About this final talk of the day, we, I think you submitted this as a CFP,
which may have been like a little late, like may have been right on the dot,
and I was like, and I think it was just right on the spot when all this crap was happening,
with the PHA, WannaCry, and, you know, when I saw this talk, I was like,
I talked to my, you know, the previous speaker was Eric, I was Eric,
I was like, Eric, he runs Honey Pot, and I was like, we've got to talk to this guy,
we've got to talk to this guy, and did you talk to Eric at all, the Honey Pot?
And the Honey Pot, you know, that's been a part of us, that's been part of our village,
and I was like, we've got to bring this in, I mean, we've got to bring this guy in,
and without much ado, he's going to talk about a very, very relevant issue.
Anyone doing policy here?
By any chance, anyone like non-tech or doing policy?
This will be a pretty good talk, especially for those,
it's a good indoctrination of why the cyber security problem is so bad.
And it is my pleasure to introduce you, Tan Kien Song.
Thanks, Wing. Thank you very much.
Can you guys hear me at the back, at the front? Should be fine, right?
Okay. Hey, everyone, my name is Kien Song.
You can call me Kien.
Yeah, thank you very much today, to be having me here today,
to share a few interesting stories about my 15 days of SMB Honey Pot.
I ran Honey Pot. I'm a Honey Pot hobbyist, definitely.
And I ran this Honey Pot during the WannaCry Ransomware time.
Initially, I just expect that, well, I may catch a lot of tons of WannaCry Ransomware,
but unexpectedly and interestingly, I found that, hey,
there are a lot of people who are interested in this,
and there are a lot of uninvited guests that try to talk to my Honey Pot,
try to crash a party, crawling into the Honey Pot,
lay the egg inside the Honey Pot itself.
So, for the next 40 minutes, I'm going to share with you about this,
what I have in my Honey Pot.
I'm going to empty out all my pockets, share with you about the payload itself,
and then, yeah, here we go.
So, I'm going to share with you only three things for these sessions.
The first things will be, let's try to explore together,
about our WannaCry Ransomware in brief, in terms of our network perspective.
And then the second one, I'm going to share with you about my design of the Honey Pot itself.
And then we will see how the so-called wonderful interactions
between the Honey Pot itself and the WannaCry Ransomware.
Yeah, and then later, for the third one,
we're going to see what happened to my Honey Pot after when I pushed it to the internet.
Yeah.
So, yep.
Uh, last but not least,
definitely, I will share with you some of the photos that I have for my Honey Pot itself.
Yeah, so please don't let me go if I don't share it to you.
Yeah.
Yeah, just a quick introduction about myself.
I'm from Malaysia.
I'm a Honey Pot hobbyist, and then I'm part of the HoneyNet project as well.
During my free time, I try to develop Honey Pot, deploy Honey Pot, and try to see what I can have from the internet.
Yeah.
So, I've been involved in some of the so-called open-source network Honey Pot itself.
For example, Dione Honey Pot, and then Garton Honey Pot as well.
And then two years back, we found that there's a challenge about how we can deploy Honey Pot in a Raspberry Pi,
which is those credit card-sized machines.
Yep.
And then Christopher Lake from the HoneyNet project, Singapore chapter.
Both of us, we start off with a project called HoneyPi, which is everyone can download that image itself.
And then just burn it into an SD card, boot it in the Raspberry Pi, boom, you've got a Honey Pot set up.
That's it.
So, I mean, it'll be much easier to set up a Honey Pot within like 15 minutes with this Raspberry Pi.
So, this is the HoneyPi project.
Yeah.
And then during my free time, I've been involved in a Hang in a Box conference, HITB.
So, for this coming August, we'll have one HITB conference in Singapore.
So, feel free to join us if you are in a town.
Yeah.
And me too, also I'm part of this Capture the Flag team for Hang in a Box.
So, a few of us, we just set up the game itself for Hang in a Box conference for the past few years.
I would say this is always one of the exciting experiences because of people, they try to solve the challenge,
they will try to get access into your scoreboards, definitely.
Oh, well, this is one of the most scary and one of the most exciting screens you'll have.
Back in May 2017, I would say that if you have that on your screen, it could be potentially means that, oh, shit, shit happened,
which is you may get infected with a WannaCry somewhere.
