start	end	text
0	6720	Thank you so much and thank you completely to the IoT village and all the volunteers and the staff
6720	14800	because I know we are coming down to the wire and they have got to be exhausted and just,
14800	21320	you know, kind of melting in all of this. So thank you all to the team. Let's get started
21320	28420	because I have to get off of this slide before it gets evil and comes out and does attack.
28420	37840	Do you know how hard it is to find a refrigerator like this? Anyway, this is who I am. I am the CEO
37840	44080	of B-Sides Chicago. I was the COO for Diana Initiative last year. I also am part of B-Sides
44080	50240	Pittsburgh. Why? Because I live in Pittsburgh currently. My first DEF CON was number three.
50240	56620	How many people are that old? There were 16 speakers then. I have got a lot of years in
56620	64400	security emphasis in blue teams. I used to be purple. I do a lot of DEF SEC ops. I sort of was
64400	70140	based in Pittsburgh the last year and a half but in 16 more days I will be in beautiful Kirkland,
70140	76080	Washington. I can't wait. I am a natural creature of winter and you will typically find me as you
76080	83360	will see right here sipping a Casanova while simultaneously defending my systems using open
83360	88880	source magic spells and dancing flamingos. We don't have time for dancing flamingos but we
88880	102020	damn well have time for tequila. Oh great. And now I'm coughing. That never happens. Wow. Honeypots,
102020	109900	refrigerators and internet of threats. I like to call it that instead of internet of things.
110880	115640	But yeah, these are some of my absolute favorite things. We're going to talk about this stuff.
115640	122000	And oh yes, I'm a drummer too if you haven't quite figured that out. All right. The views here and
122000	128700	opinions and everything I show you today are mine. They are no one else's. Definitely not any my
128700	137120	employer, past or present. Please take anything I show you with a grain of salt. Don't try this at
137120	147360	home as they say on, oh God, I just forgot the TV show. Oh well. It's one of those days. And
147360	151480	those of you with an overwhelming fear of the unknown will be happy to know that if you read
151480	157600	this disclaimer backwards, there is no hidden message that will be revealed. Although some
157600	163660	people want me to put one in there. I think I may do that the next time. All right. Why are we here?
164340	169660	Couple of important points. I always like to present this in any of my talks. And I need to
169660	175860	update it for 2019. I just have to get the information on it. But let's just look at 2018.
176200	185180	In 2018, companies spent over $114 billion on fancy software, fancy hardware, you know,
185180	191820	all the blinky boxes, the blinky software, all that crap. Attacks and breaches continue to go up.
191820	197620	The security stuff that we buy, whether it's EPP, whether it's firewalls, whether it's who
197620	204720	knows whatever it is, it's vulnerable. Another very important point that I always like to make
204720	214300	is lateral movement is so often overlooked. I'll talk about that coming up a little bit more.
214300	220840	Then think about this. What about... I've actually had people tell me that,
220840	227640	ooh, our security architecture is incredibly unique. Really? I don't think so. There's not
227640	235780	that many ways to make it unique. Also, what is your typical day? Normally, I'm in a room
235780	243280	presenting this, so I would say by a show of hands, how many of you spend 50% of your time
243280	250980	checking boxes that have to do with compliance? I can't see if you're raising your hands,
250980	255260	but pretend you are and put it in Discord, because I'd be really curious to look once
255260	263020	I get off this screen. If you don't have this book, I recommend that you get it. It's called
263020	269800	Offensive Countermeasures by John Strand. And this quote is directly out of this book. I love it.
269800	276560	Instead of brilliance, we've standardized mediocrity. And what I take from that is the
276560	281920	fact that, yeah, we just go out and spend a few bucks here and there. We buy some common
281920	288680	off-the-shelf hardware, software, whatever. We plug it in, and we go, woo, we're protected.
288980	294420	I don't think so. If that were the case, there wouldn't be the Equifaxes of the world,
294420	303400	the Capital Ones, and so on. All right. I love this cartoon, because this kind of says it all.
