00:01:31,560 --> 00:01:36,860
to share a few interesting stories about my 15 days of SMB Honey Pot.

22
00:01:37,240 --> 00:01:40,820
I ran Honey Pot. I'm a Honey Pot hobbyist, definitely.

23
00:01:41,100 --> 00:01:44,560
And I ran this Honey Pot during the WannaCry Ransomware time.

24
00:01:45,460 --> 00:01:50,740
Initially, I just expect that, well, I may catch a lot of tons of WannaCry Ransomware,

25
00:01:51,260 --> 00:01:54,320
but unexpectedly and interestingly, I found that, hey,

26
00:01:54,520 --> 00:01:55,780
there are a lot of people who are interested in this,

27
00:01:55,780 --> 00:01:58,500
and there are a lot of uninvited guests that try to talk to my Honey Pot,

28
00:01:58,940 --> 00:02:02,340
try to crash a party, crawling into the Honey Pot,

29
00:02:02,920 --> 00:02:04,500
lay the egg inside the Honey Pot itself.

30
00:02:04,800 --> 00:02:08,460
So, for the next 40 minutes, I'm going to share with you about this,

31
00:02:09,540 --> 00:02:11,380
what I have in my Honey Pot.

32
00:02:11,580 --> 00:02:15,140
I'm going to empty out all my pockets, share with you about the payload itself,

33
00:02:15,780 --> 00:02:17,900
and then, yeah, here we go.

34
00:02:18,480 --> 00:02:21,160
So, I'm going to share with you only three things for these sessions.

35
00:02:21,680 --> 00:02:24,660
The first things will be, let's try to explore together,

36
00:02:24,660 --> 00:02:28,520
about our WannaCry Ransomware in brief, in terms of our network perspective.

37
00:02:29,120 --> 00:02:32,660
And then the second one, I'm going to share with you about my design of the Honey Pot itself.

38
00:02:33,020 --> 00:02:38,040
And then we will see how the so-called wonderful interactions

39
00:02:38,620 --> 00:02:42,660
between the Honey Pot itself and the WannaCry Ransomware.

40
00:02:43,120 --> 00:02:45,280
Yeah, and then later, for the third one,

41
00:02:46,080 --> 00:02:49,700
we're going to see what happened to my Honey Pot after when I pushed it to the internet.

42
00:02:50,220 --> 00:02:50,540
Yeah.

43
00:02:50,800 --> 00:02:52,280
So, yep.

44
00:02:52,440 --> 00:02:54,640
Uh, last but not least,

45
00:02:54,660 --> 00:02:59,680
definitely, I will share with you some of the photos that I have for my Honey Pot itself.

46
00:03:00,120 --> 00:03:02,400
Yeah, so please don't let me go if I don't share it to you.

47
00:03:02,620 --> 00:03:02,800
Yeah.

48
00:03:06,400 --> 00:03:08,820
Yeah, just a quick introduction about myself.

49
00:03:09,140 --> 00:03:09,920
I'm from Malaysia.

50
00:03:10,920 --> 00:03:15,240
I'm a Honey Pot hobbyist, and then I'm part of the HoneyNet project as well.

51
00:03:15,680 --> 00:03:23,020
During my free time, I try to develop Honey Pot, deploy Honey Pot, and try to see what I can have from the internet.

52
00:03:23,380 --> 00:03:23,780
Yeah.

53
00:03:24,660 --> 00:03:29,760
So, I've been involved in some of the so-called open-source network Honey Pot itself.

54
00:03:29,920 --> 00:03:33,940
For example, Dione Honey Pot, and then Garton Honey Pot as well.

55
00:03:34,160 --> 00:03:41,160
And then two years back, we found that there's a challenge about how we can deploy Honey Pot in a Raspberry Pi,

56
00:03:41,260 --> 00:03:42,900
which is those credit card-sized machines.

57
00:03:43,540 --> 00:03:43,640
Yep.

58
00:03:43,700 --> 00:03:47,060
And then Christopher Lake from the HoneyNet project, Singapore chapter.

59
00:03:47,820 --> 00:03:53,020
Both of us, we start off with a project called HoneyPi, which is everyone can download that image itself.

60
00:03:53,420 --> 00:03:59,940
And then just burn it into an SD card, boot it in the Raspberry Pi, boom, you've got a Honey Pot set up.

61
00:04:00,080 --> 00:04:00,500
That's it.

62
00:04:00,820 --> 00:04:06,700
So, I mean, it'll be much easier to set up a Honey Pot within like 15 minutes with this Raspberry Pi.

63
00:04:07,060 --> 00:04:08,440
So, this is the HoneyPi project.

64
00:04:08,820 --> 00:04:09,180
Yeah.

65
00:04:09,480 --> 00:04:14,060
And then during my free time, I've been involved in a Hang in a Box conference, HITB.

66
00:04:14,460 --> 00:04:18,040
So, for this coming August, we'll have one HITB conference in Singapore.

67
00:04:18,440 --> 00:04:22,800
So, feel free to join us if you are in a town.

68
00:04:22,800 --> 00:04:23,440
Yeah.

69
00:04:23,920 --> 00:04:29,440
And me too, also I'm part of this Capture the Flag team for Hang in a Box.

70
00:04:29,720 --> 00:04:35,300
So, a few of us, we just set up the game itself for Hang in a Box conference for the past few years.

71
00:04:35,820 --> 00:04:40,000
I would say this is always one of the exciting experiences because of people, they try to solve the challenge,

72
00:04:40,200 --> 00:04:43,300
they will try to get access into your scoreboards, definitely.

73
00:04:46,940 --> 00:04:52,120
Oh, well, this is one of the most scary and one of the most exciting screens you'll have.

74
00:04:52,960 --> 00:05:01,480
Back in May 2017, I would say that if you have that on your screen, it could be potentially means that, oh, shit, shit happened,

75
00:05:01,640 --> 00:05:03,660
which is you may get infected with a WannaCry somewhere.

76
00:05:05,260 --> 00:05:09,540
But I know some of the very smart-ass dude, which is they put this on their screen,

77
00:05:10,160 --> 00:05:15,260
and then when some guy just walk over and say that, hey, man, you got infected with a WannaCry,

78
00:05:16,180 --> 00:05:21,120
then he will just reply, hey, dude, just relax, this is just a screensaver, no worry.

79
00:05:22,800 --> 00:05:24,120
I heard about this story, yeah, seriously.

80
00:05:27,440 --> 00:05:32,440
Personally, I would say that that's good and bad about the WannaCry ransomware attack.

81
00:05:34,500 --> 00:05:39,700
The bad thing that's definitely is about is going to disrupt a lot of operations.

82
00:05:39,920 --> 00:05:45,860
For example, I heard that there are some car manufacturing company have to shut down the whole

83
00:05:45,860 --> 00:05:49,580
entire production line because of the WannaCry ransomware attacks, definitely.

84
00:05:50,040 --> 00:05:52,340
And then let me share this story.

85
00:05:54,580 --> 00:05:58,700
During the WannaCry ransomware outbreak time, I was in the Uber drive, yeah.

86
00:05:59,020 --> 00:06:05,700
And then we have a good conversation between the driver itself, and then he's a 60-year-old

87
00:06:07,220 --> 00:06:08,820
retirement, rich guy, definitely, yeah.

88
00:06:09,080 --> 00:06:15,660
Then we have a chit-chat, and then he asked me, he say, hey, Kian, what are you doing for a living?

89
00:06:16,260 --> 00:06:22,780
Then I told him that I'm with IT industry, but the next questions that he asked me is really amazed and surprised me the most.

90
00:06:22,780 --> 00:06:30,700
He asked me, hey, Kian, I mean he's a 60 years old retirement, he asked me, hey, Kian, have you heard about WannaCry ransomware?

91
00:06:30,900 --> 00:06:33,080
Is WannaCry ransomware going to affect my iPhone?

92
00:06:34,520 --> 00:06:40,080
I will say good and bad, which is the, the good thing is WannaCry insanity in fact created

93
00:06:40,080 --> 00:06:47,420
a loss of security awareness of, for us, as well as a loss of non-IT industry that's very people.