But I know some of the very smart-ass dude, which is they put this on their screen,
and then when some guy just walk over and say that, hey, man, you got infected with a WannaCry,
then he will just reply, hey, dude, just relax, this is just a screensaver, no worry.
I heard about this story, yeah, seriously.
Personally, I would say that that's good and bad about the WannaCry ransomware attack.
The bad thing that's definitely is about is going to disrupt a lot of operations.
For example, I heard that there are some car manufacturing company have to shut down the whole
entire production line because of the WannaCry ransomware attacks, definitely.
And then let me share this story.
During the WannaCry ransomware outbreak time, I was in the Uber drive, yeah.
And then we have a good conversation between the driver itself, and then he's a 60-year-old
retirement, rich guy, definitely, yeah.
Then we have a chit-chat, and then he asked me, he say, hey, Kian, what are you doing for a living?
Then I told him that I'm with IT industry, but the next questions that he asked me is really amazed and surprised me the most.
He asked me, hey, Kian, I mean he's a 60 years old retirement, he asked me, hey, Kian, have you heard about WannaCry ransomware?
Is WannaCry ransomware going to affect my iPhone?
I will say good and bad, which is the, the good thing is WannaCry insanity in fact created
a loss of security awareness of, for us, as well as a loss of non-IT industry that's very people.
For him, definitely he concern about his iPhone because he's using his iPhone, the IP address.
for his living. If his wound got infected, I think his ride will be in
trouble. So let's try to dive in. Just to simply, let's try to explore
together about how WannaCry works in terms of network perspective. Just a
brief one. So let's see. Personally, I love to simplify stuff, which is I love
to simplify complicated concepts into just a simple concept, simple ideas. So
personally, I love to simplify at just three simple phases. So the first one
will be scanning, which is WannaCry will try to scan the targeted host. And then
after that, they will move on to the second phase, which is so-called
exploitation phase. And then the third one will be delivering the payload
itself. So for the scanning phase, you will try to check if the host or the
targeted host is patched or not. And then the second thing you will check is
if the double POSA backdoor is installed on it.
Yeah. So and then it will move on to the second phase, which is the
exploitation phase. The exploitation phase will be go with this eternal
pool exploit. And then upon the success of the exploitations, they will install
the double POSA into it. Yeah. Here's the very simple two steps, which is the
first one will be the scanning, move on to the exploitations. And then the third
one will be, yep, definitely WannaCry will definitely happily deliver the
payloads to the compromised host.
Yeah. So this is just a very brief one about three simple steps. So let's try to take a look in
terms of the network perspective. I'm going to show a few screenshots, which is just about
WannaCry in terms of the network pick-up capture perspective. So let's see. In the initial phase,
which is WannaCry will try to check if the system is patched or not, or if the system is
vulnerable to the MS-17017 vulnerability. So it will go through by one simple request, which is
a name pipe request with a file id equal to zero. As a normal Windows 7 or the clean
installations of the Windows 7 machines, it will reply back with trans response, which is the one
highlighted in blue color. Yeah. And then it will continue the error message called status,
insufficient server resources. All right? Then by looking at that, WannaCry will make a second
check. The check will be tried to check for, if the double POSA backdoor is installed on the machine.
And this check is interesting. I mean, I mean, it catch my eye
when I first try to analyze, try to understand about how these
things work. So, the checking will be done through by
trans2 request and a multiplex ID equal to 65, which is
highlighted in the gray color. Yep. And then even normal clean
machines, it will come back with a response called trans2
response, session set up, multiplex ID equal to 65.
Request, 65. Respond, 65. Yep. So, in this case, I want to
understand that. Well, this machine is not infected, it's
not patched, it's not installed with a double POSA. So, what it
will do, it will try to go to the second phase, which is the
exploitations. Yep. This is how eternal blue looks like in
terms of a network perspective. So, it's just a long, I would
say very long, quite long, base 64 encoder stream. So, this is
how eternal blue looks like in terms of the strings. Yep. I
mean, there are some, we can try to decode and try to understand
that. But upon the success of the installations of the eternal
blue, it will, yeah, it will install double POSA into it.
Yeah. So, right now, we have complete the initial phase,
which is the, which is the scanning. And then the second
phase is the exploitations. And then, here we go. Final check.
