Thank you so much and thank you completely to the IoT village and all the volunteers and the staff
because I know we are coming down to the wire and they have got to be exhausted and just,
you know, kind of melting in all of this. So thank you all to the team. Let's get started
because I have to get off of this slide before it gets evil and comes out and does attack.
Do you know how hard it is to find a refrigerator like this? Anyway, this is who I am. I am the CEO
of B-Sides Chicago. I was the COO for Diana Initiative last year. I also am part of B-Sides
Pittsburgh. Why? Because I live in Pittsburgh currently. My first DEF CON was number three.
How many people are that old? There were 16 speakers then. I have got a lot of years in
security emphasis in blue teams. I used to be purple. I do a lot of DEF SEC ops. I sort of was
based in Pittsburgh the last year and a half but in 16 more days I will be in beautiful Kirkland,
Washington. I can't wait. I am a natural creature of winter and you will typically find me as you
will see right here sipping a Casanova while simultaneously defending my systems using open
source magic spells and dancing flamingos. We don't have time for dancing flamingos but we
damn well have time for tequila. Oh great. And now I'm coughing. That never happens. Wow. Honeypots,
refrigerators and internet of threats. I like to call it that instead of internet of things.
But yeah, these are some of my absolute favorite things. We're going to talk about this stuff.
And oh yes, I'm a drummer too if you haven't quite figured that out. All right. The views here and
opinions and everything I show you today are mine. They are no one else's. Definitely not any my
employer, past or present. Please take anything I show you with a grain of salt. Don't try this at
home as they say on, oh God, I just forgot the TV show. Oh well. It's one of those days. And
those of you with an overwhelming fear of the unknown will be happy to know that if you read
this disclaimer backwards, there is no hidden message that will be revealed. Although some
people want me to put one in there. I think I may do that the next time. All right. Why are we here?
Couple of important points. I always like to present this in any of my talks. And I need to
update it for 2019. I just have to get the information on it. But let's just look at 2018.
In 2018, companies spent over $114 billion on fancy software, fancy hardware, you know,
all the blinky boxes, the blinky software, all that crap. Attacks and breaches continue to go up.
The security stuff that we buy, whether it's EPP, whether it's firewalls, whether it's who
knows whatever it is, it's vulnerable. Another very important point that I always like to make
is lateral movement is so often overlooked. I'll talk about that coming up a little bit more.
Then think about this. What about... I've actually had people tell me that,
ooh, our security architecture is incredibly unique. Really? I don't think so. There's not
that many ways to make it unique. Also, what is your typical day? Normally, I'm in a room
presenting this, so I would say by a show of hands, how many of you spend 50% of your time
checking boxes that have to do with compliance? I can't see if you're raising your hands,
but pretend you are and put it in Discord, because I'd be really curious to look once
I get off this screen. If you don't have this book, I recommend that you get it. It's called
Offensive Countermeasures by John Strand. And this quote is directly out of this book. I love it.
Instead of brilliance, we've standardized mediocrity. And what I take from that is the
fact that, yeah, we just go out and spend a few bucks here and there. We buy some common
off-the-shelf hardware, software, whatever. We plug it in, and we go, woo, we're protected.
I don't think so. If that were the case, there wouldn't be the Equifaxes of the world,
the Capital Ones, and so on. All right. I love this cartoon, because this kind of says it all.
In this corner, we have firewalls, encryption, antivirus, software, et cetera, et cetera,
et cetera. And in this corner, we have Dave. And the best part about this is up until recently,
my boss, his name was Dave. And when I showed him this, I just couldn't stop laughing,
because it was perfect. But it really is true, right? Because it's all about our users that
continue to do things or get compromised or something happens. And we need a way to figure
it out, especially in two aspects of it. One, we're all working remotely. And two, we have a lot
of IoT stuff on our networks. So we have to do something about that. Also, I saw this just the
other day. This $12 course can turn you into an ethical hacking pro. I guess I did it wrong. I
don't know. I went to school for this. Although, I was a music major, so what do I know? Now,
I just have to put that up for your entertainment, because I do think it's kind of funny. Don't fall
for these scams. Most of these courses are crap. Honestly, set up a lab in your environment. I'll
give you one little tip. Whenever I interview people, one of the first questions I ask engineers,
security engineers, and so on, is tell me about your home lab. I have actually had security
engineers tell me, I don't have time for that. Really? Next. So keep that in mind. You better
have a really good home lab. This is something I want to point out, because these are screenshots
from a recent security conference before COVID, before we went to virtual conferences. I was
physically at a conference. It doesn't matter which one. But the point here is this. Here I
had a GoPro that allowed me to connect to it. And I actually started taking screenshots from
this person's GoPro. I was trying to figure out where they were in the room based on the shots I
was able to see. I had another device that was attempting to pair with me. I actually was able
to pair with it. I also was running an evil AP, and I was kind of capturing all the SIDS that were
running around this particular security conference. The point is, I usually do this every year at
DEF CON. So if you see me walking around, I'll usually have a purse, and in that purse will be
my evil AP. And the beauty of carrying a purse is it hides very neatly in your purse. But I look at
all of this stuff, and I kind of analyze it when I get back. And it's fascinating to me that as
security professionals ourselves and hackers and so on, we make the same mistakes that a lot of
amateurs and new people make because they don't clear out their Wi-Fi. They don't do things that
they should be doing. There was also one other thing. This morning I was kind of bored. I put
up a new spice rack in my kitchen, so I took a picture of it. I wanted to share that with everyone.