94
00:06:47,660 --> 00:06:52,760
For him, definitely he concern about his iPhone because he's using his iPhone, the IP address.

95
00:06:52,780 --> 00:06:57,140
for his living. If his wound got infected, I think his ride will be in

96
00:06:57,140 --> 00:07:02,600
trouble. So let's try to dive in. Just to simply, let's try to explore

97
00:07:02,600 --> 00:07:07,260
together about how WannaCry works in terms of network perspective. Just a

98
00:07:07,260 --> 00:07:13,740
brief one. So let's see. Personally, I love to simplify stuff, which is I love

99
00:07:13,740 --> 00:07:22,760
to simplify complicated concepts into just a simple concept, simple ideas. So

100
00:07:23,240 --> 00:07:28,300
personally, I love to simplify at just three simple phases. So the first one

101
00:07:28,300 --> 00:07:33,540
will be scanning, which is WannaCry will try to scan the targeted host. And then

102
00:07:33,540 --> 00:07:36,580
after that, they will move on to the second phase, which is so-called

103
00:07:36,580 --> 00:07:40,480
exploitation phase. And then the third one will be delivering the payload

104
00:07:40,480 --> 00:07:45,380
itself. So for the scanning phase, you will try to check if the host or the

105
00:07:45,380 --> 00:07:49,880
targeted host is patched or not. And then the second thing you will check is

106
00:07:50,460 --> 00:07:52,500
if the double POSA backdoor is installed on it.

107
00:07:52,760 --> 00:07:57,200
Yeah. So and then it will move on to the second phase, which is the

108
00:07:57,200 --> 00:08:03,560
exploitation phase. The exploitation phase will be go with this eternal

109
00:08:03,560 --> 00:08:08,080
pool exploit. And then upon the success of the exploitations, they will install

110
00:08:08,080 --> 00:08:13,220
the double POSA into it. Yeah. Here's the very simple two steps, which is the

111
00:08:13,220 --> 00:08:17,200
first one will be the scanning, move on to the exploitations. And then the third

112
00:08:17,200 --> 00:08:21,180
one will be, yep, definitely WannaCry will definitely happily deliver the

113
00:08:21,180 --> 00:08:22,740
payloads to the compromised host.

114
00:08:23,540 --> 00:08:30,860
Yeah. So this is just a very brief one about three simple steps. So let's try to take a look in

115
00:08:30,860 --> 00:08:34,560
terms of the network perspective. I'm going to show a few screenshots, which is just about

116
00:08:34,560 --> 00:08:40,640
WannaCry in terms of the network pick-up capture perspective. So let's see. In the initial phase,

117
00:08:40,840 --> 00:08:45,120
which is WannaCry will try to check if the system is patched or not, or if the system is

118
00:08:45,120 --> 00:08:51,140
vulnerable to the MS-17017 vulnerability. So it will go through by one simple request, which is

119
00:08:52,760 --> 00:08:58,780
a name pipe request with a file id equal to zero. As a normal Windows 7 or the clean

120
00:08:58,780 --> 00:09:04,880
installations of the Windows 7 machines, it will reply back with trans response, which is the one

121
00:09:04,880 --> 00:09:10,800
highlighted in blue color. Yeah. And then it will continue the error message called status,

122
00:09:11,700 --> 00:09:17,120
insufficient server resources. All right? Then by looking at that, WannaCry will make a second

123
00:09:17,120 --> 00:09:22,420
check. The check will be tried to check for, if the double POSA backdoor is installed on the machine.

124
00:09:22,760 --> 00:09:27,260
And this check is interesting. I mean, I mean, it catch my eye

125
00:09:27,260 --> 00:09:30,040
when I first try to analyze, try to understand about how these

126
00:09:30,040 --> 00:09:34,000
things work. So, the checking will be done through by

127
00:09:34,600 --> 00:09:37,900
trans2 request and a multiplex ID equal to 65, which is

128
00:09:37,900 --> 00:09:41,860
highlighted in the gray color. Yep. And then even normal clean

129
00:09:41,860 --> 00:09:44,880
machines, it will come back with a response called trans2

130
00:09:44,880 --> 00:09:48,180
response, session set up, multiplex ID equal to 65.

131
00:09:49,140 --> 00:09:54,720
Request, 65. Respond, 65. Yep. So, in this case, I want to

132
00:09:54,720 --> 00:09:58,120
understand that. Well, this machine is not infected, it's

133
00:09:58,120 --> 00:10:01,360
not patched, it's not installed with a double POSA. So, what it

134
00:10:01,360 --> 00:10:05,780
will do, it will try to go to the second phase, which is the

135
00:10:05,780 --> 00:10:09,520
exploitations. Yep. This is how eternal blue looks like in

136
00:10:09,520 --> 00:10:14,140
terms of a network perspective. So, it's just a long, I would

137
00:10:14,140 --> 00:10:18,160
say very long, quite long, base 64 encoder stream. So, this is

138
00:10:18,180 --> 00:10:19,420
how eternal blue looks like in terms of the strings. Yep. I

139
00:10:19,420 --> 00:10:22,120
mean, there are some, we can try to decode and try to understand

140
00:10:22,120 --> 00:10:25,340
that. But upon the success of the installations of the eternal

141
00:10:25,340 --> 00:10:29,060
blue, it will, yeah, it will install double POSA into it.

142
00:10:29,280 --> 00:10:33,340
Yeah. So, right now, we have complete the initial phase,

143
00:10:33,520 --> 00:10:36,380
which is the, which is the scanning. And then the second

144
00:10:36,380 --> 00:10:41,980
phase is the exploitations. And then, here we go. Final check.

145
00:10:42,240 --> 00:10:47,500
You'll check whether, if the double POSA installed nicely on

146
00:10:47,500 --> 00:10:48,160
the compromisers. So, this is how eternal blue looks like in

147
00:10:48,180 --> 00:10:50,740
terms of the host. The checking is pretty simple. Same trick,

148
00:10:50,840 --> 00:10:54,680
same old trick, which is using the, the trans2 request, the

149
00:10:54,680 --> 00:10:58,460
multiplex ID equal to 65. Yeah, we have seen it before. But

150
00:10:58,460 --> 00:11:02,180
surprisingly, the, the response that came back is a trans2

151
00:11:02,180 --> 00:11:08,100
response with a multiplex ID equal to 81. So, let's see. 65,

152
00:11:08,380 --> 00:11:11,860
65. This is the original request. If the machine is not

153
00:11:11,860 --> 00:11:15,300
infected by one, by double POSA. But what if, if the

154
00:11:15,300 --> 00:11:18,160
machine is, is infected with a double POSA, the machine is

155
00:11:18,160 --> 00:11:20,320
installed with double POSA. The request, the multiplex ID

156
00:11:20,320 --> 00:11:26,000
will be 65. The response will be 81. Let's see. 65, 81. The

157
00:11:26,000 --> 00:11:32,160
difference is 16, which is, 16 is equivalent to hex value 0x10.