You'll check whether, if the double POSA installed nicely on
the compromisers. So, this is how eternal blue looks like in
terms of the host. The checking is pretty simple. Same trick,
same old trick, which is using the, the trans2 request, the
multiplex ID equal to 65. Yeah, we have seen it before. But
surprisingly, the, the response that came back is a trans2
response with a multiplex ID equal to 81. So, let's see. 65,
65. This is the original request. If the machine is not
infected by one, by double POSA. But what if, if the
machine is, is infected with a double POSA, the machine is
installed with double POSA. The request, the multiplex ID
will be 65. The response will be 81. Let's see. 65, 81. The
difference is 16, which is, 16 is equivalent to hex value 0x10.
So, by looking at the, this particular differences in, in
terms of the multiplex ID, yeah, I want to kind of understand
that. Well, this machine is installed with the double POSA
successfully. So, double POSA will start to perform so-called
payload delivery. I have the payloads. You are my target
host. You just eat it. Yeah, pum-pum-pum. You just eat all
the, send all the payloads to the compromised host. Yeah. And
then, if the payloads got, um, executed on the host itself,
the first things the payload, it will do, it will try to
perform a DNS resolution to this, uh, very long strings
random domain. I think a lot of us will be very familiar with
this. This is so-called a kill switch domain that we have for,
uh, the one acquiring somewhere. I will say that, uh, this is the,
uh, design floor of the one acquiring somewhere itself. Uh,
so, when one acquiring somewhere payload got executed, the first
thing, if he failed to resolve this particular domain itself,
it will start to perform encryptions on the disk, which
is to try to lock the, uh, lock the disk itself. But the catch
is, this domain is not exist in the world. It's just random
come out from someone or some sandbox stuff. But, and then,
so, no, no matter how one of try to resolve this domain itself,
they will not have any resolutions back. There's no
IP address that should be matched with this domain
initially. So, uh, I think props to the 22 years old, young,
very, uh, brilliant, uh, British, uh, researchers. He, he
said, uh, let me try to register this domain. I'm going to own
this domain. So, in this case, any attempts to, for this, uh,
DNS, uh, resolutions, it will come back to the IP address.
Boom. Then, I mean, thanks to his, uh, his, uh, this act,
definitely, I mean, he, uh, slowed down the whole, uh, one
acquiring somewhere outbreak around the whole world. I mean,
this is a very, uh, very good trick. So, definitely, try to,
try to stop the entire, uh, so-called operation itself. So,
right now, let's look back on the, uh, the, on the attack
life cycle. We have completed, uh, the initial phase and then
the exploitation phase and the payload phase. So, right now,
everyone here is a WannaCry expert. Yeah.
So, as a Honeypot, uh, researcher, back in this, uh, May 2017,
I noticed that, uh, our, uh, the security industry facing a, uh,
very big challenge. The challenge, uh, itself is how can
we collect or how can we download all the WannaCry
payloads as much as possible, as easy as possible? Yeah, I mean,
this is one of the very big challenges we, uh, we have
encountered during, uh, May, uh, back in, uh, uh, two months
back. So, I'm trying to take a look on this, uh, attack life
cycle itself. Yep. And then I found a very pretty interest
thing behavior of the, uh, WannaCry ransomware. I'm, uh, I'm
trying to simplify, again, I, uh, I love to, I, I love to
simplify, uh, complicated idea into a simplified, uh, more
simple idea. So, so, I found that, uh, we can simplify this,
uh, five simple steps into, uh, into just three steps. So, let's
see. WannaCry talk to me, start to talk to me. He say, hey,
Kian, are you, are you patched with the patches? Then I will
respond to him. I say, no, I'm not patched. I'm vulnerable to
this, uh, vulnerability. And then, uh, WannaCry will, will
send me a second request. Are you installed with a double
poser? And I'll respond back. Hey, man, I'm infected with a
double, with a double poser. Yeah. And I, I, I noticed that
WannaCry will not proceed with the exploitation phase or he
will not proceed with the installations of a new
WannaCry, uh, of the new, uh, double poser. But what he will
do, he will just happily deliver the payload to me. So,
right now, I have the payload. Yeah. In this case, by
simplifying this, uh, five steps into three steps, I'm
doing three steps. So, well, while I, uh, discovered this,
uh, behavior, then now I have, uh, I have a thought. Let's try
to implement the whole thing into the honeypot and then let's
see what we will have. Yeah. So, the honeypot that I chose
with, uh, is a Dionea honeypot. Yeah. Uh, Dionea, this, this
particular name, I always misspell with it, which is a D-I-O-N-A-E-A.
