1
00:00:00,000 --> 00:00:17,500
Thank you so much and thank you completely to the IoT village and all the volunteers and the staff because I know we are coming down to the wire and they have got to be exhausted and just, you know, kind of melting in all of this.

2
00:00:17,500 --> 00:00:20,100
So thank you all to the team.

3
00:00:20,100 --> 00:00:28,420
Let's get started because I have to get off of this slide before it gets evil and comes out and does attack.

4
00:00:28,420 --> 00:00:32,860
Do you know how hard it is to find a refrigerator like this?

5
00:00:33,020 --> 00:00:36,040
Anyway, this is who I am.

6
00:00:36,040 --> 00:00:39,460
I am the CEO of B-Sides Chicago.

7
00:00:39,460 --> 00:00:42,580
I was the COO for Diana Initiative last year.

8
00:00:42,580 --> 00:00:45,060
I also am part of B-Sides Pittsburgh.

9
00:00:45,180 --> 00:00:45,500
Why?

10
00:00:45,500 --> 00:00:47,620
Because I live in Pittsburgh currently.

11
00:00:47,620 --> 00:00:50,240
My first DEF CON was number three.

12
00:00:50,240 --> 00:00:52,200
How many people are that old?

13
00:00:52,200 --> 00:00:54,840
There were 16 speakers then.

14
00:00:55,020 --> 00:00:58,600
I have got a lot of years in security emphasis in blue teams.

15
00:00:58,600 --> 00:01:00,080
I used to be purple.

16
00:01:00,600 --> 00:01:02,660
I do a lot of DEF SEC ops.

17
00:01:03,140 --> 00:01:10,640
I sort of was based in Pittsburgh the last year and a half but in 16 more days I will be in beautiful Kirkland, Washington.

18
00:01:10,640 --> 00:01:11,880
I can't wait.

19
00:01:11,880 --> 00:01:26,440
I am a natural creature of winter and you will typically find me as you will see right here sipping a Casanova while simultaneously defending my systems using open source magic spells and dancing flamingos.

20
00:01:26,440 --> 00:01:31,840
We don't have time for dancing flamingos but we damn well have time for tequila.

21
00:01:36,340 --> 00:01:37,360
Oh great.

22
00:01:37,360 --> 00:01:38,480
And now I'm coughing.

23
00:01:38,480 --> 00:01:40,040
That never happens.

24
00:01:40,040 --> 00:01:41,040
Wow.

25
00:01:41,340 --> 00:01:45,900
Honeypots, refrigerators and internet of threats.

26
00:01:45,900 --> 00:01:49,900
I like to call it that instead of internet of things.

27
00:01:50,880 --> 00:01:54,180
But yeah, these are some of my absolute favorite things.

28
00:01:54,180 --> 00:01:55,640
We're going to talk about this stuff.

29
00:01:55,640 --> 00:01:59,140
And oh yes, I'm a drummer too if you haven't quite figured that out.

30
00:01:59,940 --> 00:02:00,820
All right.

31
00:02:00,820 --> 00:02:05,200
The views here and opinions and everything I show you today are mine.

32
00:02:05,200 --> 00:02:07,020
They are no one else's.

33
00:02:07,020 --> 00:02:10,920
Definitely not any my employer, past or present.

34
00:02:11,440 --> 00:02:15,780
Please take anything I show you with a grain of salt.

35
00:02:15,780 --> 00:02:23,560
Don't try this at home as they say on, oh God, I just forgot the TV show.

36
00:02:23,560 --> 00:02:24,940
Oh well.

37
00:02:25,340 --> 00:02:27,120
It's one of those days.

38
00:02:27,140 --> 00:02:37,100
And those of you with an overwhelming fear of the unknown will be happy to know that if you read this disclaimer backwards, there is no hidden message that will be revealed.

39
00:02:37,100 --> 00:02:39,080
Although some people want me to put one in there.

40
00:02:39,080 --> 00:02:41,040
I think I may do that the next time.

41
00:02:41,660 --> 00:02:42,260
All right.

42
00:02:42,260 --> 00:02:43,660
Why are we here?

43
00:02:44,340 --> 00:02:46,380
Couple of important points.

44
00:02:46,380 --> 00:02:49,180
I always like to present this in any of my talks.

45
00:02:49,180 --> 00:02:51,180
And I need to update it for 2019.

46
00:02:51,180 --> 00:02:53,740
I just have to get the information on it.

47
00:02:53,740 --> 00:02:55,860
But let's just look at 2018.

48
00:02:56,200 --> 00:03:08,440
In 2018, companies spent over $114 billion on fancy software, fancy hardware, you know, all the blinky boxes, the blinky software, all that crap.

49
00:03:08,540 --> 00:03:11,820
Attacks and breaches continue to go up.

50
00:03:11,820 --> 00:03:20,980
The security stuff that we buy, whether it's EPP, whether it's firewalls, whether it's who knows whatever it is, it's vulnerable.

51
00:03:21,100 --> 00:03:29,920
Another very important point that I always like to make is lateral movement is so often overlooked.

52
00:03:29,920 --> 00:03:34,300
I'll talk about that coming up a little bit more.

53
00:03:34,300 --> 00:03:36,460
Then think about this.

54
00:03:36,460 --> 00:03:44,800
What about... I've actually had people tell me that, ooh, our security architecture is incredibly unique.

55
00:03:44,960 --> 00:03:45,880
Really?

56
00:03:45,880 --> 00:03:47,080
I don't think so.

57
00:03:47,080 --> 00:03:51,800
There's not that many ways to make it unique.

58
00:03:51,960 --> 00:03:54,320
Also, what is your typical day?

59
00:03:54,320 --> 00:04:07,880
Normally, I'm in a room presenting this, so I would say by a show of hands, how many of you spend 50% of your time checking boxes that have to do with compliance?

60
00:04:08,120 --> 00:04:16,760
I can't see if you're raising your hands, but pretend you are and put it in Discord, because I'd be really curious to look once I get off this screen.

61
00:04:18,520 --> 00:04:22,600
If you don't have this book, I recommend that you get it.

62
00:04:22,600 --> 00:04:26,380
It's called Offensive Countermeasures by John Strand.

63
00:04:26,400 --> 00:04:28,960
And this quote is directly out of this book.

64
00:04:28,960 --> 00:04:29,800
I love it.

65
00:04:29,800 --> 00:04:34,280
Instead of brilliance, we've standardized mediocrity.

66
00:04:34,340 --> 00:04:40,100
And what I take from that is the fact that, yeah, we just go out and spend a few bucks here and there.

67
00:04:40,100 --> 00:04:44,580
We buy some common off-the-shelf hardware, software, whatever.

68
00:04:44,580 --> 00:04:48,680
We plug it in, and we go, woo, we're protected.

69
00:04:48,980 --> 00:04:50,260
I don't think so.

70
00:04:50,260 --> 00:04:56,660
If that were the case, there wouldn't be the Equifaxes of the world, the Capital Ones, and so on.

71
00:04:58,060 --> 00:04:58,580
All right.

72
00:04:58,580 --> 00:05:03,400
I love this cartoon, because this kind of says it all.

73
00:05:03,400 --> 00:05:08,880
In this corner, we have firewalls, encryption, antivirus, software, et cetera, et cetera, et cetera.

74
00:05:08,880 --> 00:05:11,480
And in this corner, we have Dave.