158
00:11:32,680 --> 00:11:35,880
So, by looking at the, this particular differences in, in

159
00:11:35,880 --> 00:11:39,660
terms of the multiplex ID, yeah, I want to kind of understand

160
00:11:39,660 --> 00:11:43,640
that. Well, this machine is installed with the double POSA

161
00:11:43,640 --> 00:11:47,940
successfully. So, double POSA will start to perform so-called

162
00:11:48,160 --> 00:11:51,320
payload delivery. I have the payloads. You are my target

163
00:11:51,320 --> 00:11:54,620
host. You just eat it. Yeah, pum-pum-pum. You just eat all

164
00:11:54,620 --> 00:11:58,400
the, send all the payloads to the compromised host. Yeah. And

165
00:11:58,400 --> 00:12:02,840
then, if the payloads got, um, executed on the host itself,

166
00:12:03,380 --> 00:12:06,180
the first things the payload, it will do, it will try to

167
00:12:06,180 --> 00:12:09,160
perform a DNS resolution to this, uh, very long strings

168
00:12:09,160 --> 00:12:11,920
random domain. I think a lot of us will be very familiar with

169
00:12:11,920 --> 00:12:14,600
this. This is so-called a kill switch domain that we have for,

170
00:12:14,600 --> 00:12:17,760
uh, the one acquiring somewhere. I will say that, uh, this is the,

171
00:12:18,160 --> 00:12:20,860
uh, design floor of the one acquiring somewhere itself. Uh,

172
00:12:20,960 --> 00:12:24,440
so, when one acquiring somewhere payload got executed, the first

173
00:12:24,440 --> 00:12:27,760
thing, if he failed to resolve this particular domain itself,

174
00:12:28,060 --> 00:12:30,640
it will start to perform encryptions on the disk, which

175
00:12:30,640 --> 00:12:34,220
is to try to lock the, uh, lock the disk itself. But the catch

176
00:12:34,220 --> 00:12:37,100
is, this domain is not exist in the world. It's just random

177
00:12:37,100 --> 00:12:41,800
come out from someone or some sandbox stuff. But, and then,

178
00:12:41,940 --> 00:12:44,980
so, no, no matter how one of try to resolve this domain itself,

179
00:12:45,280 --> 00:12:47,960
they will not have any resolutions back. There's no

180
00:12:48,160 --> 00:12:50,940
IP address that should be matched with this domain

181
00:12:50,940 --> 00:12:55,780
initially. So, uh, I think props to the 22 years old, young,

182
00:12:55,880 --> 00:12:59,080
very, uh, brilliant, uh, British, uh, researchers. He, he

183
00:12:59,080 --> 00:13:02,940
said, uh, let me try to register this domain. I'm going to own

184
00:13:02,940 --> 00:13:06,000
this domain. So, in this case, any attempts to, for this, uh,

185
00:13:06,020 --> 00:13:09,060
DNS, uh, resolutions, it will come back to the IP address.

186
00:13:09,340 --> 00:13:12,900
Boom. Then, I mean, thanks to his, uh, his, uh, this act,

187
00:13:13,020 --> 00:13:15,840
definitely, I mean, he, uh, slowed down the whole, uh, one

188
00:13:15,840 --> 00:13:18,140
acquiring somewhere outbreak around the whole world. I mean,

189
00:13:18,160 --> 00:13:20,920
this is a very, uh, very good trick. So, definitely, try to,

190
00:13:20,940 --> 00:13:26,060
try to stop the entire, uh, so-called operation itself. So,

191
00:13:26,600 --> 00:13:29,680
right now, let's look back on the, uh, the, on the attack

192
00:13:29,680 --> 00:13:34,120
life cycle. We have completed, uh, the initial phase and then

193
00:13:34,120 --> 00:13:37,380
the exploitation phase and the payload phase. So, right now,

194
00:13:37,380 --> 00:13:39,400
everyone here is a WannaCry expert. Yeah.

195
00:13:41,040 --> 00:13:47,040
So, as a Honeypot, uh, researcher, back in this, uh, May 2017,

196
00:13:48,160 --> 00:13:51,920
I noticed that, uh, our, uh, the security industry facing a, uh,

197
00:13:52,020 --> 00:13:56,660
very big challenge. The challenge, uh, itself is how can

198
00:13:56,660 --> 00:14:00,740
we collect or how can we download all the WannaCry

199
00:14:00,740 --> 00:14:05,100
payloads as much as possible, as easy as possible? Yeah, I mean,

200
00:14:05,140 --> 00:14:07,920
this is one of the very big challenges we, uh, we have

201
00:14:07,920 --> 00:14:11,180
encountered during, uh, May, uh, back in, uh, uh, two months

202
00:14:11,180 --> 00:14:14,800
back. So, I'm trying to take a look on this, uh, attack life

203
00:14:14,800 --> 00:14:17,980
cycle itself. Yep. And then I found a very pretty interest

204
00:14:18,160 --> 00:14:21,800
thing behavior of the, uh, WannaCry ransomware. I'm, uh, I'm

205
00:14:21,800 --> 00:14:24,620
trying to simplify, again, I, uh, I love to, I, I love to

206
00:14:24,620 --> 00:14:27,860
simplify, uh, complicated idea into a simplified, uh, more

207
00:14:27,860 --> 00:14:32,920
simple idea. So, so, I found that, uh, we can simplify this,

208
00:14:32,980 --> 00:14:37,080
uh, five simple steps into, uh, into just three steps. So, let's

209
00:14:37,080 --> 00:14:40,340
see. WannaCry talk to me, start to talk to me. He say, hey,

210
00:14:40,380 --> 00:14:45,360
Kian, are you, are you patched with the patches? Then I will

211
00:14:45,360 --> 00:14:48,140
respond to him. I say, no, I'm not patched. I'm vulnerable to

212
00:14:48,160 --> 00:14:51,780
this, uh, vulnerability. And then, uh, WannaCry will, will

213
00:14:51,780 --> 00:14:54,200
send me a second request. Are you installed with a double

214
00:14:54,200 --> 00:14:58,260
poser? And I'll respond back. Hey, man, I'm infected with a

215
00:14:58,260 --> 00:15:01,720
double, with a double poser. Yeah. And I, I, I noticed that

216
00:15:02,180 --> 00:15:04,900
WannaCry will not proceed with the exploitation phase or he

217
00:15:04,900 --> 00:15:07,280
will not proceed with the installations of a new

218
00:15:07,280 --> 00:15:10,740
WannaCry, uh, of the new, uh, double poser. But what he will

219
00:15:10,740 --> 00:15:13,580
do, he will just happily deliver the payload to me. So,

220
00:15:13,620 --> 00:15:16,040
right now, I have the payload. Yeah. In this case, by

221
00:15:16,040 --> 00:15:18,140
simplifying this, uh, five steps into three steps, I'm

222
00:15:18,160 --> 00:15:21,500
doing three steps. So, well, while I, uh, discovered this,

223
00:15:21,620 --> 00:15:25,360
uh, behavior, then now I have, uh, I have a thought. Let's try

224
00:15:25,360 --> 00:15:28,000
to implement the whole thing into the honeypot and then let's

225
00:15:28,000 --> 00:15:31,600
see what we will have. Yeah. So, the honeypot that I chose

226
00:15:31,600 --> 00:15:35,140
with, uh, is a Dionea honeypot. Yeah. Uh, Dionea, this, this

227
00:15:35,140 --> 00:15:38,940
particular name, I always misspell with it, which is a D-I-O-N-A-E-A.

228
00:15:39,220 --> 00:15:42,200
When you type, uh, I think I have a fat tingles, which is a

229
00:15:42,200 --> 00:15:47,820
D-I-O-N-A-N-A, D-I-O-N-N-N-N-N-A. But not only, uh,

230
00:15:48,240 --> 00:15:51,340
it's a, this is a very easy to remember name, Dionea honeypot,

231
00:15:51,540 --> 00:15:55,080
which is, uh, equivalent to this particular weird shaped plant in

232
00:15:55,080 --> 00:15:58,160
here. So, right now, I think everyone is a WannaCry expert,

233
00:15:58,300 --> 00:16:00,780
and, uh, everyone is a Dionea, uh, Dionea expert, right?