When you type, uh, I think I have a fat tingles, which is a
D-I-O-N-A-N-A, D-I-O-N-N-N-N-N-A. But not only, uh,
it's a, this is a very easy to remember name, Dionea honeypot,
which is, uh, equivalent to this particular weird shaped plant in
here. So, right now, I think everyone is a WannaCry expert,
and, uh, everyone is a Dionea, uh, Dionea expert, right?
So, Dionea honeypot, uh, the most powerful, uh, features of
this, uh, Dionea honeypot is about the capability of doing
the network, uh, emulations. Um, a bit, uh, story about
Dionea honeypot, uh, it was developed back in the
Conflictor era, which is, uh, uh, the age of the
Conflictor, which is back in the 2008 or 2009, yeah, back
then. And, uh, but, uh, again, this tool proven to be very
useful after six or seven, uh, seven or nine year, eight, uh,
eight years right now. Uh, this whole, uh, this is a Dionea
honeypot, uh, capable of, uh, supporting a lot of protocol,
mainly will be on SMB protocol, HTTP, uh, FTP, TFTP,
uh, SQL protocol as well, and then also the VOIP, uh, voice
over IP, SIP, yeah. And then, uh, two years back, uh, we
started to implement, uh, uh, the IOT protocol, which is, uh,
UPMP, and, uh, MQTT, uh, into it. So, two months ago, with
that ideas that we have, that, that simplified ideas, then I'm
implode, uh, I'm trying to, uh, implement entire ideas that
I have inside the honeypot itself. So, what I did is, uh,
I turned Dionea honeypot into a Windows 7 machines, and then,
uh, it is infected with a double POSAR backdoor. Yeah, so
this is the core idea of the entire, uh, Dionea honeypot.
Uh, uh, honeypot itself. So, right now, Dionea honeypot is
able to speak in the double POSAR language. Yeah. So, he, he
can interpret, he can understand about how double POSAR work.
So, for example, about, uh, about the command itself,
external host try to talk to my double POSAR, and it, it will
send a first command called ping. I ping you, and double
POSAR will respond back. Hey, I'm here. Yep. And then, uh, it,
uh, it will send a second request, which is the execute
request. And then, uh, it will send a second request, which is
this request. Uh, that, uh, Dionea honeypot will understand
that, well, this guy is going to send a payload to me. So, yep.
And then the, there's a very interesting command, which is,
uh, you don't see it elsewhere. Maybe a lot of people are not
aware about that, this particular double POSAR. That's a kill
command, which is, like, we can kill double POSAR backdoor. So,
during the design of the honeypot itself, a, uh, a couple of
friends will just sit down, and then catch up for, uh, for a
beer, and then we have a talk. Why not we just create an
internet scanner, scan the whole internet, find any machines
with, uh, double POSAR backdoor. We send the kill command to the
double POSAR backdoor. Are we going to kill all the double
POSAR infected machines in the world? Are we going to stop the
whole entire WannaCry outbreak? Uh, I mean, besides about, uh,
that kill switch domain. I mean, we have this kind of
thought. Why not we just create a scanner, zoom scan the whole
internet. After a day, we got everything done. But the problem
is, uh, it doesn't solve the fundamental questions, which is
the security patches.
On the Windows machine itself. So, even be able to kill, kill
the double POSAR, it doesn't make sense, which is, uh, the
infections will be still come back. Yeah, so, let's try to
focus on the, uh, interesting stuff. So, right now, uh,
Diana Honeypot can speak in the double POSAR language. Uh, uh,
we started seeing the payloads coming to the honeypot. The egg
is coming. But the problem is, uh, there's another big
challenge. Um, the payload itself is, uh, encrypted. So,
we're not able to passing that. I'm, uh, definitely, uh, thank
to, uh, zero sum for his, uh, very detailed, uh, analysis on
how double POSAR work. And then, uh, uh, we understand that, uh,
this encryption is just simple four bytes of key. And then with
some, uh, uh, algorithms, yep, uh, this, uh, uh, encryption
key, in fact, is provided by the compromised host. Any host
can, uh, the infected host will be provided this XOR key to
WannaCry. WannaCry will use that and then encrypt the payload
and to the compromised host. Yeah. Uh, so, in this case, uh,
I will say that. Let's try to have, let's try to have, uh,
have our honeypot provide this key to, uh, to WannaCry.