303400	307920	In this corner, we have firewalls, encryption, antivirus, software, et cetera, et cetera,
307920	315760	et cetera. And in this corner, we have Dave. And the best part about this is up until recently,
315760	322680	my boss, his name was Dave. And when I showed him this, I just couldn't stop laughing,
322680	331100	because it was perfect. But it really is true, right? Because it's all about our users that
331100	337220	continue to do things or get compromised or something happens. And we need a way to figure
337220	345780	it out, especially in two aspects of it. One, we're all working remotely. And two, we have a lot
345780	357300	of IoT stuff on our networks. So we have to do something about that. Also, I saw this just the
357300	366300	other day. This $12 course can turn you into an ethical hacking pro. I guess I did it wrong. I
366300	371800	don't know. I went to school for this. Although, I was a music major, so what do I know? Now,
371800	376520	I just have to put that up for your entertainment, because I do think it's kind of funny. Don't fall
376520	385440	for these scams. Most of these courses are crap. Honestly, set up a lab in your environment. I'll
385440	392300	give you one little tip. Whenever I interview people, one of the first questions I ask engineers,
392300	397880	security engineers, and so on, is tell me about your home lab. I have actually had security
397880	404820	engineers tell me, I don't have time for that. Really? Next. So keep that in mind. You better
404820	411740	have a really good home lab. This is something I want to point out, because these are screenshots
411740	419020	from a recent security conference before COVID, before we went to virtual conferences. I was
419020	426660	physically at a conference. It doesn't matter which one. But the point here is this. Here I
426660	434720	had a GoPro that allowed me to connect to it. And I actually started taking screenshots from
434720	440640	this person's GoPro. I was trying to figure out where they were in the room based on the shots I
440640	447600	was able to see. I had another device that was attempting to pair with me. I actually was able
447600	456000	to pair with it. I also was running an evil AP, and I was kind of capturing all the SIDS that were
456000	463400	running around this particular security conference. The point is, I usually do this every year at
463400	468860	DEF CON. So if you see me walking around, I'll usually have a purse, and in that purse will be
468860	476700	my evil AP. And the beauty of carrying a purse is it hides very neatly in your purse. But I look at
476700	482400	all of this stuff, and I kind of analyze it when I get back. And it's fascinating to me that as
482400	489260	security professionals ourselves and hackers and so on, we make the same mistakes that a lot of
491040	498860	amateurs and new people make because they don't clear out their Wi-Fi. They don't do things that
498860	505460	they should be doing. There was also one other thing. This morning I was kind of bored. I put
505460	510480	up a new spice rack in my kitchen, so I took a picture of it. I wanted to share that with everyone.
511140	518700	Yes, you should all be laughing right now. If you're not, oh well, I tried. All right,
518700	526480	why are we not here? Well, first of all, it's not a demo of 5,000 different kinds of honeypots.
526480	532920	That would be kind of silly. I have 45 minutes. It's not going to work very well. I'm not going to
532920	538960	show you all of my honeypots. If you follow me on Twitter, you know I have honeypots all over the
538960	546600	world. I have them scattered everywhere. I have them in my apartment. I have them in a lot of
546600	552960	different places. Showing you my honeypots would be counterproductive. It's not going to do anything,
552960	560040	but I will show you some without showing you where they're located, and they'll make a point.
560960	569440	Oops, I have to come back, sorry. The whole point of this is there must be a better way
569440	577020	to do security, because if we keep spending all this money, there really has to be a better way,
577020	582940	and I think honeypots are the way to do it. Let's quick talk about what is an incident or a breach.
583200	589280	Some key points, most breaches are not zero-day. They're not fancy. You don't get breaches from
589280	597200	vulnerability scanners. Most breaches come from configuration issues. Ooh, this interests me,
597200	606560	because it opens up the door to how I can modify my honeypots. A close second is compromised
606560	615020	credentials. I worked at a company many years ago where, well, most companies are smart enough that
615020	621560	they will change the administrator account in their domain. They don't want it to be administrator,
621560	628840	but why don't you put back an administrator account and make it a honey credential? Think
628840	634400	about that. We'll talk about that a little bit more. Also, trailing in third are overprivileged
634400	642680	users. That's not going to fit well into our honeypots as much as everything else.