75
00:05:11,480 --> 00:05:18,000
And the best part about this is up until recently, my boss, his name was Dave.

76
00:05:18,000 --> 00:05:25,000
And when I showed him this, I just couldn't stop laughing, because it was perfect.

77
00:05:25,000 --> 00:05:27,400
But it really is true, right?

78
00:05:27,500 --> 00:05:35,400
Because it's all about our users that continue to do things or get compromised or something happens.

79
00:05:35,400 --> 00:05:41,800
And we need a way to figure it out, especially in two aspects of it.

80
00:05:41,800 --> 00:05:44,000
One, we're all working remotely.

81
00:05:44,000 --> 00:05:51,280
And two, we have a lot of IoT stuff on our networks.

82
00:05:51,540 --> 00:05:54,140
So we have to do something about that.

83
00:05:55,620 --> 00:05:58,080
Also, I saw this just the other day.

84
00:05:58,080 --> 00:06:02,360
This $12 course can turn you into an ethical hacking pro.

85
00:06:04,040 --> 00:06:06,140
I guess I did it wrong.

86
00:06:06,140 --> 00:06:06,920
I don't know.

87
00:06:06,920 --> 00:06:08,780
I went to school for this.

88
00:06:08,860 --> 00:06:11,500
Although, I was a music major, so what do I know?

89
00:06:11,500 --> 00:06:16,060
Now, I just have to put that up for your entertainment, because I do think it's kind of funny.

90
00:06:16,060 --> 00:06:17,520
Don't fall for these scams.

91
00:06:17,520 --> 00:06:20,520
Most of these courses are crap.

92
00:06:21,200 --> 00:06:25,120
Honestly, set up a lab in your environment.

93
00:06:25,120 --> 00:06:27,140
I'll give you one little tip.

94
00:06:27,140 --> 00:06:35,940
Whenever I interview people, one of the first questions I ask engineers, security engineers, and so on, is tell me about your home lab.

95
00:06:35,940 --> 00:06:41,220
I have actually had security engineers tell me, I don't have time for that.

96
00:06:41,220 --> 00:06:42,100
Really?

97
00:06:42,160 --> 00:06:43,360
Next.

98
00:06:43,400 --> 00:06:44,560
So keep that in mind.

99
00:06:44,560 --> 00:06:47,100
You better have a really good home lab.

100
00:06:47,200 --> 00:06:58,480
This is something I want to point out, because these are screenshots from a recent security conference before COVID, before we went to virtual conferences.

101
00:06:58,480 --> 00:07:00,620
I was physically at a conference.

102
00:07:00,620 --> 00:07:02,880
It doesn't matter which one.

103
00:07:02,880 --> 00:07:05,400
But the point here is this.

104
00:07:06,100 --> 00:07:11,100
Here I had a GoPro that allowed me to connect to it.

105
00:07:11,540 --> 00:07:16,100
And I actually started taking screenshots from this person's GoPro.

106
00:07:16,100 --> 00:07:21,880
I was trying to figure out where they were in the room based on the shots I was able to see.

107
00:07:21,880 --> 00:07:26,300
I had another device that was attempting to pair with me.

108
00:07:26,300 --> 00:07:28,840
I actually was able to pair with it.

109
00:07:28,840 --> 00:07:39,420
I also was running an evil AP, and I was kind of capturing all the SIDS that were running around this particular security conference.

110
00:07:39,420 --> 00:07:44,460
The point is, I usually do this every year at DEF CON.

111
00:07:44,640 --> 00:07:50,300
So if you see me walking around, I'll usually have a purse, and in that purse will be my evil AP.

112
00:07:50,980 --> 00:07:55,460
And the beauty of carrying a purse is it hides very neatly in your purse.

113
00:07:55,500 --> 00:08:00,000
But I look at all of this stuff, and I kind of analyze it when I get back.

114
00:08:00,000 --> 00:08:17,280
And it's fascinating to me that as security professionals ourselves and hackers and so on, we make the same mistakes that a lot of amateurs and new people make because they don't clear out their Wi-Fi.

115
00:08:17,280 --> 00:08:20,280
They don't do things that they should be doing.

116
00:08:21,560 --> 00:08:23,300
There was also one other thing.

117
00:08:23,300 --> 00:08:25,100
This morning I was kind of bored.

118
00:08:25,100 --> 00:08:28,520
I put up a new spice rack in my kitchen, so I took a picture of it.

119
00:08:28,520 --> 00:08:30,480
I wanted to share that with everyone.

120
00:08:31,140 --> 00:08:33,620
Yes, you should all be laughing right now.

121
00:08:33,620 --> 00:08:37,220
If you're not, oh well, I tried.

122
00:08:37,580 --> 00:08:40,820
All right, why are we not here?

123
00:08:41,560 --> 00:08:46,480
Well, first of all, it's not a demo of 5,000 different kinds of honeypots.

124
00:08:46,480 --> 00:08:48,080
That would be kind of silly.

125
00:08:48,080 --> 00:08:49,200
I have 45 minutes.

126
00:08:49,200 --> 00:08:51,020
It's not going to work very well.

127
00:08:51,740 --> 00:08:55,400
I'm not going to show you all of my honeypots.

128
00:08:55,400 --> 00:08:59,760
If you follow me on Twitter, you know I have honeypots all over the world.

129
00:09:00,020 --> 00:09:02,160
I have them scattered everywhere.

130
00:09:02,160 --> 00:09:03,980
I have them in my apartment.

131
00:09:03,980 --> 00:09:07,920
I have them in a lot of different places.

132
00:09:08,000 --> 00:09:10,880
Showing you my honeypots would be counterproductive.

133
00:09:10,880 --> 00:09:20,040
It's not going to do anything, but I will show you some without showing you where they're located, and they'll make a point.

134
00:09:20,960 --> 00:09:24,300
Oops, I have to come back, sorry.

135
00:09:24,760 --> 00:09:39,380
The whole point of this is there must be a better way to do security, because if we keep spending all this money, there really has to be a better way, and I think honeypots are the way to do it.

136
00:09:39,380 --> 00:09:42,940
Let's quick talk about what is an incident or a breach.

137
00:09:43,200 --> 00:09:46,540
Some key points, most breaches are not zero-day.

138
00:09:46,540 --> 00:09:47,760
They're not fancy.

139
00:09:47,760 --> 00:09:51,440
You don't get breaches from vulnerability scanners.

140
00:09:51,440 --> 00:09:54,560
Most breaches come from configuration issues.

141
00:09:54,560 --> 00:10:03,560
Ooh, this interests me, because it opens up the door to how I can modify my honeypots.

142
00:10:04,260 --> 00:10:08,280
A close second is compromised credentials.

143
00:10:08,520 --> 00:10:19,420
I worked at a company many years ago where, well, most companies are smart enough that they will change the administrator account in their domain.

144
00:10:19,420 --> 00:10:28,400
They don't want it to be administrator, but why don't you put back an administrator account and make it a honey credential?

145
00:10:28,540 --> 00:10:29,660
Think about that.

146
00:10:29,660 --> 00:10:31,940
We'll talk about that a little bit more.

147
00:10:32,060 --> 00:10:35,400
Also, trailing in third are overprivileged users.

148
00:10:35,400 --> 00:10:42,680
That's not going to fit well into our honeypots as much as everything else.