WannaCry take it, encrypt. We have it. We decrypt. Yeah. So,
this is, uh, uh, the idea behind the scene. And, uh, and
this key is, uh, uh, embedded in this particular SMB trans2
response, which is, uh, the, the one square in the red in the
signature boson. Yeah. So, right now, we have, uh, double
POSAR backdoor. We have, uh, the encryptions, decryptions.
Here we go. This is the beautiful payload that we have,
uh, in our honeypot.
So, uh, in the payload itself, uh, that contain a few PE file,
PE header itself. And then, uh, you have couple of, uh, I think
three of, two or three, three or four PE headers inside the
payload. This is, uh, exactly match with the WannaCry, uh,
behavior, which is the WannaCry embedded, uh, his, uh,
resources, uh, his EXE in the resource, uh, of the, uh, PE
header itself. Then, uh, we saw that there are a few, uh,
additional code prepended in, uh, in front of the, uh, the
first, uh, PE file. Yeah, I mean, uh, what we do is just, uh,
try to strip it off. Yeah. Now, we have the clean binary. Yep.
So, let me show you. This is one of the very beautiful
interactions between my honeypot and, uh, WannaCry
ransomware. So, this is how they talk to each others, how
they flirt around to each others. And WannaCry will start
to laying eggs and try to see, uh, pushing all the eggs to my
honeypot. We have the payload. We start to decrypt the payloads
with the four white keys that we, we send to them. And then, uh,
after that, we, we will try to find out the PE headers, remove
the, those code that prepended, uh, in the PE headers. Boom.
Yep. We have those kind of clean payloads in our pockets.
Yeah. So, this is how, uh, how it works. Yeah. So, um,
definitely at the same time, which is in the May, we know
that, uh, Windows is vulnerable with, uh, WannaCry
ransomware. But for Linux machines, the same thing. They
have, uh, so-called, uh, SambaCry, uh, uh, vulnerability.
Uh, this, uh, vulnerability is pretty interesting, which is, for
example, let's see. We're able to find, uh, one, uh, SMB
servers. And then there's, uh, in a, in a SMB servers, there,
there's a, uh, there's a writable folders. We can put
our binary into it. Yeah. And then, uh, by, uh, uploading
that, uh, the binary that, that we have into the writable
folders. And then we can do some tricks just to get it to be
executed. Yeah. So, this is one of the wonderful wormable
vulnerability. You can, anyone can just create a worm and scan
the whole internet. Pop into a lot of shell, uh, uh, as much
as possible. Yeah. So, uh, uh, uh, uh, uh, uh, uh, uh, uh, uh, uh,
I mean, uh, Metasploit came out with one of the very interesting
module. Uh, uh, uh, this, uh, is known pipe name. It's pretty
stable. So, for me, again, as a honeypot hobbyist, uh, I love
to, to turn my honeypot into SMB, SMB, uh, server with a
writable shareholders. Yeah. And then, uh, Dionea will be
happy to receive all the payloads that, all the eggs that
coming from around the world. So, yep, uh, I'm trying to
implement these holdings into Dionea. So, Dionea Honeypot can
be a win-win.
It can be Windows, uh, kind of Windows 7 machines, or it can
be another so-called Samba server. So, yep. Oh, I was told
that, uh, uh, I need to put a cat's photos on my, because this
will get, uh, everyone high. Oh, no, no, no. I get, uh,
everyone excited. Yeah. Oh, all right. Right now, we have our
honeypot design. So, we try to push it to the internet. So,
let's see what we are going to have. Yeah. Oh, another one.
Yeah. So, if later we manage to, uh, uh, uh, uh, uh, uh, uh,
we met up with each other, uh, so let's try to catch up over
a beer if you are interested about the honeypot, SMP
honeypots, and how if you're running some honeypots, I'd love
to heard about this idea, definitely. So, let's see. Let's
see what I've, I'm going to empty out all my pockets. I'm
going to share with you what I've seen for the past, uh, few
months, or especially during the fort-, 15 days during the hot,
uh, so-called golden age while, uh, WannaCry ransomware
outbreak. So, here we go. What happened to my honeypot?