Yes, you should all be laughing right now. If you're not, oh well, I tried. All right,
why are we not here? Well, first of all, it's not a demo of 5,000 different kinds of honeypots.
That would be kind of silly. I have 45 minutes. It's not going to work very well. I'm not going to
show you all of my honeypots. If you follow me on Twitter, you know I have honeypots all over the
world. I have them scattered everywhere. I have them in my apartment. I have them in a lot of
different places. Showing you my honeypots would be counterproductive. It's not going to do anything,
but I will show you some without showing you where they're located, and they'll make a point.
Oops, I have to come back, sorry. The whole point of this is there must be a better way
to do security, because if we keep spending all this money, there really has to be a better way,
and I think honeypots are the way to do it. Let's quick talk about what is an incident or a breach.
Some key points, most breaches are not zero-day. They're not fancy. You don't get breaches from
vulnerability scanners. Most breaches come from configuration issues. Ooh, this interests me,
because it opens up the door to how I can modify my honeypots. A close second is compromised
credentials. I worked at a company many years ago where, well, most companies are smart enough that
they will change the administrator account in their domain. They don't want it to be administrator,
but why don't you put back an administrator account and make it a honey credential? Think
about that. We'll talk about that a little bit more. Also, trailing in third are overprivileged
users. That's not going to fit well into our honeypots as much as everything else.
Let's look at a couple of quick examples of IoT issues. This was a funny one. A university was
attacked by its own light bulbs, vending machines, and lampposts. Answer a question for me. I know
you can't, but you could in Discord. What in God's name were the light bulbs, the vending machines,
the lampposts doing on the same network as the rest of the university? It should not have been
there. Also, there are industrial issues that we deal with all the time. An oil rig was shut down
a couple of years ago. Why? Because there was an IoT sensor on the oil rig that actually detected
whether the oil rig was tipping. It was an ocean oil rig. Somebody got in. They made the sensor
read. I want to say it was like a 12 degree tilt and the sensor was set. If it went to 10 degrees
or over, then it would shut down the oil rig. Nobody bothered to check that damn sensor to
see if it was misreading or something was wrong with it. Also, there was a blast furnace that
happened to have been owned by the government. It malfunctioned, so to speak. Well, what happened
was somebody got into it. They raised the temperature, shut off the shut off valves.
The way this kind of solved itself was very simple. It melted. It melted down. No one was hurt.
Although, if you were a blast furnace, I guess you might have been hurt in that particular case.
This one I will never understand. Why are toilets connected to networks? Seriously. I mean, are we
what? We're monitoring water? I don't know. But this happens all over Europe and Asia and so on.
It does bring new meaning to the word system dump. But anyway, yes, I would never put a toilet
on the network. All right. Now we're going to talk about one of my favorite things,
honeypots. I love them. I think they are much more valuable than people give credit.
Honeypots or deception technology. People have changed the name lately. They love to call them
deception technology. Why? I don't know. They wanted something that sounded more professional.
I guess deception technology. And yet I have found many commercial honeypots are nothing more
than open source versions that have been repackaged with a fancy front end and a distribution model
that allows it to be deployed to your environment much easier. But it's still the open source
solution. So why can't I do that myself with an open source honeypot, maybe Ansible, Puppet,
Chef, whatever is your tool of choice, use that to deploy your honeypots and manage them.
Maybe we can. But think of a honeypot as nothing more than a resource with no value.
The value of that honeypot is someone using the resource. My honeypots are attacked all the time.