644080	651960	Let's look at a couple of quick examples of IoT issues. This was a funny one. A university was
651960	659360	attacked by its own light bulbs, vending machines, and lampposts. Answer a question for me. I know
659360	665620	you can't, but you could in Discord. What in God's name were the light bulbs, the vending machines,
665620	673800	the lampposts doing on the same network as the rest of the university? It should not have been
673800	682380	there. Also, there are industrial issues that we deal with all the time. An oil rig was shut down
682520	689240	a couple of years ago. Why? Because there was an IoT sensor on the oil rig that actually detected
689240	696640	whether the oil rig was tipping. It was an ocean oil rig. Somebody got in. They made the sensor
696640	703860	read. I want to say it was like a 12 degree tilt and the sensor was set. If it went to 10 degrees
703860	710600	or over, then it would shut down the oil rig. Nobody bothered to check that damn sensor to
710600	716100	see if it was misreading or something was wrong with it. Also, there was a blast furnace that
716100	723340	happened to have been owned by the government. It malfunctioned, so to speak. Well, what happened
723340	729000	was somebody got into it. They raised the temperature, shut off the shut off valves.
729000	737260	The way this kind of solved itself was very simple. It melted. It melted down. No one was hurt.
737260	743560	Although, if you were a blast furnace, I guess you might have been hurt in that particular case.
743560	751860	This one I will never understand. Why are toilets connected to networks? Seriously. I mean, are we
751860	759000	what? We're monitoring water? I don't know. But this happens all over Europe and Asia and so on.
759000	767660	It does bring new meaning to the word system dump. But anyway, yes, I would never put a toilet
767660	773780	on the network. All right. Now we're going to talk about one of my favorite things,
773780	781320	honeypots. I love them. I think they are much more valuable than people give credit.
781780	788480	Honeypots or deception technology. People have changed the name lately. They love to call them
788480	795440	deception technology. Why? I don't know. They wanted something that sounded more professional.
795440	802460	I guess deception technology. And yet I have found many commercial honeypots are nothing more
802460	811500	than open source versions that have been repackaged with a fancy front end and a distribution model
811500	819560	that allows it to be deployed to your environment much easier. But it's still the open source
819560	828080	solution. So why can't I do that myself with an open source honeypot, maybe Ansible, Puppet,
828080	835240	Chef, whatever is your tool of choice, use that to deploy your honeypots and manage them.
835340	842360	Maybe we can. But think of a honeypot as nothing more than a resource with no value.
842360	852160	The value of that honeypot is someone using the resource. My honeypots are attacked all the time.
852160	859340	I typically will not set my honeypots up to hack back. Who knows? Maybe someday I will.
859340	868320	But I haven't done it yet. Also, these are incredibly important points. Probably the
868320	876400	most important aspect of honeypots is deployment. Where are you going to put them? I made a comment
876620	883140	a few minutes ago. I have honeypots all over the world. I don't just put them out just randomly
883140	890760	for the hell of it. There might be a couple that I might just place in a country on a VPS somewhere
890760	897560	just to see if it gets attacked. But most of them are very strategically placed, especially within
897560	904360	my own environment, my own networks, etc. So think about it. We're going to talk about that detail
904360	913440	coming up. Architecture. Customization. In other words, planning. You know, there are hundreds,
913440	920520	thousands, I don't know, I've lost track. There are hundreds of types of honeypots out there.
921040	927140	We're going to talk about that. In fact, let's talk about it right now. Here's a good list of
927140	935080	some of my favorite honeypots. ADHD. Great tool. Comes from Active Countermeasures. It is free.
936680	944380	Excuse me. And, you know, go download it. Start playing with it. It has numerous honeypots built
944380	949300	into it, a couple of which are my favorite as well. Honey badger and honey badger red.