234
00:16:02,700 --> 00:16:07,020
So, Dionea honeypot, uh, the most powerful, uh, features of

235
00:16:07,020 --> 00:16:09,240
this, uh, Dionea honeypot is about the capability of doing

236
00:16:09,240 --> 00:16:13,320
the network, uh, emulations. Um, a bit, uh, story about

237
00:16:13,320 --> 00:16:15,660
Dionea honeypot, uh, it was developed back in the

238
00:16:15,660 --> 00:16:18,140
Conflictor era, which is, uh, uh, the age of the

239
00:16:18,160 --> 00:16:21,500
Conflictor, which is back in the 2008 or 2009, yeah, back

240
00:16:21,500 --> 00:16:24,760
then. And, uh, but, uh, again, this tool proven to be very

241
00:16:24,760 --> 00:16:28,540
useful after six or seven, uh, seven or nine year, eight, uh,

242
00:16:28,760 --> 00:16:32,600
eight years right now. Uh, this whole, uh, this is a Dionea

243
00:16:32,600 --> 00:16:35,480
honeypot, uh, capable of, uh, supporting a lot of protocol,

244
00:16:35,680 --> 00:16:40,020
mainly will be on SMB protocol, HTTP, uh, FTP, TFTP,

245
00:16:40,960 --> 00:16:45,080
uh, SQL protocol as well, and then also the VOIP, uh, voice

246
00:16:45,080 --> 00:16:48,140
over IP, SIP, yeah. And then, uh, two years back, uh, we

247
00:16:48,140 --> 00:16:50,940
started to implement, uh, uh, the IOT protocol, which is, uh,

248
00:16:50,980 --> 00:16:56,260
UPMP, and, uh, MQTT, uh, into it. So, two months ago, with

249
00:16:56,260 --> 00:16:59,500
that ideas that we have, that, that simplified ideas, then I'm

250
00:16:59,500 --> 00:17:03,140
implode, uh, I'm trying to, uh, implement entire ideas that

251
00:17:03,140 --> 00:17:08,000
I have inside the honeypot itself. So, what I did is, uh,

252
00:17:08,600 --> 00:17:12,580
I turned Dionea honeypot into a Windows 7 machines, and then,

253
00:17:12,660 --> 00:17:15,940
uh, it is infected with a double POSAR backdoor. Yeah, so

254
00:17:15,940 --> 00:17:18,120
this is the core idea of the entire, uh, Dionea honeypot.

255
00:17:18,140 --> 00:17:22,560
Uh, uh, honeypot itself. So, right now, Dionea honeypot is

256
00:17:22,560 --> 00:17:26,560
able to speak in the double POSAR language. Yeah. So, he, he

257
00:17:26,560 --> 00:17:30,080
can interpret, he can understand about how double POSAR work.

258
00:17:30,300 --> 00:17:33,840
So, for example, about, uh, about the command itself,

259
00:17:34,460 --> 00:17:37,700
external host try to talk to my double POSAR, and it, it will

260
00:17:37,700 --> 00:17:41,000
send a first command called ping. I ping you, and double

261
00:17:41,000 --> 00:17:44,540
POSAR will respond back. Hey, I'm here. Yep. And then, uh, it,

262
00:17:44,600 --> 00:17:47,280
uh, it will send a second request, which is the execute

263
00:17:47,280 --> 00:17:48,120
request. And then, uh, it will send a second request, which is

264
00:17:48,140 --> 00:17:51,180
this request. Uh, that, uh, Dionea honeypot will understand

265
00:17:51,180 --> 00:17:54,900
that, well, this guy is going to send a payload to me. So, yep.

266
00:17:54,980 --> 00:17:57,220
And then the, there's a very interesting command, which is,

267
00:17:57,280 --> 00:17:59,740
uh, you don't see it elsewhere. Maybe a lot of people are not

268
00:17:59,740 --> 00:18:02,660
aware about that, this particular double POSAR. That's a kill

269
00:18:02,660 --> 00:18:06,940
command, which is, like, we can kill double POSAR backdoor. So,

270
00:18:07,460 --> 00:18:10,960
during the design of the honeypot itself, a, uh, a couple of

271
00:18:10,960 --> 00:18:13,900
friends will just sit down, and then catch up for, uh, for a

272
00:18:13,900 --> 00:18:16,960
beer, and then we have a talk. Why not we just create an

273
00:18:16,960 --> 00:18:20,620
internet scanner, scan the whole internet, find any machines

274
00:18:20,620 --> 00:18:24,080
with, uh, double POSAR backdoor. We send the kill command to the

275
00:18:24,080 --> 00:18:27,400
double POSAR backdoor. Are we going to kill all the double

276
00:18:27,400 --> 00:18:30,020
POSAR infected machines in the world? Are we going to stop the

277
00:18:30,020 --> 00:18:34,960
whole entire WannaCry outbreak? Uh, I mean, besides about, uh,

278
00:18:35,060 --> 00:18:37,360
that kill switch domain. I mean, we have this kind of

279
00:18:37,360 --> 00:18:40,200
thought. Why not we just create a scanner, zoom scan the whole

280
00:18:40,200 --> 00:18:43,180
internet. After a day, we got everything done. But the problem

281
00:18:43,180 --> 00:18:45,780
is, uh, it doesn't solve the fundamental questions, which is

282
00:18:45,780 --> 00:18:46,700
the security patches.

283
00:18:46,960 --> 00:18:51,320
On the Windows machine itself. So, even be able to kill, kill

284
00:18:51,320 --> 00:18:53,420
the double POSAR, it doesn't make sense, which is, uh, the

285
00:18:53,420 --> 00:18:56,020
infections will be still come back. Yeah, so, let's try to

286
00:18:56,020 --> 00:18:58,720
focus on the, uh, interesting stuff. So, right now, uh,

287
00:18:58,860 --> 00:19:03,560
Diana Honeypot can speak in the double POSAR language. Uh, uh,

288
00:19:03,580 --> 00:19:06,780
we started seeing the payloads coming to the honeypot. The egg

289
00:19:06,780 --> 00:19:09,400
is coming. But the problem is, uh, there's another big

290
00:19:09,400 --> 00:19:13,940
challenge. Um, the payload itself is, uh, encrypted. So,

291
00:19:14,040 --> 00:19:16,800
we're not able to passing that. I'm, uh, definitely, uh, thank

292
00:19:16,960 --> 00:19:19,980
to, uh, zero sum for his, uh, very detailed, uh, analysis on

293
00:19:19,980 --> 00:19:23,700
how double POSAR work. And then, uh, uh, we understand that, uh,

294
00:19:23,820 --> 00:19:26,260
this encryption is just simple four bytes of key. And then with

295
00:19:26,260 --> 00:19:30,200
some, uh, uh, algorithms, yep, uh, this, uh, uh, encryption

296
00:19:30,200 --> 00:19:34,200
key, in fact, is provided by the compromised host. Any host

297
00:19:34,200 --> 00:19:37,960
can, uh, the infected host will be provided this XOR key to

298
00:19:37,960 --> 00:19:40,780
WannaCry. WannaCry will use that and then encrypt the payload

299
00:19:40,780 --> 00:19:45,440
and to the compromised host. Yeah. Uh, so, in this case, uh,

300
00:19:45,580 --> 00:19:46,940
I will say that. Let's try to have, let's try to have, uh,

301
00:19:46,960 --> 00:19:49,620
have our honeypot provide this key to, uh, to WannaCry.

302
00:19:50,040 --> 00:19:53,620
WannaCry take it, encrypt. We have it. We decrypt. Yeah. So,

303
00:19:53,720 --> 00:19:57,140
this is, uh, uh, the idea behind the scene. And, uh, and

304
00:19:57,140 --> 00:20:01,780
this key is, uh, uh, embedded in this particular SMB trans2

305
00:20:01,780 --> 00:20:05,980
response, which is, uh, the, the one square in the red in the

306
00:20:05,980 --> 00:20:09,680
signature boson. Yeah. So, right now, we have, uh, double

307
00:20:09,680 --> 00:20:12,820
POSAR backdoor. We have, uh, the encryptions, decryptions.

308
00:20:13,160 --> 00:20:15,900
Here we go. This is the beautiful payload that we have,

309
00:20:15,960 --> 00:20:16,940
uh, in our honeypot.

310
00:20:16,960 --> 00:20:21,620
So, uh, in the payload itself, uh, that contain a few PE file,

311
00:20:21,720 --> 00:20:25,560
PE header itself. And then, uh, you have couple of, uh, I think

312
00:20:25,560 --> 00:20:29,200
three of, two or three, three or four PE headers inside the

313
00:20:29,200 --> 00:20:31,760
payload. This is, uh, exactly match with the WannaCry, uh,

314
00:20:31,960 --> 00:20:34,720
behavior, which is the WannaCry embedded, uh, his, uh,

315
00:20:34,760 --> 00:20:38,920
resources, uh, his EXE in the resource, uh, of the, uh, PE

316
00:20:38,920 --> 00:20:42,600
header itself. Then, uh, we saw that there are a few, uh,

317
00:20:43,080 --> 00:20:46,940
additional code prepended in, uh, in front of the, uh, the

318
00:20:46,960 --> 00:20:50,660
first, uh, PE file. Yeah, I mean, uh, what we do is just, uh,

319
00:20:50,680 --> 00:20:54,280
try to strip it off. Yeah. Now, we have the clean binary. Yep.