149
00:10:44,080 --> 00:10:49,100
Let's look at a couple of quick examples of IoT issues.

150
00:10:49,420 --> 00:10:50,900
This was a funny one.

151
00:10:50,900 --> 00:10:56,280
A university was attacked by its own light bulbs, vending machines, and lampposts.

152
00:10:57,560 --> 00:10:59,140
Answer a question for me.

153
00:10:59,140 --> 00:11:01,780
I know you can't, but you could in Discord.

154
00:11:02,400 --> 00:11:12,040
What in God's name were the light bulbs, the vending machines, the lampposts doing on the same network as the rest of the university?

155
00:11:12,040 --> 00:11:14,760
It should not have been there.

156
00:11:15,140 --> 00:11:20,120
Also, there are industrial issues that we deal with all the time.

157
00:11:20,460 --> 00:11:23,640
An oil rig was shut down a couple of years ago.

158
00:11:23,640 --> 00:11:24,060
Why?

159
00:11:24,060 --> 00:11:31,340
Because there was an IoT sensor on the oil rig that actually detected whether the oil rig was tipping.

160
00:11:31,340 --> 00:11:33,420
It was an ocean oil rig.

161
00:11:33,960 --> 00:11:35,340
Somebody got in.

162
00:11:35,340 --> 00:11:38,120
They made the sensor read.

163
00:11:38,260 --> 00:11:42,620
I want to say it was like a 12 degree tilt and the sensor was set.

164
00:11:42,620 --> 00:11:47,200
If it went to 10 degrees or over, then it would shut down the oil rig.

165
00:11:47,200 --> 00:11:53,700
Nobody bothered to check that damn sensor to see if it was misreading or something was wrong with it.

166
00:11:53,800 --> 00:11:58,380
Also, there was a blast furnace that happened to have been owned by the government.

167
00:11:58,600 --> 00:12:02,620
It malfunctioned, so to speak.

168
00:12:02,620 --> 00:12:05,460
Well, what happened was somebody got into it.

169
00:12:05,460 --> 00:12:09,000
They raised the temperature, shut off the shut off valves.

170
00:12:09,000 --> 00:12:13,980
The way this kind of solved itself was very simple.

171
00:12:13,980 --> 00:12:14,880
It melted.

172
00:12:14,880 --> 00:12:15,900
It melted down.

173
00:12:15,900 --> 00:12:17,260
No one was hurt.

174
00:12:17,260 --> 00:12:23,560
Although, if you were a blast furnace, I guess you might have been hurt in that particular case.

175
00:12:23,560 --> 00:12:25,880
This one I will never understand.

176
00:12:26,200 --> 00:12:29,800
Why are toilets connected to networks?

177
00:12:30,080 --> 00:12:31,120
Seriously.

178
00:12:31,120 --> 00:12:32,160
I mean, are we what?

179
00:12:32,160 --> 00:12:33,780
We're monitoring water?

180
00:12:33,780 --> 00:12:35,220
I don't know.

181
00:12:35,220 --> 00:12:39,000
But this happens all over Europe and Asia and so on.

182
00:12:39,000 --> 00:12:43,040
It does bring new meaning to the word system dump.

183
00:12:43,040 --> 00:12:49,660
But anyway, yes, I would never put a toilet on the network.

184
00:12:49,800 --> 00:12:50,560
All right.

185
00:12:50,560 --> 00:12:54,600
Now we're going to talk about one of my favorite things, honeypots.

186
00:12:54,600 --> 00:12:56,240
I love them.

187
00:12:56,240 --> 00:13:01,320
I think they are much more valuable than people give credit.

188
00:13:01,780 --> 00:13:04,980
Honeypots or deception technology.

189
00:13:04,980 --> 00:13:07,460
People have changed the name lately.

190
00:13:07,460 --> 00:13:10,700
They love to call them deception technology.

191
00:13:10,700 --> 00:13:11,240
Why?

192
00:13:11,240 --> 00:13:12,320
I don't know.

193
00:13:12,320 --> 00:13:15,440
They wanted something that sounded more professional.

194
00:13:15,440 --> 00:13:17,820
I guess deception technology.

195
00:13:17,820 --> 00:13:37,640
And yet I have found many commercial honeypots are nothing more than open source versions that have been repackaged with a fancy front end and a distribution model that allows it to be deployed to your environment much easier.

196
00:13:37,640 --> 00:13:40,940
But it's still the open source solution.

197
00:13:41,060 --> 00:13:55,240
So why can't I do that myself with an open source honeypot, maybe Ansible, Puppet, Chef, whatever is your tool of choice, use that to deploy your honeypots and manage them.

198
00:13:55,340 --> 00:13:57,220
Maybe we can.

199
00:13:57,220 --> 00:14:02,360
But think of a honeypot as nothing more than a resource with no value.

200
00:14:02,360 --> 00:14:08,420
The value of that honeypot is someone using the resource.

201
00:14:08,460 --> 00:14:12,160
My honeypots are attacked all the time.

202
00:14:12,160 --> 00:14:16,760
I typically will not set my honeypots up to hack back.

203
00:14:16,960 --> 00:14:17,900
Who knows?

204
00:14:17,900 --> 00:14:19,340
Maybe someday I will.

205
00:14:19,340 --> 00:14:21,380
But I haven't done it yet.

206
00:14:22,500 --> 00:14:26,940
Also, these are incredibly important points.

207
00:14:27,060 --> 00:14:32,940
Probably the most important aspect of honeypots is deployment.

208
00:14:33,280 --> 00:14:35,580
Where are you going to put them?

209
00:14:35,580 --> 00:14:37,360
I made a comment a few minutes ago.

210
00:14:37,360 --> 00:14:39,220
I have honeypots all over the world.

211
00:14:39,220 --> 00:14:44,820
I don't just put them out just randomly for the hell of it.

212
00:14:44,820 --> 00:14:53,220
There might be a couple that I might just place in a country on a VPS somewhere just to see if it gets attacked.

213
00:14:53,220 --> 00:15:01,640
But most of them are very strategically placed, especially within my own environment, my own networks, etc.

214
00:15:01,640 --> 00:15:02,960
So think about it.

215
00:15:02,960 --> 00:15:05,440
We're going to talk about that detail coming up.

216
00:15:05,740 --> 00:15:06,780
Architecture.

217
00:15:07,520 --> 00:15:08,560
Customization.

218
00:15:08,920 --> 00:15:11,220
In other words, planning.

219
00:15:11,500 --> 00:15:16,620
You know, there are hundreds, thousands, I don't know, I've lost track.

220
00:15:16,620 --> 00:15:20,520
There are hundreds of types of honeypots out there.

221
00:15:21,040 --> 00:15:22,540
We're going to talk about that.

222
00:15:22,540 --> 00:15:25,000
In fact, let's talk about it right now.

223
00:15:25,000 --> 00:15:29,180
Here's a good list of some of my favorite honeypots.

224
00:15:29,460 --> 00:15:30,560
ADHD.

225
00:15:30,640 --> 00:15:31,740
Great tool.

226
00:15:31,740 --> 00:15:33,640
Comes from Active Countermeasures.

227
00:15:33,680 --> 00:15:35,080
It is free.

228
00:15:36,680 --> 00:15:38,040
Excuse me.