949300	955580	I love honey badger and I'll talk about that coming up. There's another place to generate
955580	963860	canary tokens. There is also Open Canary, which is a great honeypot. If you want to build your
963860	971240	own custom honeypots out of hardware and software, take a look at the Mozilla project called Web
971240	978140	Things. There's a whole framework there that you can actually build your own honeypots with raspberry
978140	986000	pies and so on. Teapot is still a good one to get started with. Start playing. There's a new one
986000	991860	that replaced the Modern Honey Network a couple of years ago. It's called Community Honey Network.
991900	998560	Take a look at that one. Twisted Honeypot's another. But I think you're getting the idea.
998560	1007400	Also, what about the real thing? What if I have a server that I could install
1008180	1015810	Windows Server on it, whatever year you want to pick, why couldn't that be an actual honeypot?
1016120	1022560	Why does it have to have special software on it to be a honeypot? I'll tell you this right now.
1022560	1030980	I have a mail server in my own personal network that is a fake mail server. If you look at my MX
1030980	1037140	record, you will see that I have a couple of mail servers in there. But then there's this other mail
1037140	1044920	server that sits on the exact same network, but it's not part of the MX record. It's a honeypot.
1044920	1054280	And I catch people trying to spam it and get in and do things all the time because the bots find it.
1054400	1063100	The whole point here is there are lots and lots of honeypots. This is a great website or a GitHub
1063100	1070580	link where the person maintains a great list of all of the honeypots, so keep that in mind. Also,
1070580	1077540	I will be making my slides available after this talk up on my GitHub repo. My GitHub repo is the
1077540	1085480	same as my Twitter handle, Rainbow Cat. So this will be up later tonight. Also, remember I said
1085480	1094120	lateral movement. Lateral movement is critical. And honeypots are one of your best tools to detect
1094120	1103580	lateral movement. Just recently I bought a new IoT device. I plugged it into my network, and one
1103580	1111380	of my honeypots, which is made to detect port scanning, and I have it here in my own place,
1111380	1118040	kind of went off. Why? Because the device that I plugged in started port scanning my network.
1119640	1125640	Without going into details, because I have a bug bounty in place for this, it turns out that the
1125640	1133320	vendor had actually installed somehow some beta... or their testing software, not beta,
1133320	1140120	their testing software got put on a piece of equipment that got shipped to production,
1140120	1146700	that got shipped and purchased. I'm wondering whether that's a true story, but we can talk
1146700	1152480	about that offline. The whole point is we have to find a way to detect lateral movement. Honeypots
1152480	1158620	are the way to do it. We're going to see that. All right. Everyone should know what OODA is.
1158700	1167860	If you don't know what OODA is, you're about to. OODA stands for Observe, Orient, Decide,
1167860	1173780	and Act. And this came from the military. It came from the military on how you do warfare,
1173780	1180500	how you do all of this. And it also was adopted by a lot of security professionals.
1180500	1189140	Well, in the honeypot world, I think we need our own little mnemonic, if you will. And it's
1189140	1202840	called CCAD. CCAD stands for Confuse, Confound, my favorite, Annoy, and, of course, Delay.
1202840	1210260	Why? Because if I can delay an attacker because they're stuck in a honeypot, then I'm going to
1210260	1218940	have more time to find them and keep them from getting into my actual valuable resources.
1219720	1226020	So, yeah. I love this. We'll see it a little more later. Don't forget about monitoring. You can
1226020	1233780	deploy all the honeypots you want, but people keep forgetting to monitor them. I use a great
1233780	1239380	tool. I just put it up here. I don't represent them. It's open source. It's called Wazoo,
1239380	1247520	or some people say Waza. But go take a look at it. It's an agent configuration and also a sim
1247520	1255400	built in. You put the agents on your honeypot. It does a lot of analysis of all the honey data
1255400	1261760	or all the attack data that's coming into your honeypots, sends it up to your sim, and it's
1261760	1267480	tremendous. I just like to mention that because you should pick something to be able to monitor
1267480	1275040	your honeypots. All right. Let's talk about deployment. This is the big part. I can't say
1275040	1283940	it enough. Plan, plan, plan. This should be 90% of your time when it comes to deploying honeypots,
1283940	1289760	especially when it comes to IoT. You can't just build a little IoT honeypot and go,
1289760	1296080	oh, I'll just put it on my network. No. You have to design your network such that it looks like
1296080	1306460	this is a valid honeypot. I'm going to show you coming up a honeypot... let me... I'll stop right
1306460	1311820	there. I'll show you something and we'll talk about it then. Also, two types of honeypots I
1311820	1317420	recommend. Low interaction, medium interaction. We don't need higher interaction honeypots.