I typically will not set my honeypots up to hack back. Who knows? Maybe someday I will.
But I haven't done it yet. Also, these are incredibly important points. Probably the
most important aspect of honeypots is deployment. Where are you going to put them? I made a comment
a few minutes ago. I have honeypots all over the world. I don't just put them out just randomly
for the hell of it. There might be a couple that I might just place in a country on a VPS somewhere
just to see if it gets attacked. But most of them are very strategically placed, especially within
my own environment, my own networks, etc. So think about it. We're going to talk about that detail
coming up. Architecture. Customization. In other words, planning. You know, there are hundreds,
thousands, I don't know, I've lost track. There are hundreds of types of honeypots out there.
We're going to talk about that. In fact, let's talk about it right now. Here's a good list of
some of my favorite honeypots. ADHD. Great tool. Comes from Active Countermeasures. It is free.
Excuse me. And, you know, go download it. Start playing with it. It has numerous honeypots built
into it, a couple of which are my favorite as well. Honey badger and honey badger red.
I love honey badger and I'll talk about that coming up. There's another place to generate
canary tokens. There is also Open Canary, which is a great honeypot. If you want to build your
own custom honeypots out of hardware and software, take a look at the Mozilla project called Web
Things. There's a whole framework there that you can actually build your own honeypots with raspberry
pies and so on. Teapot is still a good one to get started with. Start playing. There's a new one
that replaced the Modern Honey Network a couple of years ago. It's called Community Honey Network.
Take a look at that one. Twisted Honeypot's another. But I think you're getting the idea.
Also, what about the real thing? What if I have a server that I could install
Windows Server on it, whatever year you want to pick, why couldn't that be an actual honeypot?
Why does it have to have special software on it to be a honeypot? I'll tell you this right now.
I have a mail server in my own personal network that is a fake mail server. If you look at my MX
record, you will see that I have a couple of mail servers in there. But then there's this other mail
server that sits on the exact same network, but it's not part of the MX record. It's a honeypot.
And I catch people trying to spam it and get in and do things all the time because the bots find it.
The whole point here is there are lots and lots of honeypots. This is a great website or a GitHub
link where the person maintains a great list of all of the honeypots, so keep that in mind. Also,
I will be making my slides available after this talk up on my GitHub repo. My GitHub repo is the
same as my Twitter handle, Rainbow Cat. So this will be up later tonight. Also, remember I said
lateral movement. Lateral movement is critical. And honeypots are one of your best tools to detect
lateral movement. Just recently I bought a new IoT device. I plugged it into my network, and one
of my honeypots, which is made to detect port scanning, and I have it here in my own place,
kind of went off. Why? Because the device that I plugged in started port scanning my network.
Without going into details, because I have a bug bounty in place for this, it turns out that the
vendor had actually installed somehow some beta... or their testing software, not beta,
their testing software got put on a piece of equipment that got shipped to production,
that got shipped and purchased. I'm wondering whether that's a true story, but we can talk
about that offline. The whole point is we have to find a way to detect lateral movement. Honeypots
are the way to do it. We're going to see that. All right. Everyone should know what OODA is.
If you don't know what OODA is, you're about to. OODA stands for Observe, Orient, Decide,
and Act. And this came from the military. It came from the military on how you do warfare,
how you do all of this. And it also was adopted by a lot of security professionals.
Well, in the honeypot world, I think we need our own little mnemonic, if you will. And it's
called CCAD. CCAD stands for Confuse, Confound, my favorite, Annoy, and, of course, Delay.
Why? Because if I can delay an attacker because they're stuck in a honeypot, then I'm going to
have more time to find them and keep them from getting into my actual valuable resources.
So, yeah. I love this. We'll see it a little more later. Don't forget about monitoring. You can
deploy all the honeypots you want, but people keep forgetting to monitor them. I use a great
tool. I just put it up here. I don't represent them. It's open source. It's called Wazoo,
or some people say Waza. But go take a look at it. It's an agent configuration and also a sim
built in. You put the agents on your honeypot. It does a lot of analysis of all the honey data
or all the attack data that's coming into your honeypots, sends it up to your sim, and it's
tremendous. I just like to mention that because you should pick something to be able to monitor
your honeypots. All right. Let's talk about deployment. This is the big part. I can't say
it enough. Plan, plan, plan. This should be 90% of your time when it comes to deploying honeypots,
especially when it comes to IoT. You can't just build a little IoT honeypot and go,
oh, I'll just put it on my network. No. You have to design your network such that it looks like
this is a valid honeypot. I'm going to show you coming up a honeypot... let me... I'll stop right
there. I'll show you something and we'll talk about it then. Also, two types of honeypots I
recommend. Low interaction, medium interaction. We don't need higher interaction honeypots.