229
00:15:38,360 --> 00:15:40,660
And, you know, go download it.

230
00:15:40,660 --> 00:15:41,540
Start playing with it.

231
00:15:41,540 --> 00:15:47,140
It has numerous honeypots built into it, a couple of which are my favorite as well.

232
00:15:47,140 --> 00:15:49,300
Honey badger and honey badger red.

233
00:15:49,300 --> 00:15:52,780
I love honey badger and I'll talk about that coming up.

234
00:15:52,780 --> 00:15:57,700
There's another place to generate canary tokens.

235
00:15:57,820 --> 00:16:02,040
There is also Open Canary, which is a great honeypot.

236
00:16:02,040 --> 00:16:12,420
If you want to build your own custom honeypots out of hardware and software, take a look at the Mozilla project called Web Things.

237
00:16:12,420 --> 00:16:20,040
There's a whole framework there that you can actually build your own honeypots with raspberry pies and so on.

238
00:16:21,660 --> 00:16:24,180
Teapot is still a good one to get started with.

239
00:16:24,180 --> 00:16:25,180
Start playing.

240
00:16:25,180 --> 00:16:29,680
There's a new one that replaced the Modern Honey Network a couple of years ago.

241
00:16:29,680 --> 00:16:31,860
It's called Community Honey Network.

242
00:16:31,900 --> 00:16:33,560
Take a look at that one.

243
00:16:33,560 --> 00:16:35,700
Twisted Honeypot's another.

244
00:16:35,720 --> 00:16:38,560
But I think you're getting the idea.

245
00:16:38,560 --> 00:16:42,340
Also, what about the real thing?

246
00:16:42,660 --> 00:16:55,810
What if I have a server that I could install Windows Server on it, whatever year you want to pick, why couldn't that be an actual honeypot?

247
00:16:56,120 --> 00:17:00,860
Why does it have to have special software on it to be a honeypot?

248
00:17:00,860 --> 00:17:02,560
I'll tell you this right now.

249
00:17:02,560 --> 00:17:09,740
I have a mail server in my own personal network that is a fake mail server.

250
00:17:09,740 --> 00:17:15,700
If you look at my MX record, you will see that I have a couple of mail servers in there.

251
00:17:15,700 --> 00:17:23,760
But then there's this other mail server that sits on the exact same network, but it's not part of the MX record.

252
00:17:23,820 --> 00:17:24,920
It's a honeypot.

253
00:17:24,920 --> 00:17:34,280
And I catch people trying to spam it and get in and do things all the time because the bots find it.

254
00:17:34,400 --> 00:17:40,300
The whole point here is there are lots and lots of honeypots.

255
00:17:40,300 --> 00:17:50,100
This is a great website or a GitHub link where the person maintains a great list of all of the honeypots, so keep that in mind.

256
00:17:50,100 --> 00:17:56,020
Also, I will be making my slides available after this talk up on my GitHub repo.

257
00:17:56,020 --> 00:18:00,040
My GitHub repo is the same as my Twitter handle, Rainbow Cat.

258
00:18:00,040 --> 00:18:02,220
So this will be up later tonight.

259
00:18:03,580 --> 00:18:06,940
Also, remember I said lateral movement.

260
00:18:07,260 --> 00:18:09,460
Lateral movement is critical.

261
00:18:09,740 --> 00:18:15,440
And honeypots are one of your best tools to detect lateral movement.

262
00:18:15,440 --> 00:18:21,060
Just recently I bought a new IoT device.

263
00:18:21,100 --> 00:18:33,080
I plugged it into my network, and one of my honeypots, which is made to detect port scanning, and I have it here in my own place, kind of went off.

264
00:18:33,080 --> 00:18:33,500
Why?

265
00:18:33,500 --> 00:18:38,040
Because the device that I plugged in started port scanning my network.

266
00:18:39,640 --> 00:19:00,120
Without going into details, because I have a bug bounty in place for this, it turns out that the vendor had actually installed somehow some beta... or their testing software, not beta, their testing software got put on a piece of equipment that got shipped to production,

267
00:19:00,120 --> 00:19:03,220
that got shipped and purchased.

268
00:19:03,220 --> 00:19:08,060
I'm wondering whether that's a true story, but we can talk about that offline.

269
00:19:08,060 --> 00:19:11,940
The whole point is we have to find a way to detect lateral movement.

270
00:19:12,000 --> 00:19:13,500
Honeypots are the way to do it.

271
00:19:13,500 --> 00:19:14,900
We're going to see that.

272
00:19:15,100 --> 00:19:15,900
All right.

273
00:19:16,260 --> 00:19:18,620
Everyone should know what OODA is.

274
00:19:18,700 --> 00:19:21,460
If you don't know what OODA is, you're about to.

275
00:19:21,640 --> 00:19:28,740
OODA stands for Observe, Orient, Decide, and Act.

276
00:19:28,740 --> 00:19:31,060
And this came from the military.

277
00:19:31,060 --> 00:19:35,520
It came from the military on how you do warfare, how you do all of this.

278
00:19:35,520 --> 00:19:40,500
And it also was adopted by a lot of security professionals.

279
00:19:40,500 --> 00:19:48,920
Well, in the honeypot world, I think we need our own little mnemonic, if you will.

280
00:19:48,920 --> 00:19:50,720
And it's called CCAD.

281
00:19:50,980 --> 00:20:02,840
CCAD stands for Confuse, Confound, my favorite, Annoy, and, of course, Delay.

282
00:20:02,840 --> 00:20:03,580
Why?

283
00:20:03,580 --> 00:20:18,940
Because if I can delay an attacker because they're stuck in a honeypot, then I'm going to have more time to find them and keep them from getting into my actual valuable resources.

284
00:20:19,720 --> 00:20:20,880
So, yeah.

285
00:20:20,880 --> 00:20:21,880
I love this.

286
00:20:21,880 --> 00:20:23,480
We'll see it a little more later.

287
00:20:23,480 --> 00:20:25,600
Don't forget about monitoring.

288
00:20:25,600 --> 00:20:32,980
You can deploy all the honeypots you want, but people keep forgetting to monitor them.

289
00:20:32,980 --> 00:20:34,700
I use a great tool.

290
00:20:34,720 --> 00:20:36,020
I just put it up here.

291
00:20:36,020 --> 00:20:37,600
I don't represent them.

292
00:20:37,600 --> 00:20:38,620
It's open source.

293
00:20:38,620 --> 00:20:41,020
It's called Wazoo, or some people say Waza.

294
00:20:41,220 --> 00:20:44,160
But go take a look at it.

295
00:20:44,160 --> 00:20:48,460
It's an agent configuration and also a sim built in.

296
00:20:48,460 --> 00:20:50,660
You put the agents on your honeypot.

297
00:20:50,660 --> 00:21:02,400
It does a lot of analysis of all the honey data or all the attack data that's coming into your honeypots, sends it up to your sim, and it's tremendous.

298
00:21:02,400 --> 00:21:08,980
I just like to mention that because you should pick something to be able to monitor your honeypots.

299
00:21:09,260 --> 00:21:09,780
All right.

300
00:21:09,780 --> 00:21:11,580
Let's talk about deployment.

301
00:21:12,300 --> 00:21:14,180
This is the big part.

302
00:21:14,280 --> 00:21:15,580
I can't say it enough.

303
00:21:15,580 --> 00:21:16,880
Plan, plan, plan.