I've run honeypot for quite some times. Uh, but just a
disclaimer, uh, I know, I understand a lot of security
company or the national certain you run, you have a lot of
honeypot and you have a lot of IP space, uh, to play with. Maybe
you have a few thousand of honeypot deployed around your
country or around, around the world, try to understand what's,
uh, the internet track itself. But for me, I only have one
honeypot in my room. Yeah. I promise, I promise, I promise. I
going to show you my photo later. Yeah. So, I only have one
honeypot just for personal basis, personal learn, learning
experience. Yeah. And then, uh, I realized that, uh, I'm trying
to, uh, I realized from this graph is that, uh, from January to
May, from time to time, I was seeing conflictors still talk to
me, talk to my honeypot after so many years. But interestingly,
when, uh, during the May, middle of May, uh, there's a loss of
incoming connection to my room. Yeah. Uh, those, uh, in the
daily basis could be around 200. And then out of 200, 40 of them
will try to lay the eggs inside my honeypot, which is, uh, yeah,
I mean, we are going to try to take a look on this. Yeah. And
then, uh, here we go. I'd love to share with you about my gold
mine that I have in my honeypot. Yeah, this is just a
brief one. Um, from whatever in the screenshot, it's just, uh,
four days of my collections from May 27 to May 30th. You can see
from the, uh, pick, collect MD5, the exact binary itself. And then
also, uh, the timestamp when these binaries start to drop into
May. And then also the file size. Yep. By looking at this list,
a very short list, you can see there's patterns in terms of the
file size. Yep. I give you five seconds. One, two, three, four,
five. Okay. Yeah. The pattern itself, there's always a 5.1 MB
of files if you take a closer look. Yep. There's always a 5.1
MB of files. Uh, my purpose is very simple. I just would like to
have WannaCry. I just would like to talk to WannaCry. I just would
like to flirt around together with a WannaCry. But, uh,
interestingly and unexpectedly, there's a lot of uninvited guests,
which is a very small file, big file, very small little, a few
bytes of files. You see, like, there are some eight bytes of
files into my honeypots. So, what the hell is that? I have no
idea. I just want to WannaCry. But why you come into my
honeypots? Yeah. So, let's try to take a look on just a few
categories of what I have in my pocket. So, I'm going to talk a
little bit about the file size. So, I try to explore. Those are
definitely about a 5.1 MB of files. And then we will try to
explore some of the 70 KB, 83 KB, uh, also the very small tiny
file, which is four bytes or even 400 bytes of, uh, file. The
file size is the, the differences between the file size is too
significant. 5 MB and eight bytes. What the hell? Yeah. So,
yep. Uh, in, during May and, uh, June and two days ago, I'm
still seeing a lot of 5.1 MB of files in my honeypots. Yeah. I
believe right now I have a, I think I have a gigabytes of
collections of, uh, WannaCry . Well, I mean, uh, all
these are 5.1 MB of files. I just make a simple strings on it.
And then we will know that, uh, this is the kill switch domain.
Yeah. So, I just make a very tough and very, very, very rough assumptions. I assume all of 5.1 MB of
files, they are WannaCry ransomware. Yep. So, let's ignore it. So, we don't talk about
WannaCry right now. Let's try to see what I have, uh, in the honeypot itself. So, 25th of May, I
think this particular small file, which is, uh, 83 KB as well, try to make a simple, uh,
analysis. And then it will try to call to this particular domains and download secondary
files, which is, uh, two five zero zero one dot exe. Yep. Uh, this file, uh, just make a
simple query in a, uh, various total. I understand that, hey, this, this guy, he just, uh,
did also. Yeah, it's, uh, Windows, uh, versions of Bill Gates born net. So, this born net is in
my honeypot. Uh, I would say that every party will have a did also, definitely. Yep. So, three
days afterwards, I think, uh, another file, which is a 70 KBs of file dropped on my honeypot.