We want them to get delayed and get stuck, but we don't need them mucking around with things that
are very complex and difficult. Most of my honeypots, if I am deploying them within an
environment, run on Raspberry Pis. If I could turn my camera, I would show you. I have a
table down here that has about 25 Raspberry Pis on it in various forms of
destruction and rebuilding and everything. Raspberry Pis are great for it. Also,
think about honeyports, honeypots, honeytokens, honeycredentials. It's easy to build a honeypot,
but it's also going to be a little more difficult because we have to customize it.
And this is where the hard part comes in. This is why I say ding, ding, ding, this is important.
I'm going to show you a test coming up here in just a second, and we're going to see how many
of you pass. Also, if you're going to put a honeypot out there, real versus self-signed
certificates. Self-signed certificates is the most dead-awful giveaway that this is a honeypot
versus a real resource. And these days with Let's Encrypt, there's no reason you can't put
a real certificate on a honeypot. Also, how difficult would it be if you took an actual
application, a production application that you have, but put it on a honeypot server.
And you might take maybe some of the data out of it, maybe, you know, ask your application team
to modify it a little bit. But the point is, you put the actual application on a honeypot server.
So that way, when they're trying to attack it or trying to get into it, it looks like they're
getting into something real. I'm going to show you an example of that coming up in just a second.
I already mentioned, put a host intrusion detection on it. My favorite being Wazoo,
which is a fork of OSEC from several years ago. There are some rules, and you do have to do some
tuning work, but it's very, very important. Now, where do you put your honeypots? Well,
I put them everywhere. In server farms, in cloud storage, IoT, the IoT one's coming up in a second.
Put them out my DMZ, out for mail servers, all over the place. Remember, stop and think about it.
You know, you want WordPress, you want Raspberry Pis, spin up some VMs or some VPSs out there.
Also, what about a point of sale system? I'll tell you one about that coming up here in just a second.
All right, normally this is interactive. It's not very interactive right now, but if you were
looking at this, and I'm hoping you can see my mouse, you should be able to. So we see this is,
I got into this device. It looks like it says Linux RT AC 5300. Normally, I'm asking everybody
in the room, what do you think this is? And most people will yell out, oh, it looks like it's an
Asus router, and in fact, it's an AC 5300. No, it's not. It's actually Kauri. Kauri is an SSH
Telnet honeypot tool that can be configured to look like just about anything. In my case, what I did
is I went to an actual AC 5300. I gathered all of the screenshots and the... not screenshots,
all of the data files. I did DFs. I did LSs. I captured all of the data I could off an actual
AC 5300. I then went to my Kauri configuration, and I started modifying all of the files here,
because that's all you have to do. If you can modify the files, then suddenly this looks like
an actual Asus 5300. Now, if we were in my live version of this where people could
yell out things, you might yell out, but what about the HTTP interface of the router? Well,
that is in here too. I just didn't get a screenshot of it. I should have, but I captured
everything from the interface. I logged in. I got all of the HTML files after doing some
screen dumps and so on. I then went to my Kauri device. I modified it a little bit because Kauri
normally doesn't have a web server on it. Well, because you're installing Kauri on a base version
of Linux, there's nothing to stop you from putting Apache on there. I put Apache on there. I put
all of my configurations, so when you hit the web interface, it looked exactly like the Asus 5300.
Now, here's the hard part. I had to go, well, wait a minute. I can't just drop it on a network
somewhere, because why would someone have a wireless router sitting just randomly on a
network? No. What I had to do was create a DMZ in my environment, set it up so it looked like this
was my Xfinity connection, so anyone coming to my Xfinity system would see an Asus 5300 exposed
and think they found the keys to the kingdom. And they would sit there forever trying to break
into it, leaving my real firewall, which of course may be pfSense, who knows? Or it might be open
sense, because I like that better. The point is, don't forget about the configurations. That's in
the customization. But that's how easy it is to take a simple firewall tool, in this case Kauri,
and modify it to look like something else. Now, my other question. If you were looking at this,
what would you say this is? And of course, actually, let me... oops, wrong one. Let me see
if I can see where my Discord window went. Is anybody asking any questions? No. Okay.
What I was going to say is, in Discord, tell me, what do you think this is? I'm looking
at the Discord channel right now, the top questions text. So does this look like what?