304
00:21:16,880 --> 00:21:26,520
This should be 90% of your time when it comes to deploying honeypots, especially when it comes to IoT.

305
00:21:26,520 --> 00:21:31,520
You can't just build a little IoT honeypot and go, oh, I'll just put it on my network.

306
00:21:31,520 --> 00:21:32,240
No.

307
00:21:32,240 --> 00:21:39,240
You have to design your network such that it looks like this is a valid honeypot.

308
00:21:39,840 --> 00:21:46,800
I'm going to show you coming up a honeypot... let me... I'll stop right there.

309
00:21:46,800 --> 00:21:49,680
I'll show you something and we'll talk about it then.

310
00:21:49,680 --> 00:21:52,640
Also, two types of honeypots I recommend.

311
00:21:52,640 --> 00:21:54,800
Low interaction, medium interaction.

312
00:21:54,800 --> 00:21:57,420
We don't need higher interaction honeypots.

313
00:21:58,080 --> 00:22:07,840
We want them to get delayed and get stuck, but we don't need them mucking around with things that are very complex and difficult.

314
00:22:07,840 --> 00:22:13,800
Most of my honeypots, if I am deploying them within an environment, run on Raspberry Pis.

315
00:22:13,800 --> 00:22:15,680
If I could turn my camera, I would show you.

316
00:22:15,680 --> 00:22:28,320
I have a table down here that has about 25 Raspberry Pis on it in various forms of destruction and rebuilding and everything.

317
00:22:28,620 --> 00:22:30,960
Raspberry Pis are great for it.

318
00:22:30,960 --> 00:22:38,840
Also, think about honeyports, honeypots, honeytokens, honeycredentials.

319
00:22:38,840 --> 00:22:47,100
It's easy to build a honeypot, but it's also going to be a little more difficult because we have to customize it.

320
00:22:47,180 --> 00:22:51,020
And this is where the hard part comes in.

321
00:22:51,020 --> 00:22:54,080
This is why I say ding, ding, ding, this is important.

322
00:22:54,260 --> 00:23:00,580
I'm going to show you a test coming up here in just a second, and we're going to see how many of you pass.

323
00:23:00,740 --> 00:23:06,620
Also, if you're going to put a honeypot out there, real versus self-signed certificates.

324
00:23:06,620 --> 00:23:16,100
Self-signed certificates is the most dead-awful giveaway that this is a honeypot versus a real resource.

325
00:23:16,100 --> 00:23:25,740
And these days with Let's Encrypt, there's no reason you can't put a real certificate on a honeypot.

326
00:23:25,740 --> 00:23:41,220
Also, how difficult would it be if you took an actual application, a production application that you have, but put it on a honeypot server.

327
00:23:41,940 --> 00:23:50,720
And you might take maybe some of the data out of it, maybe, you know, ask your application team to modify it a little bit.

328
00:23:50,720 --> 00:23:58,960
But the point is, you put the actual application on a honeypot server.

329
00:23:58,960 --> 00:24:05,460
So that way, when they're trying to attack it or trying to get into it, it looks like they're getting into something real.

330
00:24:05,460 --> 00:24:08,980
I'm going to show you an example of that coming up in just a second.

331
00:24:09,320 --> 00:24:13,680
I already mentioned, put a host intrusion detection on it.

332
00:24:13,680 --> 00:24:20,120
My favorite being Wazoo, which is a fork of OSEC from several years ago.

333
00:24:20,120 --> 00:24:24,940
There are some rules, and you do have to do some tuning work, but it's very, very important.

334
00:24:25,520 --> 00:24:28,440
Now, where do you put your honeypots?

335
00:24:28,520 --> 00:24:30,060
Well, I put them everywhere.

336
00:24:30,060 --> 00:24:35,460
In server farms, in cloud storage, IoT, the IoT one's coming up in a second.

337
00:24:35,460 --> 00:24:40,620
Put them out my DMZ, out for mail servers, all over the place.

338
00:24:40,620 --> 00:24:44,000
Remember, stop and think about it.

339
00:24:44,560 --> 00:24:52,720
You know, you want WordPress, you want Raspberry Pis, spin up some VMs or some VPSs out there.

340
00:24:52,720 --> 00:24:56,220
Also, what about a point of sale system?

341
00:24:56,680 --> 00:25:00,260
I'll tell you one about that coming up here in just a second.

342
00:25:00,260 --> 00:25:03,200
All right, normally this is interactive.

343
00:25:03,820 --> 00:25:12,220
It's not very interactive right now, but if you were looking at this, and I'm hoping you can see my mouse, you should be able to.

344
00:25:12,220 --> 00:25:15,820
So we see this is, I got into this device.

345
00:25:15,820 --> 00:25:19,780
It looks like it says Linux RT AC 5300.

346
00:25:19,820 --> 00:25:25,120
Normally, I'm asking everybody in the room, what do you think this is?

347
00:25:25,120 --> 00:25:33,720
And most people will yell out, oh, it looks like it's an Asus router, and in fact, it's an AC 5300.

348
00:25:35,440 --> 00:25:37,560
No, it's not.

349
00:25:37,700 --> 00:25:39,880
It's actually Kauri.

350
00:25:39,940 --> 00:25:49,100
Kauri is an SSH Telnet honeypot tool that can be configured to look like just about anything.

351
00:25:49,100 --> 00:25:55,660
In my case, what I did is I went to an actual AC 5300.

352
00:25:55,660 --> 00:26:01,940
I gathered all of the screenshots and the... not screenshots, all of the data files.

353
00:26:01,940 --> 00:26:02,920
I did DFs.

354
00:26:02,920 --> 00:26:04,440
I did LSs.

355
00:26:04,440 --> 00:26:10,760
I captured all of the data I could off an actual AC 5300.

356
00:26:10,760 --> 00:26:23,800
I then went to my Kauri configuration, and I started modifying all of the files here, because that's all you have to do.

357
00:26:23,800 --> 00:26:32,660
If you can modify the files, then suddenly this looks like an actual Asus 5300.

358
00:26:32,660 --> 00:26:43,800
Now, if we were in my live version of this where people could yell out things, you might yell out, but what about the HTTP interface of the router?

359
00:26:43,800 --> 00:26:46,560
Well, that is in here too.

360
00:26:46,560 --> 00:26:48,560
I just didn't get a screenshot of it.

361
00:26:48,560 --> 00:26:53,820
I should have, but I captured everything from the interface.

362
00:26:53,820 --> 00:26:54,780
I logged in.

363
00:26:54,780 --> 00:27:00,240
I got all of the HTML files after doing some screen dumps and so on.

364
00:27:00,240 --> 00:27:02,780
I then went to my Kauri device.

365
00:27:02,780 --> 00:27:08,100
I modified it a little bit because Kauri normally doesn't have a web server on it.

366
00:27:08,100 --> 00:27:15,520
Well, because you're installing Kauri on a base version of Linux, there's nothing to stop you from putting Apache on there.

367
00:27:15,520 --> 00:27:17,300
I put Apache on there.

368
00:27:17,300 --> 00:27:27,900
I put all of my configurations, so when you hit the web interface, it looked exactly like the Asus 5300.

369
00:27:28,260 --> 00:27:30,220
Now, here's the hard part.

370
00:27:30,220 --> 00:27:31,720
I had to go, well, wait a minute.