And then, when I, while I try to analyze with that, uh, they will, uh, they will connect to the
secondary domains, uh, try to download this secondary payload. So, in this payload, while I
try to execute this of three four five dot exe, I realized that, uh, the file was not
dropped, uh, six or seven, uh, batch file, VBS file, exe files, uh, into my, uh, into the
machine itself. So, let's take a quick look on what is the batch file, BAT file, or the exe
file. So, the batch file will just perform two simple tasks. The first one, when it has got
executors on the machines, it will enable the firewall rules, uh, firewall service, definitely,
on the machines. And then, it will plug two different simple firewall rules inside the
firewall. And then, it will click on the firewall. And then, it will click on the firewall
and it will try to block any incoming connections, any, to the port four four five or one three
nine. Um, these simple actions claim that it means that, uh, this batch file will try to claim the
ownership of that, uh, host itself. So, this is my machine right now. I won't allow anyone else to
connect to the same machines. I want this machine. This is mine. So, what it will do, the next
thing, it will execute it, uh, the VBS file, which is, uh, there's a stratum, uh, protocol
inside that. Uh, you know that it is a so-called Bitcoin miner, yeah. So, uh, this is the
VBS file. So, I claim the machines. This is mine. I'm going to mine Bitcoin with these
machines, yeah. So, I mean, so, I mean, I would say, again, every party will have a
Bitcoin miner right now. So, at the same day, May 22, there's another interesting behavior
happened to my honeypot. I think two files, two eggs delivered, two presents, or two gifts
that drop into the honeypot at the same time. And then, uh, this, this file itself, uh,
is just pretty small. Uh, eight bytes of files and, uh, four hundred and seventy, seventy
six bytes of files. When I first, uh, look at this particular, uh, this, uh, file size, I'm
so excited because I know that, oh, well, this is likely the summer cry attacks. So, I got a
summer cry first pawn into my honeypot. Um, I also understand that, uh, this vulnerability
was, uh, released on 24th of May. And then Metasploit started to release their first proof
of concept on 26th of May. But my honeypot received this, uh, special guest, uh, on 28th of
May. So, I believe that lots of people are trying to act very fast, uh, to try to claim, try to
get a lot of, uh, shell access, all the SMB servers, uh, in the world, if, uh, those
servers is not patched. Yeah. So, let's see what we have in this, uh, eight bytes and four
hundred and seventy six bytes of files. Yep. Uh, but just look at a simple, uh, payload,
so what the, the content of this file itself, uh, is exactly match with how summer cry work.
So, the attackers will definitely, he or she, have to test if the, if the folder itself is
writable. So, in this case, he write, it bytes of files, random characters into my honeypot. So,
right now, he's, uh, understand that, oh, well, these, uh, folder is writable. Yep. And then,
uh, he start to deliver this, uh, ELF, so-called, uh, L-file to me. Uh, just a simple, uh, hex
dump. Understand that, uh, those are highlighted in the red color. It's a slash bin, slash
SSH. Uh, I mean, this is a shell, definitely. Yep. So, uh, the, the, the, the, the, the, the, the, the,
the, the, the, the, the, the, the, the, the, so, what we have explore, want to cry, DDoSer,
Bitcoin miner, we have summer cry, so what else? I have, uh, two more hours to go. So, after two
days, another two days, May 30th, there's another file called 5.1 MB of, very small file, uh,
uh, into the honeypot. But looking at the hex dumps, I understand that, uh, this is, there's
IP address inside at the bottom. In the middle, there's, uh, random strings. But looking at,
uh, by just purely looking at a, hex dumps, I understand, uh, that it's, there's IP address
that this is slightly the Metasploit HTTP reversal. How it
works is if this payload got executed, it will send a HTTP
request with a URI HTTP double colon slash slash, the IP
address and that random strings. I would say, well, welcome to my
honeypot. Yeah. So this is the last one I'm going to share
today. May 30th, I saw another file, this file, 39 KB of small
file going to my honeypot. When I have it executed, it is, it
will try to download the file called mat.exe. This happened on
May 30th. But in June 5, June, 5th of June, I see the same file
again. So I'm trying to grab the secondary payloads from the
external host, the mat.exe, but I realize that, hey, the mp5 is
different, which is somewhere in the back. Definitely they
changed their payload and because of, definitely they
claimed after five, after a few days, could be AV pick it up. So
they try to get a new binary into, into their back end. So
of my curiosity, I just try to shop around in their back end.
Yeah. That's what I see. This back end is just a simple HFS,
which is a HTTP file server. This file server is pretty
commonly used in Asia. Yeah. And then for the mat.exe, in the,
back in May 30th, this is the first time I've seen this kind of
thing. This file was uploaded to the HFS on 25th of May. Within
five days' duration, this guy got downloaded by 988 times. I
believe could be some of the security researchers, just like
me, very curious, write a wget or curl, download it for 900
times. Who knows? Yeah. So I, June 5th, I see the same back end.