OpenVPN? And I know there's a delay, so I'm kind of waiting and waiting and see what anybody says.
But it looks like an OpenVPN server. I assume you would all say that. And I'm pausing a little
bit to see what Discord says. People are typing. Yes, yes. Okay. But it's not. It's actually
a honeypot. What did I do? I installed the OpenVPN server on it, but here's the change.
When you click this to download the software, it downloads HoneyBadger.
HoneyBadger runs on the attacker's machine. It sends back a trace, and it says,
guess where I am? The whole point here is, yes, I used OpenVPN, the actual application.
But I modified it so it does things that I want it to do and not just what it was
written to do. I have a real OpenVPN server, but this one is fake.
Okay. Some more examples. Okay. I mentioned point of sale. I did this at a previous company
many, many years ago where we have point of sale servers. They kept getting hacked,
and they kept getting hacked with skimmers being put on them. So any time, you know,
they were credit card, typical credit card skimmer software. Well, we couldn't find who
was doing it. It was happening at multiple locations. So what did we do? We built Raspberry
Pis. In this case, it was RPi3s. We took RPi3s, configured them to look exactly like Oracle's
micro POS system. So the interface was there, and everything was there. We then drop shipped
them to the various locations that we had, and within a week of being installed in our locations,
one of them was attacked, and the skimmer software was attempted to be installed,
and we finally found out where it was coming from. And it was contractors and blah, blah, blah.
Doesn't matter. The point was the honeypots caught the bad actors, all because we stopped
and thought about where to put these things, because that's what's important, where to put them.
Also, think about compromised credentials. How many people have AWS keys that are stored out
in GitHub? And they better be fake AWS keys, because the minute they're compromised, you're
going to find out who is really trying to attack you, and not just some fake threat report that
comes from some company that says, oh, you're being attacked by this country and these people
and blah, blah, blah. Most of the times they're telling you about attacks you already know about.
So think about credentials that you can use. And if you ever have a user that comes to you and says,
my account was compromised because I clicked on a phishing account. Well, here's what you do.
Change their account name right away. Create a honey credential of the one that was compromised.
It works every time. This one I don't have time to talk about.
I had another one where we had a server room, a data center. And we knew that we had people
that seemed to be getting into systems physically. They were connecting up a crash cart and they
were logging into servers. We couldn't catch them because the entire place wasn't covered by
cameras. This was maybe about ten years ago. So we had an issue. But I guess it wasn't ten years
ago. It was more like eight. What we did was we created QR codes. We stuck them on the bottom
of these servers. And if you scanned it, because we told people about it, if you scanned it,
it would give you emergency credentials to log in to fix a server. Well, no. What it really did was
emailed us saying that somebody just scanned the QR code. And that's how we found who was doing it.
Again, honeypots. I already told you about my mail server. This is an easy one to do. And it's not
that hard. Also, set up a webcam, a fake one, of course. It's very easy to mimic what a webcam
software looks like on a Raspberry Pi. You can expose it on your internet via some port routing
between your firewall and everything. And even if it's just on your DMZ. The point here is I did
this years ago. If you all remember Mirai, I had done this. I had fake webcams out on my network.
I didn't always get a chance to analyze them. Because I didn't have them set up pointing to a
sim. So, this is how I learned I need to get a sim set up and have everything being correlated
and analyzed. Because I found out that I had the Mirai payload on one of my honeypots two months
after Mirai hit. The problem was the payload had been dropped two months before Mirai hit. So,
if I had only been looking at my honeypots more regularly, I might have found Mirai before it
actually did what it did. Oh, well. Think of S3 buckets. When you stop and think about IoT devices,
what do they talk to? They talk to the cloud. In many cases, they talk to all sorts of things in
the cloud. And they can also talk to S3 buckets and drop data in it. Put a fake S3 bucket out
there. Generate some weird data. Drop it in there. Put some fake credentials out that are available
that would access that S3 bucket. And then when the credentials are compromised, you get an alert
for that. But then when they're used to access the S3 bucket, which has bogus data in it, you also
know who's actually actively trying to attack. Think about honey ports. This is going to be
important. We're going to have to speed up because I have a little less time. Here's an example of a
great honeypot tool. This is on the ADHD package that you can look at. It's called Port Spoof.
So here you see I did an Nmap from port 200 to port 300 of a host called Gonzo. And it returned
all of these funky, what are pretty normal services and so on that you see running on there.