371
00:27:31,720 --> 00:27:41,840
I can't just drop it on a network somewhere, because why would someone have a wireless router sitting just randomly on a network ?

372
00:27:41,840 --> 00:27:42,320
No.

373
00:27:42,320 --> 00:28:02,920
What I had to do was create a DMZ in my environment, set it up so it looked like this was my Xfinity connection, so anyone coming to my Xfinity system would see an Asus 5300 exposed and think they found the keys to the kingdom.

374
00:28:02,940 --> 00:28:11,800
And they would sit there forever trying to break into it, leaving my real firewall, which of course may be pfSense, who knows?

375
00:28:11,800 --> 00:28:14,520
Or it might be open sense, because I like that better.

376
00:28:14,520 --> 00:28:20,420
The point is, don't forget about the configurations.

377
00:28:20,680 --> 00:28:22,820
That's in the customization.

378
00:28:22,980 --> 00:28:32,500
But that's how easy it is to take a simple firewall tool, in this case Kauri, and modify it to look like something else.

379
00:28:32,700 --> 00:28:34,780
Now, my other question.

380
00:28:34,900 --> 00:28:39,640
If you were looking at this, what would you say this is?

381
00:28:39,640 --> 00:28:43,620
And of course, actually, let me... oops, wrong one.

382
00:28:43,900 --> 00:28:50,100
Let me see if I can see where my Discord window went.

383
00:28:50,100 --> 00:28:52,700
Is anybody asking any questions?

384
00:28:53,520 --> 00:28:54,420
No.

385
00:28:54,420 --> 00:28:55,220
Okay.

386
00:28:55,980 --> 00:29:02,320
What I was going to say is, in Discord, tell me, what do you think this is?

387
00:29:02,320 --> 00:29:06,400
I'm looking at the Discord channel right now, the top questions text.

388
00:29:06,480 --> 00:29:08,520
So does this look like what?

389
00:29:08,880 --> 00:29:09,680
OpenVPN?

390
00:29:09,680 --> 00:29:16,340
And I know there's a delay, so I'm kind of waiting and waiting and see what anybody says.

391
00:29:16,960 --> 00:29:21,920
But it looks like an OpenVPN server.

392
00:29:21,920 --> 00:29:25,040
I assume you would all say that.

393
00:29:25,040 --> 00:29:29,060
And I'm pausing a little bit to see what Discord says.

394
00:29:29,060 --> 00:29:30,340
People are typing.

395
00:29:30,340 --> 00:29:32,080
Yes, yes.

396
00:29:32,220 --> 00:29:33,140
Okay.

397
00:29:33,140 --> 00:29:35,080
But it's not.

398
00:29:35,180 --> 00:29:40,160
It's actually a honeypot.

399
00:29:40,160 --> 00:29:41,340
What did I do?

400
00:29:41,340 --> 00:29:47,620
I installed the OpenVPN server on it, but here's the change.

401
00:29:47,620 --> 00:29:59,020
When you click this to download the software, it downloads HoneyBadger.

402
00:29:59,020 --> 00:30:02,960
HoneyBadger runs on the attacker's machine.

403
00:30:02,960 --> 00:30:10,700
It sends back a trace, and it says, guess where I am?

404
00:30:10,700 --> 00:30:18,930
The whole point here is, yes, I used OpenVPN, the actual application.

405
00:30:18,930 --> 00:30:30,570
But I modified it so it does things that I want it to do and not just what it was written to do.

406
00:30:30,570 --> 00:30:36,730
I have a real OpenVPN server, but this one is fake.

407
00:30:38,550 --> 00:30:39,150
Okay.

408
00:30:39,150 --> 00:30:40,610
Some more examples.

409
00:30:42,230 --> 00:30:42,910
Okay.

410
00:30:42,910 --> 00:30:45,510
I mentioned point of sale.

411
00:30:45,910 --> 00:30:52,710
I did this at a previous company many, many years ago where we have point of sale servers.

412
00:30:52,710 --> 00:30:58,570
They kept getting hacked, and they kept getting hacked with skimmers being put on them.

413
00:30:58,570 --> 00:31:03,490
So any time, you know, they were credit card, typical credit card skimmer software.

414
00:31:03,490 --> 00:31:06,410
Well, we couldn't find who was doing it.

415
00:31:06,410 --> 00:31:09,410
It was happening at multiple locations.

416
00:31:09,410 --> 00:31:10,770
So what did we do?

417
00:31:10,770 --> 00:31:13,230
We built Raspberry Pis.

418
00:31:13,230 --> 00:31:15,310
In this case, it was RPi3s.

419
00:31:15,310 --> 00:31:23,250
We took RPi3s, configured them to look exactly like Oracle's micro POS system.

420
00:31:23,250 --> 00:31:26,170
So the interface was there, and everything was there.

421
00:31:26,170 --> 00:31:44,530
We then drop shipped them to the various locations that we had, and within a week of being installed in our locations, one of them was attacked, and the skimmer software was attempted to be installed, and we finally found out where it was coming from.

422
00:31:44,530 --> 00:31:47,370
And it was contractors and blah, blah, blah.

423
00:31:47,370 --> 00:31:48,190
Doesn't matter.

424
00:31:48,190 --> 00:32:03,970
The point was the honeypots caught the bad actors, all because we stopped and thought about where to put these things, because that's what's important, where to put them.

425
00:32:04,190 --> 00:32:08,150
Also, think about compromised credentials.

426
00:32:08,370 --> 00:32:16,870
How many people have AWS keys that are stored out in GitHub?

427
00:32:16,890 --> 00:32:39,590
And they better be fake AWS keys, because the minute they're compromised, you're going to find out who is really trying to attack you, and not just some fake threat report that comes from some company that says, oh, you're being attacked by this country and these people and blah,

428
00:32:39,590 --> 00:32:40,090
blah, blah.

429
00:32:40,090 --> 00:32:43,730
Most of the times they're telling you about attacks you already know about.

430
00:32:43,730 --> 00:32:47,830
So think about credentials that you can use.

431
00:32:47,830 --> 00:32:56,670
And if you ever have a user that comes to you and says, my account was compromised because I clicked on a phishing account.

432
00:32:56,670 --> 00:32:58,230
Well, here's what you do.

433
00:32:58,230 --> 00:33:01,430
Change their account name right away.

434
00:33:01,990 --> 00:33:07,430
Create a honey credential of the one that was compromised.

435
00:33:07,690 --> 00:33:09,870
It works every time.

436
00:33:11,390 --> 00:33:14,730
This one I don't have time to talk about.

437
00:33:14,730 --> 00:33:25,230
I had another one where we had a server room, a data center.

438
00:33:25,230 --> 00:33:33,750
And we knew that we had people that seemed to be getting into systems physically.

439
00:33:33,750 --> 00:33:39,730
They were connecting up a crash cart and they were logging into servers.

440
00:33:39,730 --> 00:33:44,650
We couldn't catch them because the entire place wasn't covered by cameras.

441
00:33:44,730 --> 00:33:47,210
This was maybe about ten years ago.

442
00:33:47,210 --> 00:33:48,710
So we had an issue.

443
00:33:49,030 --> 00:33:51,510
But I guess it wasn't ten years ago.

444
00:33:51,510 --> 00:33:52,430
It was more like eight.