1318080	1325640	We want them to get delayed and get stuck, but we don't need them mucking around with things that
1325640	1331080	are very complex and difficult. Most of my honeypots, if I am deploying them within an
1331080	1336200	environment, run on Raspberry Pis. If I could turn my camera, I would show you. I have a
1336200	1343440	table down here that has about 25 Raspberry Pis on it in various forms of
1344520	1352440	destruction and rebuilding and everything. Raspberry Pis are great for it. Also,
1352440	1361780	think about honeyports, honeypots, honeytokens, honeycredentials. It's easy to build a honeypot,
1361780	1367100	but it's also going to be a little more difficult because we have to customize it.
1367180	1374080	And this is where the hard part comes in. This is why I say ding, ding, ding, this is important.
1374260	1379400	I'm going to show you a test coming up here in just a second, and we're going to see how many
1379400	1385320	of you pass. Also, if you're going to put a honeypot out there, real versus self-signed
1385320	1392960	certificates. Self-signed certificates is the most dead-awful giveaway that this is a honeypot
1392960	1400960	versus a real resource. And these days with Let's Encrypt, there's no reason you can't put
1401680	1412680	a real certificate on a honeypot. Also, how difficult would it be if you took an actual
1412680	1421220	application, a production application that you have, but put it on a honeypot server.
1421940	1428820	And you might take maybe some of the data out of it, maybe, you know, ask your application team
1428820	1438960	to modify it a little bit. But the point is, you put the actual application on a honeypot server.
1438960	1443980	So that way, when they're trying to attack it or trying to get into it, it looks like they're
1443980	1448980	getting into something real. I'm going to show you an example of that coming up in just a second.
1449320	1456460	I already mentioned, put a host intrusion detection on it. My favorite being Wazoo,
1456460	1462320	which is a fork of OSEC from several years ago. There are some rules, and you do have to do some
1462320	1468680	tuning work, but it's very, very important. Now, where do you put your honeypots? Well,
1468680	1475460	I put them everywhere. In server farms, in cloud storage, IoT, the IoT one's coming up in a second.
1475460	1484000	Put them out my DMZ, out for mail servers, all over the place. Remember, stop and think about it.
1484560	1492720	You know, you want WordPress, you want Raspberry Pis, spin up some VMs or some VPSs out there.
1492720	1500260	Also, what about a point of sale system? I'll tell you one about that coming up here in just a second.
1500260	1506360	All right, normally this is interactive. It's not very interactive right now, but if you were
1506360	1513940	looking at this, and I'm hoping you can see my mouse, you should be able to. So we see this is,
1513940	1521980	I got into this device. It looks like it says Linux RT AC 5300. Normally, I'm asking everybody
1521980	1528880	in the room, what do you think this is? And most people will yell out, oh, it looks like it's an
1528880	1541480	Asus router, and in fact, it's an AC 5300. No, it's not. It's actually Kauri. Kauri is an SSH
1541480	1551280	Telnet honeypot tool that can be configured to look like just about anything. In my case, what I did
1551280	1560120	is I went to an actual AC 5300. I gathered all of the screenshots and the... not screenshots,
1560120	1568620	all of the data files. I did DFs. I did LSs. I captured all of the data I could off an actual
1568620	1580680	AC 5300. I then went to my Kauri configuration, and I started modifying all of the files here,
1580680	1589620	because that's all you have to do. If you can modify the files, then suddenly this looks like
1589620	1595720	an actual Asus 5300. Now, if we were in my live version of this where people could
1595720	1604980	yell out things, you might yell out, but what about the HTTP interface of the router? Well,
1604980	1610760	that is in here too. I just didn't get a screenshot of it. I should have, but I captured
1611600	1618600	everything from the interface. I logged in. I got all of the HTML files after doing some
1618600	1625220	screen dumps and so on. I then went to my Kauri device. I modified it a little bit because Kauri
1625220	1631320	normally doesn't have a web server on it. Well, because you're installing Kauri on a base version
1631320	1637780	of Linux, there's nothing to stop you from putting Apache on there. I put Apache on there. I put
1637780	1647900	all of my configurations, so when you hit the web interface, it looked exactly like the Asus 5300.