320
00:20:55,420 --> 00:20:57,620
So, let me show you. This is one of the very beautiful

321
00:20:57,620 --> 00:21:00,600
interactions between my honeypot and, uh, WannaCry

322
00:21:00,600 --> 00:21:04,140
ransomware. So, this is how they talk to each others, how

323
00:21:04,140 --> 00:21:06,620
they flirt around to each others. And WannaCry will start

324
00:21:06,620 --> 00:21:10,060
to laying eggs and try to see, uh, pushing all the eggs to my

325
00:21:10,060 --> 00:21:13,200
honeypot. We have the payload. We start to decrypt the payloads

326
00:21:13,200 --> 00:21:16,340
with the four white keys that we, we send to them. And then, uh,

327
00:21:16,960 --> 00:21:20,380
after that, we, we will try to find out the PE headers, remove

328
00:21:20,380 --> 00:21:23,700
the, those code that prepended, uh, in the PE headers. Boom.

329
00:21:23,780 --> 00:21:26,220
Yep. We have those kind of clean payloads in our pockets.

330
00:21:26,620 --> 00:21:31,480
Yeah. So, this is how, uh, how it works. Yeah. So, um,

331
00:21:31,620 --> 00:21:34,860
definitely at the same time, which is in the May, we know

332
00:21:34,860 --> 00:21:37,160
that, uh, Windows is vulnerable with, uh, WannaCry

333
00:21:37,160 --> 00:21:40,740
ransomware. But for Linux machines, the same thing. They

334
00:21:40,740 --> 00:21:43,480
have, uh, so-called, uh, SambaCry, uh, uh, vulnerability.

335
00:21:44,100 --> 00:21:46,840
Uh, this, uh, vulnerability is pretty interesting, which is, for

336
00:21:46,840 --> 00:21:49,160
example, let's see. We're able to find, uh, one, uh, SMB

337
00:21:49,160 --> 00:21:52,960
servers. And then there's, uh, in a, in a SMB servers, there,

338
00:21:53,060 --> 00:21:56,480
there's a, uh, there's a writable folders. We can put

339
00:21:56,480 --> 00:21:59,940
our binary into it. Yeah. And then, uh, by, uh, uploading

340
00:21:59,940 --> 00:22:02,460
that, uh, the binary that, that we have into the writable

341
00:22:02,460 --> 00:22:05,340
folders. And then we can do some tricks just to get it to be

342
00:22:05,340 --> 00:22:08,640
executed. Yeah. So, this is one of the wonderful wormable

343
00:22:08,640 --> 00:22:11,200
vulnerability. You can, anyone can just create a worm and scan

344
00:22:11,200 --> 00:22:14,220
the whole internet. Pop into a lot of shell, uh, uh, as much

345
00:22:14,220 --> 00:22:16,820
as possible. Yeah. So, uh, uh, uh, uh, uh, uh, uh, uh, uh, uh, uh,

346
00:22:16,820 --> 00:22:19,900
I mean, uh, Metasploit came out with one of the very interesting

347
00:22:19,900 --> 00:22:23,300
module. Uh, uh, uh, this, uh, is known pipe name. It's pretty

348
00:22:23,300 --> 00:22:27,960
stable. So, for me, again, as a honeypot hobbyist, uh, I love

349
00:22:27,960 --> 00:22:33,060
to, to turn my honeypot into SMB, SMB, uh, server with a

350
00:22:33,060 --> 00:22:36,100
writable shareholders. Yeah. And then, uh, Dionea will be

351
00:22:36,100 --> 00:22:39,040
happy to receive all the payloads that, all the eggs that

352
00:22:39,040 --> 00:22:42,400
coming from around the world. So, yep, uh, I'm trying to

353
00:22:42,400 --> 00:22:46,420
implement these holdings into Dionea. So, Dionea Honeypot can

354
00:22:46,420 --> 00:22:46,800
be a win-win.

355
00:22:46,820 --> 00:22:49,440
It can be Windows, uh, kind of Windows 7 machines, or it can

356
00:22:49,440 --> 00:22:55,200
be another so-called Samba server. So, yep. Oh, I was told

357
00:22:55,200 --> 00:22:59,420
that, uh, uh, I need to put a cat's photos on my, because this

358
00:22:59,420 --> 00:23:01,580
will get, uh, everyone high. Oh, no, no, no. I get, uh,

359
00:23:01,600 --> 00:23:07,480
everyone excited. Yeah. Oh, all right. Right now, we have our

360
00:23:07,480 --> 00:23:10,560
honeypot design. So, we try to push it to the internet. So,

361
00:23:10,600 --> 00:23:13,400
let's see what we are going to have. Yeah. Oh, another one.

362
00:23:13,520 --> 00:23:16,800
Yeah. So, if later we manage to, uh, uh, uh, uh, uh, uh, uh,

363
00:23:16,800 --> 00:23:19,220
we met up with each other, uh, so let's try to catch up over

364
00:23:19,220 --> 00:23:21,840
a beer if you are interested about the honeypot, SMP

365
00:23:21,840 --> 00:23:24,340
honeypots, and how if you're running some honeypots, I'd love

366
00:23:24,340 --> 00:23:28,040
to heard about this idea, definitely. So, let's see. Let's

367
00:23:28,040 --> 00:23:30,680
see what I've, I'm going to empty out all my pockets. I'm

368
00:23:30,680 --> 00:23:34,540
going to share with you what I've seen for the past, uh, few

369
00:23:34,540 --> 00:23:38,160
months, or especially during the fort-, 15 days during the hot,

370
00:23:38,200 --> 00:23:41,400
uh, so-called golden age while, uh, WannaCry ransomware

371
00:23:41,400 --> 00:23:45,100
outbreak. So, here we go. What happened to my honeypot?

372
00:23:46,800 --> 00:23:50,300
I've run honeypot for quite some times. Uh, but just a

373
00:23:50,300 --> 00:23:53,380
disclaimer, uh, I know, I understand a lot of security

374
00:23:53,380 --> 00:23:56,840
company or the national certain you run, you have a lot of

375
00:23:56,840 --> 00:24:00,700
honeypot and you have a lot of IP space, uh, to play with. Maybe

376
00:24:00,700 --> 00:24:03,120
you have a few thousand of honeypot deployed around your

377
00:24:03,120 --> 00:24:06,100
country or around, around the world, try to understand what's,

378
00:24:06,120 --> 00:24:09,020
uh, the internet track itself. But for me, I only have one

379
00:24:09,020 --> 00:24:12,540
honeypot in my room. Yeah. I promise, I promise, I promise. I

380
00:24:12,540 --> 00:24:16,700
going to show you my photo later. Yeah. So, I only have one

381
00:24:16,800 --> 00:24:19,540
honeypot just for personal basis, personal learn, learning

382
00:24:19,540 --> 00:24:23,400
experience. Yeah. And then, uh, I realized that, uh, I'm trying

383
00:24:23,400 --> 00:24:27,800
to, uh, I realized from this graph is that, uh, from January to

384
00:24:27,800 --> 00:24:31,700
May, from time to time, I was seeing conflictors still talk to

385
00:24:31,700 --> 00:24:34,980
me, talk to my honeypot after so many years. But interestingly,

386
00:24:35,140 --> 00:24:39,020
when, uh, during the May, middle of May, uh, there's a loss of

387
00:24:39,020 --> 00:24:42,000
incoming connection to my room. Yeah. Uh, those, uh, in the

388
00:24:42,000 --> 00:24:46,780
daily basis could be around 200. And then out of 200, 40 of them

389
00:24:46,800 --> 00:24:50,440
will try to lay the eggs inside my honeypot, which is, uh, yeah,