Try to explore about the same back end. And then I see the
same back end. And then I realize that this binary is newly
uploaded to the back end on the 2nd of June. Within three days,
this binary was downloaded for 6,500 times. Again, I believe
could be some of the security researchers, write a curl, and
he forgot to close his loop. So it downloaded for 6,500 times,
and he do a control C, okay, kill. Yeah. But I would rather
believe that there are 6,500 holes has been infected with
this Trojan Bitcoin miner, and they are mining the Bitcoin for
him. Yeah. So I always shop around with, wherever I have a
chance, with this URI, any URI that I can have for my honeypot.
So from time to time, I was seeing some of the HS file,
pretty similar, with 21,000s of download hits of some simple
particular binary. And then, yep, shopping time. We have, we
will see some of the SWFL files inside the back end as well. And
just take a quick look on this, SW, movee.swf. I think it's
related to the hacking team exploit, back in 2015. I think
2015, five one one nine or something. Yep. So we have
explored different categories of gold mines that I have which is
from WannaCry, 5 or one NBR files, to a DDoSer, to a Bitcoin
miner, to a, to a SummerCry, very small file, Metasploits,
a reverse shell. And then I have, an upgrade to theens as well.
And also, this kind of binary has been downloaded for 6,500 times.
So, as I promised, I'm going to show you some of my photos that I have for my honeypot.
So please let me go.
That is what I have at home, which is just a Raspberry Pi with a Dioneer honeypot on it.
Yep.
But this is pretty bad.
I don't recommend everyone play with this because you might spoil the pin
and then have to buy another new Raspberry Pi again.
So, I decided to go for the biased case for it.
So, instead of one, I have three.
I have three of these blinking lights in my room.
So, this is daytime.
This is nighttime.
So, this is daytime.
This is nighttime.
Definitely, I strongly encourage everyone to set up your own honeypot.
So, the first Git...
GitHub link is my development link.
But then, I would highly recommend everyone to go for Deno Tools 4.
Feeble is maintaining a very...
He paid a lot of effort in terms of maintaining Dioneer.
Right now, previously back in a conflicted era, setting up Dioneer may take one hour with your luck.
Yeah.
But right now, setting up Dioneer honeypot is just very easy.
Three to five minutes run on Ubuntu machines.
Yeah.
I would really highly recommend everyone to use Dino Tools 4.
Yeah.
And then, if you would like to set up some honeypot on a Raspberry Pi, go for HoneyPi Image.
This is a good one, which is a compilation of lots of honeypot tools inside it.
Get an SD card.
Burn into that.
Boot it up.
Yep.
You have the honeypot just as my picture.
Yeah.
I would say that, personally, I would say that playing with honeypot is a very exciting experience.
Initially, I expect just one acquirement somewhere.
But always the most awesome part is you expect the unexpected.
In this case, we have seen lots of uninvited guests crashing a party, lay their eggs, deliver the payloads to us.
I mean, definitely, I'm happy to receive all the payloads.
Yeah.
Just capture one by one.
And then, let's try to analyze what happened over the Internet and how people adapt to the different vulnerability.
And how they react.
And how to pawn any shell as much as possible by the Internet mass scanning.
Yeah.
So, that's what I have for today for everyone about one acquirement somewhere.
And, yeah, I think, thank you very much.
Any questions I can help to share or any ideas?
No.
Yeah.
Okay.
Thank you.
One question.
So, .
Yeah.
.
.
.
.
.
.
.
.
.
.
.
.
.
. .
are all those eggs still inside the honeypot itself, or the pie itself, or we transfer it elsewhere?
So for my personal practice, because back then, which is May,
this is the golden age of the whole WannaCry ransomware,
I almost log into my honeypot in an hourly or maybe in a daily basis,
and then try to see what I have in my honeypot.
I'm copying it out, the whole binary, just for backup purpose,
because SD card is very fragile.
If a small power failure, a couple of power failure, SD cards may corrupt.
So it's always good to backup, definitely, about the binary,
because those binary are the eggs that we have, yeah.
Oh, you mean that the...
You mean my Raspberry Pi honeypot picture?
I just use my Samsung?
No, no, I understand.
So the question is, what is the software that used to generate the graph, right?
That particular...
Yeah, the static system.
Inside Dionea, there's a built-in functions, there's a built-in script,
so you can just run a command, query all the SQLite's data,
then you can generate such a beautiful graphs, yeah.
Even by separate by protocol, SMB, TFTP, any protocol,
it's all, yeah.
Thank you very much.
I think, yeah, that's what I have.