445
00:33:52,430 --> 00:33:55,950
What we did was we created QR codes.

446
00:33:56,110 --> 00:33:59,690
We stuck them on the bottom of these servers.

447
00:34:00,050 --> 00:34:10,050
And if you scanned it, because we told people about it, if you scanned it, it would give you emergency credentials to log in to fix a server.

448
00:34:10,050 --> 00:34:10,710
Well, no.

449
00:34:10,710 --> 00:34:14,810
What it really did was emailed us saying that somebody just scanned the QR code.

450
00:34:15,030 --> 00:34:17,870
And that's how we found who was doing it.

451
00:34:17,870 --> 00:34:19,290
Again, honeypots.

452
00:34:19,290 --> 00:34:21,870
I already told you about my mail server.

453
00:34:21,870 --> 00:34:24,030
This is an easy one to do.

454
00:34:24,030 --> 00:34:26,230
And it's not that hard.

455
00:34:27,650 --> 00:34:34,370
Also, set up a webcam, a fake one, of course.

456
00:34:34,370 --> 00:34:41,330
It's very easy to mimic what a webcam software looks like on a Raspberry Pi.

457
00:34:41,330 --> 00:34:52,150
You can expose it on your internet via some port routing between your firewall and everything.

458
00:34:52,150 --> 00:34:54,490
And even if it's just on your DMZ.

459
00:34:54,490 --> 00:34:57,690
The point here is I did this years ago.

460
00:34:57,690 --> 00:35:01,010
If you all remember Mirai, I had done this.

461
00:35:01,010 --> 00:35:04,190
I had fake webcams out on my network.

462
00:35:04,190 --> 00:35:07,610
I didn't always get a chance to analyze them.

463
00:35:07,610 --> 00:35:11,470
Because I didn't have them set up pointing to a sim .

464
00:35:11,570 --> 00:35:20,090
So, this is how I learned I need to get a sim set up and have everything being correlated and analyzed.

465
00:35:20,090 --> 00:35:28,430
Because I found out that I had the Mirai payload on one of my honeypots two months after Mirai hit.

466
00:35:28,430 --> 00:35:34,870
The problem was the payload had been dropped two months before Mirai hit.

467
00:35:34,870 --> 00:35:45,250
So, if I had only been looking at my honeypots more regularly, I might have found Mirai before it actually did what it did.

468
00:35:45,250 --> 00:35:46,490
Oh, well.

469
00:35:46,970 --> 00:35:49,630
Think of S3 buckets.

470
00:35:50,130 --> 00:35:55,270
When you stop and think about IoT devices, what do they talk to?

471
00:35:55,270 --> 00:35:57,090
They talk to the cloud.

472
00:35:57,110 --> 00:36:00,850
In many cases, they talk to all sorts of things in the cloud.

473
00:36:00,850 --> 00:36:05,410
And they can also talk to S3 buckets and drop data in it.

474
00:36:05,410 --> 00:36:07,730
Put a fake S3 bucket out there.

475
00:36:07,730 --> 00:36:09,270
Generate some weird data.

476
00:36:09,270 --> 00:36:10,430
Drop it in there.

477
00:36:10,430 --> 00:36:16,190
Put some fake credentials out that are available that would access that S3 bucket.

478
00:36:16,190 --> 00:36:20,050
And then when the credentials are compromised, you get an alert for that.

479
00:36:20,050 --> 00:36:29,470
But then when they're used to access the S3 bucket, which has bogus data in it, you also know who's actually actively trying to attack.

480
00:36:30,550 --> 00:36:32,410
Think about honey ports.

481
00:36:32,410 --> 00:36:33,910
This is going to be important.

482
00:36:33,910 --> 00:36:36,750
We're going to have to speed up because I have a little less time.

483
00:36:37,350 --> 00:36:40,870
Here's an example of a great honeypot tool.

484
00:36:40,870 --> 00:36:44,670
This is on the ADHD package that you can look at.

485
00:36:44,670 --> 00:36:46,190
It's called Port Spoof.

486
00:36:46,190 --> 00:36:52,290
So here you see I did an Nmap from port 200 to port 300 of a host called Gonzo.

487
00:36:52,290 --> 00:37:01,050
And it returned all of these funky, what are pretty normal services and so on that you see running on there.

488
00:37:01,070 --> 00:37:06,610
But what really happened is this is running a tool called Port Spoof.

489
00:37:06,610 --> 00:37:16,290
And Port Spoof actually only listens on one port, but it has some redirect via IP tables on that server.

490
00:37:16,290 --> 00:37:24,650
So anything that hits it, it says, oh, let me go and return all of this bogus data.

491
00:37:24,650 --> 00:37:26,890
But here's the best part of it.

492
00:37:26,890 --> 00:37:29,870
Because this one returned pretty quickly.

493
00:37:29,870 --> 00:37:31,810
But here's another example.

494
00:37:31,810 --> 00:37:41,610
Here we see that, okay, oops, the attacker decided to do an Nmap minus A of Gonzo.

495
00:37:41,610 --> 00:37:48,250
So we see we've got four minutes, 43 seconds elapsed.

496
00:37:48,330 --> 00:37:52,690
It's still running its stealth scan, doesn't find much.

497
00:37:52,690 --> 00:37:54,970
It says it's got 75%.

498
00:37:56,770 --> 00:38:01,090
We've got nine minutes, 58 seconds.

499
00:38:01,090 --> 00:38:05,130
A minute 30, it says it's got remaining.

500
00:38:05,130 --> 00:38:06,790
It's still running here.

501
00:38:06,790 --> 00:38:09,150
It's only at 77%.

502
00:38:09,150 --> 00:38:12,270
And it's still going.

503
00:38:12,530 --> 00:38:15,570
And actually, I'm sorry, looking at the wrong numbers over here.

504
00:38:15,570 --> 00:38:17,270
My timing is over here.

505
00:38:17,270 --> 00:38:20,390
It went from 453 to 739.

506
00:38:20,390 --> 00:38:21,610
And it only made it 3%.

507
00:38:22,230 --> 00:38:23,430
Why?

508
00:38:23,450 --> 00:38:27,930
Because port spoof actually slows it down.

509
00:38:27,930 --> 00:38:29,290
It's like a tar pit.

510
00:38:29,290 --> 00:38:31,070
It drags it in.

511
00:38:31,070 --> 00:38:36,370
Remember CCAD, that D is delay.

512
00:38:36,370 --> 00:38:53,830
If I can delay the attacker while they screw around trying to attack this host in my own network, then the odds are I will have spotted them because my sim will alert me when port spoof triggers.

513
00:38:54,410 --> 00:38:55,690
Simple.

514
00:38:55,770 --> 00:38:58,670
So now I know where they're coming from.

515
00:38:58,670 --> 00:39:01,210
I know what they're trying to do.

516
00:39:01,210 --> 00:39:01,990
Yeah.

517
00:39:01,990 --> 00:39:03,930
You know, think about this.

518
00:39:04,090 --> 00:39:06,010
Also, I will mention this one.

519
00:39:06,010 --> 00:39:07,550
I have a screenshot of it.

520
00:39:07,550 --> 00:39:09,770
I may add it in here.

521
00:39:09,770 --> 00:39:14,770
I'm sure you all have heard of, have I been pwned?

522
00:39:14,770 --> 00:39:16,910
And a lot of people go there.