1648260	1653500	Now, here's the hard part. I had to go, well, wait a minute. I can't just drop it on a network
1653500	1661740	somewhere, because why would someone have a wireless router sitting just randomly on a
1661740	1669060	network? No. What I had to do was create a DMZ in my environment, set it up so it looked like this
1669060	1678760	was my Xfinity connection, so anyone coming to my Xfinity system would see an Asus 5300 exposed
1678760	1685800	and think they found the keys to the kingdom. And they would sit there forever trying to break
1685800	1692620	into it, leaving my real firewall, which of course may be pfSense, who knows? Or it might be open
1692620	1701380	sense, because I like that better. The point is, don't forget about the configurations. That's in
1701380	1708580	the customization. But that's how easy it is to take a simple firewall tool, in this case Kauri,
1708580	1717340	and modify it to look like something else. Now, my other question. If you were looking at this,
1717340	1725500	what would you say this is? And of course, actually, let me... oops, wrong one. Let me see
1725500	1735220	if I can see where my Discord window went. Is anybody asking any questions? No. Okay.
1735980	1742740	What I was going to say is, in Discord, tell me, what do you think this is? I'm looking
1742740	1748520	at the Discord channel right now, the top questions text. So does this look like what?
1748880	1756340	OpenVPN? And I know there's a delay, so I'm kind of waiting and waiting and see what anybody says.
1756960	1766400	But it looks like an OpenVPN server. I assume you would all say that. And I'm pausing a little
1766400	1776440	bit to see what Discord says. People are typing. Yes, yes. Okay. But it's not. It's actually
1778160	1787620	a honeypot. What did I do? I installed the OpenVPN server on it, but here's the change.
1787620	1799020	When you click this to download the software, it downloads HoneyBadger.
1799020	1808340	HoneyBadger runs on the attacker's machine. It sends back a trace, and it says,
1808340	1818930	guess where I am? The whole point here is, yes, I used OpenVPN, the actual application.
1818930	1829610	But I modified it so it does things that I want it to do and not just what it was
1829610	1836730	written to do. I have a real OpenVPN server, but this one is fake.
1838550	1848990	Okay. Some more examples. Okay. I mentioned point of sale. I did this at a previous company
1848990	1854450	many, many years ago where we have point of sale servers. They kept getting hacked,
1854450	1859990	and they kept getting hacked with skimmers being put on them. So any time, you know,
1859990	1865630	they were credit card, typical credit card skimmer software. Well, we couldn't find who
1865630	1872610	was doing it. It was happening at multiple locations. So what did we do? We built Raspberry
1872610	1881390	Pis. In this case, it was RPi3s. We took RPi3s, configured them to look exactly like Oracle's
1881390	1887290	micro POS system. So the interface was there, and everything was there. We then drop shipped
1887290	1896190	them to the various locations that we had, and within a week of being installed in our locations,
1896190	1901410	one of them was attacked, and the skimmer software was attempted to be installed,
1901410	1907370	and we finally found out where it was coming from. And it was contractors and blah, blah, blah.
1907370	1915770	Doesn't matter. The point was the honeypots caught the bad actors, all because we stopped
1915770	1923970	and thought about where to put these things, because that's what's important, where to put them.