390
00:24:50,540 --> 00:24:53,280
I mean, we are going to try to take a look on this. Yeah. And

391
00:24:53,280 --> 00:24:56,400
then, uh, here we go. I'd love to share with you about my gold

392
00:24:56,400 --> 00:24:59,420
mine that I have in my honeypot. Yeah, this is just a

393
00:24:59,420 --> 00:25:03,420
brief one. Um, from whatever in the screenshot, it's just, uh,

394
00:25:03,480 --> 00:25:08,080
four days of my collections from May 27 to May 30th. You can see

395
00:25:08,080 --> 00:25:11,960
from the, uh, pick, collect MD5, the exact binary itself. And then

396
00:25:11,960 --> 00:25:15,960
also, uh, the timestamp when these binaries start to drop into

397
00:25:16,800 --> 00:25:20,740
May. And then also the file size. Yep. By looking at this list,

398
00:25:20,860 --> 00:25:25,340
a very short list, you can see there's patterns in terms of the

399
00:25:25,340 --> 00:25:30,460
file size. Yep. I give you five seconds. One, two, three, four,

400
00:25:30,580 --> 00:25:35,460
five. Okay. Yeah. The pattern itself, there's always a 5.1 MB

401
00:25:35,460 --> 00:25:38,920
of files if you take a closer look. Yep. There's always a 5.1

402
00:25:38,920 --> 00:25:43,440
MB of files. Uh, my purpose is very simple. I just would like to

403
00:25:43,440 --> 00:25:46,360
have WannaCry. I just would like to talk to WannaCry. I just would

404
00:25:46,360 --> 00:25:50,480
like to flirt around together with a WannaCry. But, uh,

405
00:25:50,740 --> 00:25:53,540
interestingly and unexpectedly, there's a lot of uninvited guests,

406
00:25:53,680 --> 00:25:57,900
which is a very small file, big file, very small little, a few

407
00:25:58,420 --> 00:26:01,280
bytes of files. You see, like, there are some eight bytes of

408
00:26:01,280 --> 00:26:04,560
files into my honeypots. So, what the hell is that? I have no

409
00:26:04,560 --> 00:26:08,000
idea. I just want to WannaCry. But why you come into my

410
00:26:08,000 --> 00:26:12,600
honeypots? Yeah. So, let's try to take a look on just a few

411
00:26:12,600 --> 00:26:16,340
categories of what I have in my pocket. So, I'm going to talk a

412
00:26:16,360 --> 00:26:18,740
little bit about the file size. So, I try to explore. Those are

413
00:26:18,740 --> 00:26:22,440
definitely about a 5.1 MB of files. And then we will try to

414
00:26:22,440 --> 00:26:26,960
explore some of the 70 KB, 83 KB, uh, also the very small tiny

415
00:26:26,960 --> 00:26:31,220
file, which is four bytes or even 400 bytes of, uh, file. The

416
00:26:31,220 --> 00:26:34,020
file size is the, the differences between the file size is too

417
00:26:34,020 --> 00:26:39,160
significant. 5 MB and eight bytes. What the hell? Yeah. So,

418
00:26:39,160 --> 00:26:45,860
yep. Uh, in, during May and, uh, June and two days ago, I'm

419
00:26:45,860 --> 00:26:49,700
still seeing a lot of 5.1 MB of files in my honeypots. Yeah. I

420
00:26:49,700 --> 00:26:52,280
believe right now I have a, I think I have a gigabytes of

421
00:26:52,280 --> 00:26:57,460
collections of, uh, WannaCry . Well, I mean, uh, all

422
00:26:57,460 --> 00:27:00,180
these are 5.1 MB of files. I just make a simple strings on it.

423
00:27:00,260 --> 00:27:02,440
And then we will know that, uh, this is the kill switch domain.

424
00:27:02,740 --> 00:27:09,140
Yeah. So, I just make a very tough and very, very, very rough assumptions. I assume all of 5.1 MB of

425
00:27:09,160 --> 00:27:14,880
files, they are WannaCry ransomware. Yep. So, let's ignore it. So, we don't talk about

426
00:27:14,880 --> 00:27:20,260
WannaCry right now. Let's try to see what I have, uh, in the honeypot itself. So, 25th of May, I

427
00:27:20,260 --> 00:27:24,200
think this particular small file, which is, uh, 83 KB as well, try to make a simple, uh,

428
00:27:24,240 --> 00:27:28,340
analysis. And then it will try to call to this particular domains and download secondary

429
00:27:28,340 --> 00:27:34,120
files, which is, uh, two five zero zero one dot exe. Yep. Uh, this file, uh, just make a

430
00:27:34,120 --> 00:27:39,020
simple query in a, uh, various total. I understand that, hey, this, this guy, he just, uh,

431
00:27:39,020 --> 00:27:44,740
did also. Yeah, it's, uh, Windows, uh, versions of Bill Gates born net. So, this born net is in

432
00:27:44,740 --> 00:27:51,020
my honeypot. Uh, I would say that every party will have a did also, definitely. Yep. So, three

433
00:27:51,020 --> 00:27:55,520
days afterwards, I think, uh, another file, which is a 70 KBs of file dropped on my honeypot.

434
00:27:55,940 --> 00:28:00,540
And then, when I, while I try to analyze with that, uh, they will, uh, they will connect to the

435
00:28:00,540 --> 00:28:04,860
secondary domains, uh, try to download this secondary payload. So, in this payload, while I

436
00:28:04,860 --> 00:28:09,000
try to execute this of three four five dot exe, I realized that, uh, the file was not

437
00:28:09,000 --> 00:28:15,680
dropped, uh, six or seven, uh, batch file, VBS file, exe files, uh, into my, uh, into the

438
00:28:15,680 --> 00:28:21,220
machine itself. So, let's take a quick look on what is the batch file, BAT file, or the exe

439
00:28:21,220 --> 00:28:27,100
file. So, the batch file will just perform two simple tasks. The first one, when it has got

440
00:28:27,100 --> 00:28:31,820
executors on the machines, it will enable the firewall rules, uh, firewall service, definitely,

441
00:28:31,920 --> 00:28:37,180
on the machines. And then, it will plug two different simple firewall rules inside the

442
00:28:37,180 --> 00:28:38,980
firewall. And then, it will click on the firewall. And then, it will click on the firewall

443
00:28:39,000 --> 00:28:43,600
and it will try to block any incoming connections, any, to the port four four five or one three

444
00:28:43,600 --> 00:28:49,660
nine. Um, these simple actions claim that it means that, uh, this batch file will try to claim the

445
00:28:49,660 --> 00:28:55,520
ownership of that, uh, host itself. So, this is my machine right now. I won't allow anyone else to

446
00:28:55,520 --> 00:29:00,120
connect to the same machines. I want this machine. This is mine. So, what it will do, the next

447
00:29:00,120 --> 00:29:04,080
thing, it will execute it, uh, the VBS file, which is, uh, there's a stratum, uh, protocol

448
00:29:04,080 --> 00:29:08,980
inside that. Uh, you know that it is a so-called Bitcoin miner, yeah. So, uh, this is the

449
00:29:08,980 --> 00:29:12,320
VBS file. So, I claim the machines. This is mine. I'm going to mine Bitcoin with these

450
00:29:12,320 --> 00:29:17,160
machines, yeah. So, I mean, so, I mean, I would say, again, every party will have a

451
00:29:17,160 --> 00:29:22,960
Bitcoin miner right now. So, at the same day, May 22, there's another interesting behavior

452
00:29:22,960 --> 00:29:29,820
happened to my honeypot. I think two files, two eggs delivered, two presents, or two gifts

453
00:29:29,820 --> 00:29:34,540
that drop into the honeypot at the same time. And then, uh, this, this file itself, uh,

454
00:29:34,600 --> 00:29:38,860
is just pretty small. Uh, eight bytes of files and, uh, four hundred and seventy, seventy

455
00:29:38,860 --> 00:29:46,440
six bytes of files. When I first, uh, look at this particular, uh, this, uh, file size, I'm

456
00:29:46,440 --> 00:29:51,020
so excited because I know that, oh, well, this is likely the summer cry attacks. So, I got a

457
00:29:51,020 --> 00:29:55,560
summer cry first pawn into my honeypot. Um, I also understand that, uh, this vulnerability

458
00:29:55,560 --> 00:30:00,940
was, uh, released on 24th of May. And then Metasploit started to release their first proof

459
00:30:00,940 --> 00:30:07,880
of concept on 26th of May. But my honeypot received this, uh, special guest, uh, on 28th of

460
00:30:07,880 --> 00:30:13,780
May. So, I believe that lots of people are trying to act very fast, uh, to try to claim, try to

461
00:30:13,780 --> 00:30:19,880
get a lot of, uh, shell access, all the SMB servers, uh, in the world, if, uh, those

462
00:30:19,880 --> 00:30:25,760
servers is not patched. Yeah. So, let's see what we have in this, uh, eight bytes and four

463
00:30:25,760 --> 00:30:30,900
hundred and seventy six bytes of files. Yep. Uh, but just look at a simple, uh, payload,

464
00:30:31,000 --> 00:30:37,140
so what the, the content of this file itself, uh, is exactly match with how summer cry work.