But what really happened is this is running a tool called Port Spoof. And Port Spoof actually
only listens on one port, but it has some redirect via IP tables on that server. So anything that
hits it, it says, oh, let me go and return all of this bogus data. But here's the best part of it.
Because this one returned pretty quickly. But here's another example. Here we see that, okay,
oops, the attacker decided to do an Nmap minus A of Gonzo. So we see we've got four minutes,
43 seconds elapsed. It's still running its stealth scan, doesn't find much. It says it's got 75%.
We've got nine minutes, 58 seconds. A minute 30, it says it's got remaining. It's still running
here. It's only at 77%. And it's still going. And actually, I'm sorry, looking at the wrong
numbers over here. My timing is over here. It went from 453 to 739. And it only made it 3%.
Why? Because port spoof actually slows it down. It's like a tar pit. It drags it in. Remember
CCAD, that D is delay. If I can delay the attacker while they screw around trying to attack this host
in my own network, then the odds are I will have spotted them because my sim will alert me when
port spoof triggers. Simple. So now I know where they're coming from. I know what they're trying
to do. Yeah. You know, think about this. Also, I will mention this one. I have a screenshot of it.
I may add it in here. I'm sure you all have heard of, have I been pwned? And a lot of people go
there. They put in their email address. And they get a report back saying whether it's been
compromised or not. I was thinking about that one day. And I stood up a funky domain similar
to have I been pwned. It was only up for about a week. I took it down very quickly because I was
very surprised. It said have I been pwned, but instead of asking you to enter your email address,
it asked you to enter your password to check to see if that password has been compromised.
In one week, I had thousands of people typing in their passwords. I was floored, thinking,
good Lord, all I did was stand up a simple website that said here, enter your password.
And people started doing it. It's crazy what people do. This is why honeypots have so much
power in gathering information. So please, this is a dated quote. It's from 2014.
But I think you all would agree. 84% of organizations that were breached had evidence
of the breach in their log files. The problem is logging of all their actual applications
is terabytes and petabytes and so on. It's huge. But honeypots are not going to be false
positives. Honeypots, when they are triggered, they are real attacks. Why? Because you don't
just drop them all over the place. I did have one place that we put a bunch of honeypots and
we had all the department or the main department head actually told all the other managers where
we put the honeypots. And I was like, seriously, why did you do that? The whole point of having
internal honeypots is to catch insider threats, not for you to tell everybody. So we had to pull
them all back, wait about a month, and then redeploy them so nobody knew where they are.
The point here is planning about where you're going to put honeypots. So here are your key
takeaways from today. Remember CCAT. Confuse, confound, annoy, delay. Also, honeypots have
low false positives. Feed them to a separate sim. Don't feed them to the same sim that you have
collecting all your other data. They are great tools for detecting lateral movement. Why? Because
what are people looking for when they get inside your environment? I can only imagine if Equifax
had real honeypots inside their network, they might have actually caught them before they got
away with things. They're cost effective as hell if you're not going out and spending money on
commercial versions. And remember, honeypots are there to defend but mostly to detect your
environment. And what I really want to say is honestly the... well, I'll get to it in a sec.
Let's talk about this. If you want to only work with IoT honeypots, I recommend Home Pwn. It's a
a kit for testing and looking at IoT devices. But what I use it for is for gathering all of the
screenshots, the data and everything of white bulbs and thermostats and all these things so I
can mimic them and make my honeypots look exactly like those devices. That's one of the things I do
with it. Also, honeypots are great for forensics. Keep that in mind. Hell, I had Mirai. I just didn't
know I had it. But what I really think is important here is honeypots are real threat intel.
They are not fake threat intel. They are giving you information that is valid on who's attacking
you. It's about thinking differently. I can't watch hundreds of thousands of servers in my
environment every day unless I start to think about it slightly differently. And that's what
we do with honeypots. So I can't say it enough. Plan, plan, plan. That is the key thing. Honeypots
are easy to deploy, but planning the deployment is what's important. Thank you all very much.
I hope you enjoyed this talk. I will be posting my slides. I am working on an actual honeypot
customization workshop. I'm almost there. I've done a couple of walkthroughs. The problem has
been I need to work on the labs. But once I get this done, I'm going to give it for free virtually.
So, yeah, I'll be doing that. Watch my Twitter feed. You'll see information about that coming
up within a couple of months. I have to get through my move from where I am now out to
Washington. So thank you all very much. Hope you had a good time. Hope you liked my spice rack
joke. If not, oh, well. And here's to Casa Noble and Yeho Tequila.