523
00:39:16,910 --> 00:39:19,170
They put in their email address.

524
00:39:19,170 --> 00:39:23,710
And they get a report back saying whether it's been compromised or not.

525
00:39:23,710 --> 00:39:25,830
I was thinking about that one day.

526
00:39:25,830 --> 00:39:31,070
And I stood up a funky domain similar to have I been pwned.

527
00:39:31,070 --> 00:39:33,330
It was only up for about a week.

528
00:39:33,330 --> 00:39:37,610
I took it down very quickly because I was very surprised.

529
00:39:37,610 --> 00:39:51,250
It said have I been pwned, but instead of asking you to enter your email address, it asked you to enter your password to check to see if that password has been compromised.

530
00:39:51,250 --> 00:39:57,530
In one week, I had thousands of people typing in their passwords.

531
00:39:57,530 --> 00:40:08,870
I was floored, thinking, good Lord, all I did was stand up a simple website that said here, enter your password.

532
00:40:08,870 --> 00:40:11,290
And people started doing it.

533
00:40:11,290 --> 00:40:13,730
It's crazy what people do.

534
00:40:13,730 --> 00:40:24,630
This is why honeypots have so much power in gathering information.

535
00:40:26,090 --> 00:40:29,350
So please, this is a dated quote.

536
00:40:29,350 --> 00:40:31,570
It's from 2014.

537
00:40:31,810 --> 00:40:34,310
But I think you all would agree.

538
00:40:34,330 --> 00:40:40,290
84% of organizations that were breached had evidence of the breach in their log files.

539
00:40:40,290 --> 00:40:48,930
The problem is logging of all their actual applications is terabytes and petabytes and so on.

540
00:40:48,930 --> 00:40:51,270
It's huge.

541
00:40:51,930 --> 00:40:57,210
But honeypots are not going to be false positives.

542
00:40:57,550 --> 00:41:02,350
Honeypots, when they are triggered, they are real attacks.

543
00:41:02,350 --> 00:41:03,050
Why?

544
00:41:03,050 --> 00:41:06,530
Because you don't just drop them all over the place.

545
00:41:06,530 --> 00:41:18,570
I did have one place that we put a bunch of honeypots and we had all the department or the main department head actually told all the other managers where we put the honeypots.

546
00:41:18,870 --> 00:41:22,610
And I was like, seriously, why did you do that?

547
00:41:22,610 --> 00:41:29,930
The whole point of having internal honeypots is to catch insider threats, not for you to tell everybody.

548
00:41:29,930 --> 00:41:37,050
So we had to pull them all back, wait about a month, and then redeploy them so nobody knew where they are.

549
00:41:37,050 --> 00:41:42,450
The point here is planning about where you're going to put honeypots.

550
00:41:42,450 --> 00:41:45,570
So here are your key takeaways from today.

551
00:41:45,590 --> 00:41:47,210
Remember CCAT.

552
00:41:47,210 --> 00:41:50,350
Confuse, confound, annoy, delay.

553
00:41:50,390 --> 00:41:54,970
Also, honeypots have low false positives.

554
00:41:54,970 --> 00:41:58,270
Feed them to a separate sim.

555
00:41:58,270 --> 00:42:06,230
Don't feed them to the same sim that you have collecting all your other data.

556
00:42:06,310 --> 00:42:10,970
They are great tools for detecting lateral movement.

557
00:42:10,970 --> 00:42:11,590
Why?

558
00:42:11,590 --> 00:42:16,230
Because what are people looking for when they get inside your environment?

559
00:42:16,230 --> 00:42:24,090
I can only imagine if Equifax had real honeypots inside their network, they might have actually caught them before they got away with things.

560
00:42:24,090 --> 00:42:30,090
They're cost effective as hell if you're not going out and spending money on commercial versions.

561
00:42:30,190 --> 00:42:37,130
And remember, honeypots are there to defend but mostly to detect your environment.

562
00:42:37,130 --> 00:42:43,790
And what I really want to say is honestly the... well, I'll get to it in a sec.

563
00:42:43,790 --> 00:42:45,650
Let's talk about this.

564
00:42:45,750 --> 00:42:54,410
If you want to only work with IoT honeypots, I recommend Home Pwn.

565
00:42:54,550 --> 00:43:01,790
It's a a kit for testing and looking at IoT devices.

566
00:43:01,810 --> 00:43:17,850
But what I use it for is for gathering all of the screenshots, the data and everything of white bulbs and thermostats and all these things so I can mimic them and make my honeypots look exactly like those devices.

567
00:43:18,030 --> 00:43:19,890
That's one of the things I do with it.

568
00:43:19,890 --> 00:43:22,430
Also, honeypots are great for forensics.

569
00:43:22,430 --> 00:43:23,390
Keep that in mind.

570
00:43:23,390 --> 00:43:24,610
Hell, I had Mirai.

571
00:43:24,610 --> 00:43:26,330
I just didn't know I had it.

572
00:43:26,330 --> 00:43:31,850
But what I really think is important here is honeypots are real threat intel.

573
00:43:32,110 --> 00:43:35,130
They are not fake threat intel.

574
00:43:35,130 --> 00:43:42,170
They are giving you information that is valid on who's attacking you.

575
00:43:42,170 --> 00:43:44,950
It's about thinking differently.

576
00:43:44,950 --> 00:43:56,210
I can't watch hundreds of thousands of servers in my environment every day unless I start to think about it slightly differently.

577
00:43:56,210 --> 00:43:59,290
And that's what we do with honeypots.

578
00:43:59,290 --> 00:44:02,410
So I can't say it enough.

579
00:44:02,410 --> 00:44:03,650
Plan, plan, plan.

580
00:44:03,650 --> 00:44:05,710
That is the key thing.

581
00:44:05,710 --> 00:44:12,990
Honeypots are easy to deploy, but planning the deployment is what's important.

582
00:44:12,990 --> 00:44:15,110
Thank you all very much.

583
00:44:15,110 --> 00:44:17,450
I hope you enjoyed this talk.

584
00:44:17,450 --> 00:44:20,090
I will be posting my slides.

585
00:44:20,090 --> 00:44:26,730
I am working on an actual honeypot customization workshop.

586
00:44:26,730 --> 00:44:28,050
I'm almost there.

587
00:44:28,050 --> 00:44:29,990
I've done a couple of walkthroughs.

588
00:44:29,990 --> 00:44:33,310
The problem has been I need to work on the labs.

589
00:44:33,910 --> 00:44:38,310
But once I get this done, I'm going to give it for free virtually.

590
00:44:39,270 --> 00:44:41,690
So, yeah, I'll be doing that.

591
00:44:41,690 --> 00:44:43,030
Watch my Twitter feed.

592
00:44:43,030 --> 00:44:47,810
You'll see information about that coming up within a couple of months.

593
00:44:47,810 --> 00:44:52,350
I have to get through my move from where I am now out to Washington.

594
00:44:52,350 --> 00:44:54,490
So thank you all very much.

595
00:44:54,490 --> 00:44:56,090
Hope you had a good time.

596
00:44:56,090 --> 00:44:59,930
Hope you liked my spice rack joke.

597
00:44:59,930 --> 00:45:01,510
If not, oh, well.

598
00:45:01,510 --> 00:45:05,050
And here's to Casa Noble and Yeho Tequila.