465
00:30:37,880 --> 00:30:43,560
So, the attackers will definitely, he or she, have to test if the, if the folder itself is

466
00:30:43,560 --> 00:30:48,320
writable. So, in this case, he write, it bytes of files, random characters into my honeypot. So,

467
00:30:48,400 --> 00:30:53,280
right now, he's, uh, understand that, oh, well, these, uh, folder is writable. Yep. And then,

468
00:30:53,400 --> 00:30:59,320
uh, he start to deliver this, uh, ELF, so-called, uh, L-file to me. Uh, just a simple, uh, hex

469
00:30:59,320 --> 00:31:02,760
dump. Understand that, uh, those are highlighted in the red color. It's a slash bin, slash

470
00:31:02,760 --> 00:31:07,860
SSH. Uh, I mean, this is a shell, definitely. Yep. So, uh, the, the, the, the, the, the, the, the, the,

471
00:31:07,860 --> 00:31:11,760
the, the, the, the, the, the, the, the, the, so, what we have explore, want to cry, DDoSer,

472
00:31:12,560 --> 00:31:18,620
Bitcoin miner, we have summer cry, so what else? I have, uh, two more hours to go. So, after two

473
00:31:18,620 --> 00:31:24,640
days, another two days, May 30th, there's another file called 5.1 MB of, very small file, uh,

474
00:31:24,860 --> 00:31:29,860
uh, into the honeypot. But looking at the hex dumps, I understand that, uh, this is, there's

475
00:31:29,860 --> 00:31:34,700
IP address inside at the bottom. In the middle, there's, uh, random strings. But looking at,

476
00:31:34,780 --> 00:31:37,840
uh, by just purely looking at a, hex dumps, I understand, uh, that it's, there's IP address

477
00:31:37,860 --> 00:31:43,400
that this is slightly the Metasploit HTTP reversal. How it

478
00:31:43,400 --> 00:31:46,940
works is if this payload got executed, it will send a HTTP

479
00:31:46,940 --> 00:31:52,020
request with a URI HTTP double colon slash slash, the IP

480
00:31:52,020 --> 00:31:57,140
address and that random strings. I would say, well, welcome to my

481
00:31:57,140 --> 00:32:01,300
honeypot. Yeah. So this is the last one I'm going to share

482
00:32:01,300 --> 00:32:07,520
today. May 30th, I saw another file, this file, 39 KB of small

483
00:32:07,520 --> 00:32:12,100
file going to my honeypot. When I have it executed, it is, it

484
00:32:12,100 --> 00:32:15,740
will try to download the file called mat.exe. This happened on

485
00:32:15,740 --> 00:32:21,900
May 30th. But in June 5, June, 5th of June, I see the same file

486
00:32:21,900 --> 00:32:27,520
again. So I'm trying to grab the secondary payloads from the

487
00:32:27,520 --> 00:32:31,400
external host, the mat.exe, but I realize that, hey, the mp5 is

488
00:32:31,400 --> 00:32:34,120
different, which is somewhere in the back. Definitely they

489
00:32:34,120 --> 00:32:37,500
changed their payload and because of, definitely they

490
00:32:37,500 --> 00:32:41,700
claimed after five, after a few days, could be AV pick it up. So

491
00:32:41,700 --> 00:32:45,700
they try to get a new binary into, into their back end. So

492
00:32:45,700 --> 00:32:49,880
of my curiosity, I just try to shop around in their back end.

493
00:32:50,260 --> 00:32:54,900
Yeah. That's what I see. This back end is just a simple HFS,

494
00:32:55,060 --> 00:32:58,000
which is a HTTP file server. This file server is pretty

495
00:32:58,000 --> 00:33:05,420
commonly used in Asia. Yeah. And then for the mat.exe, in the,

496
00:33:05,440 --> 00:33:07,480
back in May 30th, this is the first time I've seen this kind of

497
00:33:07,500 --> 00:33:13,100
thing. This file was uploaded to the HFS on 25th of May. Within

498
00:33:13,100 --> 00:33:19,920
five days' duration, this guy got downloaded by 988 times. I

499
00:33:19,920 --> 00:33:22,860
believe could be some of the security researchers, just like

500
00:33:22,860 --> 00:33:27,740
me, very curious, write a wget or curl, download it for 900

501
00:33:27,740 --> 00:33:35,480
times. Who knows? Yeah. So I, June 5th, I see the same back end.

502
00:33:35,700 --> 00:33:37,480
Try to explore about the same back end. And then I see the

503
00:33:37,500 --> 00:33:40,300
same back end. And then I realize that this binary is newly

504
00:33:40,300 --> 00:33:43,840
uploaded to the back end on the 2nd of June. Within three days,

505
00:33:43,960 --> 00:33:48,580
this binary was downloaded for 6,500 times. Again, I believe

506
00:33:48,580 --> 00:33:51,640
could be some of the security researchers, write a curl, and

507
00:33:51,640 --> 00:33:56,160
he forgot to close his loop. So it downloaded for 6,500 times,

508
00:33:56,420 --> 00:34:00,500
and he do a control C, okay, kill. Yeah. But I would rather

509
00:34:00,500 --> 00:34:04,160
believe that there are 6,500 holes has been infected with

510
00:34:04,160 --> 00:34:07,180
this Trojan Bitcoin miner, and they are mining the Bitcoin for

511
00:34:07,180 --> 00:34:13,260
him. Yeah. So I always shop around with, wherever I have a

512
00:34:13,260 --> 00:34:18,280
chance, with this URI, any URI that I can have for my honeypot.

513
00:34:18,460 --> 00:34:20,660
So from time to time, I was seeing some of the HS file,

514
00:34:20,860 --> 00:34:26,800
pretty similar, with 21,000s of download hits of some simple

515
00:34:26,800 --> 00:34:33,520
particular binary. And then, yep, shopping time. We have, we

516
00:34:33,520 --> 00:34:37,160
will see some of the SWFL files inside the back end as well. And

517
00:34:37,180 --> 00:34:41,820
just take a quick look on this, SW, movee.swf. I think it's

518
00:34:41,820 --> 00:34:45,680
related to the hacking team exploit, back in 2015. I think

519
00:34:45,680 --> 00:34:54,540
2015, five one one nine or something. Yep. So we have

520
00:34:54,540 --> 00:34:58,620
explored different categories of gold mines that I have which is

521
00:34:58,620 --> 00:35:02,540
from WannaCry, 5 or one NBR files, to a DDoSer, to a Bitcoin

522
00:35:02,540 --> 00:35:06,340
miner, to a, to a SummerCry, very small file, Metasploits,

523
00:35:06,340 --> 00:35:07,160
a reverse shell. And then I have, an upgrade to theens as well.

524
00:35:07,160 --> 00:35:11,720
And also, this kind of binary has been downloaded for 6,500 times.

525
00:35:12,420 --> 00:35:16,160
So, as I promised, I'm going to show you some of my photos that I have for my honeypot.

526
00:35:16,360 --> 00:35:17,540
So please let me go.

527
00:35:19,360 --> 00:35:24,720
That is what I have at home, which is just a Raspberry Pi with a Dioneer honeypot on it.

528
00:35:25,320 --> 00:35:25,720
Yep.

529
00:35:26,780 --> 00:35:28,200
But this is pretty bad.

530
00:35:28,600 --> 00:35:32,200
I don't recommend everyone play with this because you might spoil the pin

531
00:35:32,200 --> 00:35:34,880
and then have to buy another new Raspberry Pi again.

532
00:35:34,880 --> 00:35:38,540
So, I decided to go for the biased case for it.

533
00:35:38,740 --> 00:35:40,920
So, instead of one, I have three.

534
00:35:42,220 --> 00:35:45,720
I have three of these blinking lights in my room.

535
00:35:46,120 --> 00:35:47,100
So, this is daytime.

536
00:35:48,160 --> 00:35:49,040
This is nighttime.

537
00:35:49,480 --> 00:35:50,500
So, this is daytime.

538
00:35:50,740 --> 00:35:51,340
This is nighttime.

539
00:35:56,880 --> 00:36:02,640
Definitely, I strongly encourage everyone to set up your own honeypot.

540
00:36:02,860 --> 00:36:04,460
So, the first Git...

541
00:36:04,880 --> 00:36:07,540
GitHub link is my development link.

542
00:36:07,720 --> 00:36:12,140
But then, I would highly recommend everyone to go for Deno Tools 4.

543
00:36:13,120 --> 00:36:14,900
Feeble is maintaining a very...

544
00:36:14,900 --> 00:36:17,840
He paid a lot of effort in terms of maintaining Dioneer.

545
00:36:18,060 --> 00:36:23,740
Right now, previously back in a conflicted era, setting up Dioneer may take one hour with your luck.

546
00:36:24,020 --> 00:36:24,300
Yeah.

547
00:36:24,560 --> 00:36:27,560
But right now, setting up Dioneer honeypot is just very easy.

548
00:36:27,820 --> 00:36:32,380
Three to five minutes run on Ubuntu machines.

549
00:36:32,660 --> 00:36:32,900
Yeah.

550
00:36:32,900 --> 00:36:37,820
I would really highly recommend everyone to use Dino Tools 4.

551
00:36:38,300 --> 00:36:38,700
Yeah.

552
00:36:38,740 --> 00:36:43,540
And then, if you would like to set up some honeypot on a Raspberry Pi, go for HoneyPi Image.

553
00:36:43,780 --> 00:36:48,300
This is a good one, which is a compilation of lots of honeypot tools inside it.

554
00:36:49,000 --> 00:36:49,860
Get an SD card.

555
00:36:50,160 --> 00:36:50,880
Burn into that.

556
00:36:51,180 --> 00:36:51,820
Boot it up.

557
00:36:52,060 --> 00:36:52,260
Yep.

558
00:36:52,320 --> 00:36:54,700
You have the honeypot just as my picture.

559
00:36:56,920 --> 00:36:57,320
Yeah.

560
00:36:57,440 --> 00:37:02,820
I would say that, personally, I would say that playing with honeypot is a very exciting experience.

561
00:37:03,760 --> 00:37:06,480
Initially, I expect just one acquirement somewhere.

562
00:37:06,880 --> 00:37:13,040
But always the most awesome part is you expect the unexpected.

563
00:37:13,560 --> 00:37:20,820
In this case, we have seen lots of uninvited guests crashing a party, lay their eggs, deliver the payloads to us.

564
00:37:21,080 --> 00:37:23,580
I mean, definitely, I'm happy to receive all the payloads.

565
00:37:23,620 --> 00:37:23,740
Yeah.

566
00:37:23,880 --> 00:37:25,320
Just capture one by one.

567
00:37:25,420 --> 00:37:31,980
And then, let's try to analyze what happened over the Internet and how people adapt to the different vulnerability.

568
00:37:31,980 --> 00:37:33,060
And how they react.

569
00:37:33,400 --> 00:37:39,160
And how to pawn any shell as much as possible by the Internet mass scanning.

570
00:37:39,600 --> 00:37:39,700
Yeah.

571
00:37:40,300 --> 00:37:44,260
So, that's what I have for today for everyone about one acquirement somewhere.

572
00:37:44,660 --> 00:37:47,340
And, yeah, I think, thank you very much.

573
00:37:54,980 --> 00:37:58,940
Any questions I can help to share or any ideas?

574
00:38:00,280 --> 00:38:00,840
No.

575
00:38:00,900 --> 00:38:01,220
Yeah.

576
00:38:01,400 --> 00:38:01,960
Okay.

577
00:38:01,980 --> 00:38:02,000
Thank you.

578
00:38:02,140 --> 00:38:02,620
One question.

579
00:38:02,820 --> 00:38:05,020
So, .

580
00:38:05,960 --> 00:38:06,280
Yeah.

581
00:38:09,520 --> 00:38:10,160
.

582
00:38:12,340 --> 00:38:12,980
.

583
00:38:14,360 --> 00:38:15,000
.

584
00:38:18,140 --> 00:38:18,780
.

585
00:38:18,780 --> 00:38:19,000
.

586
00:38:19,000 --> 00:38:19,100
.

587
00:38:19,100 --> 00:38:20,140
.

588
00:38:24,440 --> 00:38:25,080
.

589
00:38:25,080 --> 00:38:25,100
.

590
00:38:25,100 --> 00:38:25,140
.

591
00:38:25,140 --> 00:38:25,440
.

592
00:38:25,440 --> 00:38:25,880
.

593
00:38:25,880 --> 00:38:26,200
.

594
00:38:31,980 --> 00:38:33,300
. .

595
00:38:33,300 --> 00:38:39,080
are all those eggs still inside the honeypot itself, or the pie itself, or we transfer it elsewhere?

596
00:38:39,440 --> 00:38:44,180
So for my personal practice, because back then, which is May,

597
00:38:44,740 --> 00:38:48,360
this is the golden age of the whole WannaCry ransomware,

598
00:38:48,520 --> 00:38:52,500
I almost log into my honeypot in an hourly or maybe in a daily basis,

599
00:38:52,740 --> 00:38:56,040
and then try to see what I have in my honeypot.

600
00:38:56,780 --> 00:39:00,160
I'm copying it out, the whole binary, just for backup purpose,

601
00:39:00,160 --> 00:39:04,260
because SD card is very fragile.

602
00:39:04,480 --> 00:39:11,740
If a small power failure, a couple of power failure, SD cards may corrupt.

603
00:39:12,120 --> 00:39:14,920
So it's always good to backup, definitely, about the binary,

604
00:39:15,020 --> 00:39:17,100
because those binary are the eggs that we have, yeah.

605
00:39:21,220 --> 00:39:27,000
Oh, you mean that the...

606
00:39:30,460 --> 00:39:33,240
You mean my Raspberry Pi honeypot picture?

607
00:39:33,360 --> 00:39:34,540
I just use my Samsung?

608
00:39:35,320 --> 00:39:37,180
No, no, I understand.

609
00:39:37,460 --> 00:39:42,020
So the question is, what is the software that used to generate the graph, right?

610
00:39:42,280 --> 00:39:43,100
That particular...

611
00:39:43,860 --> 00:39:44,960
Yeah, the static system.

612
00:39:45,560 --> 00:39:49,240
Inside Dionea, there's a built-in functions, there's a built-in script,

613
00:39:49,400 --> 00:39:53,400
so you can just run a command, query all the SQLite's data,

614
00:39:53,540 --> 00:39:55,900
then you can generate such a beautiful graphs, yeah.

615
00:39:56,080 --> 00:40:00,060
Even by separate by protocol, SMB, TFTP, any protocol,

616
00:40:00,160 --> 00:40:00,960
it's all, yeah.

617
00:40:04,400 --> 00:40:05,060
Thank you very much.

618
00:40:05,140 --> 00:40:06,620
I think, yeah, that's what I have.