1924190	1935270	Also, think about compromised credentials. How many people have AWS keys that are stored out
1935270	1943770	in GitHub? And they better be fake AWS keys, because the minute they're compromised, you're
1943770	1953730	going to find out who is really trying to attack you, and not just some fake threat report that
1953730	1959190	comes from some company that says, oh, you're being attacked by this country and these people
1959190	1963730	and blah, blah, blah. Most of the times they're telling you about attacks you already know about.
1963730	1971550	So think about credentials that you can use. And if you ever have a user that comes to you and says,
1971990	1978230	my account was compromised because I clicked on a phishing account. Well, here's what you do.
1978230	1987430	Change their account name right away. Create a honey credential of the one that was compromised.
1987690	1994730	It works every time. This one I don't have time to talk about.
1994730	2008390	I had another one where we had a server room, a data center. And we knew that we had people
2008890	2018190	that seemed to be getting into systems physically. They were connecting up a crash cart and they
2018190	2023590	were logging into servers. We couldn't catch them because the entire place wasn't covered by
2023590	2031270	cameras. This was maybe about ten years ago. So we had an issue. But I guess it wasn't ten years
2031270	2037470	ago. It was more like eight. What we did was we created QR codes. We stuck them on the bottom
2037470	2045190	of these servers. And if you scanned it, because we told people about it, if you scanned it,
2045190	2051570	it would give you emergency credentials to log in to fix a server. Well, no. What it really did was
2051570	2057870	emailed us saying that somebody just scanned the QR code. And that's how we found who was doing it.
2057870	2064790	Again, honeypots. I already told you about my mail server. This is an easy one to do. And it's not
2064790	2077410	that hard. Also, set up a webcam, a fake one, of course. It's very easy to mimic what a webcam
2077970	2087190	software looks like on a Raspberry Pi. You can expose it on your internet via some port routing
2088490	2096470	between your firewall and everything. And even if it's just on your DMZ. The point here is I did
2096470	2104190	this years ago. If you all remember Mirai, I had done this. I had fake webcams out on my network.
2104190	2110830	I didn't always get a chance to analyze them. Because I didn't have them set up pointing to a
2110830	2118990	sim. So, this is how I learned I need to get a sim set up and have everything being correlated
2118990	2126050	and analyzed. Because I found out that I had the Mirai payload on one of my honeypots two months
2126050	2135250	after Mirai hit. The problem was the payload had been dropped two months before Mirai hit. So,
2135250	2142270	if I had only been looking at my honeypots more regularly, I might have found Mirai before it
2142270	2153790	actually did what it did. Oh, well. Think of S3 buckets. When you stop and think about IoT devices,
2153790	2160010	what do they talk to? They talk to the cloud. In many cases, they talk to all sorts of things in
2160010	2167050	the cloud. And they can also talk to S3 buckets and drop data in it. Put a fake S3 bucket out
2167050	2173550	there. Generate some weird data. Drop it in there. Put some fake credentials out that are available
2173550	2179110	that would access that S3 bucket. And then when the credentials are compromised, you get an alert
2179110	2184870	for that. But then when they're used to access the S3 bucket, which has bogus data in it, you also
2184870	2193070	know who's actually actively trying to attack. Think about honey ports. This is going to be
2193070	2199830	important. We're going to have to speed up because I have a little less time. Here's an example of a
2199830	2206190	great honeypot tool. This is on the ADHD package that you can look at. It's called Port Spoof.
2206190	2213450	So here you see I did an Nmap from port 200 to port 300 of a host called Gonzo. And it returned
2213450	2221050	all of these funky, what are pretty normal services and so on that you see running on there.
2221070	2228110	But what really happened is this is running a tool called Port Spoof. And Port Spoof actually
2228110	2237030	only listens on one port, but it has some redirect via IP tables on that server. So anything that
2237030	2246890	hits it, it says, oh, let me go and return all of this bogus data. But here's the best part of it.
2246890	2254010	Because this one returned pretty quickly. But here's another example. Here we see that, okay,
2254730	2265210	oops, the attacker decided to do an Nmap minus A of Gonzo. So we see we've got four minutes,
2265210	2274970	43 seconds elapsed. It's still running its stealth scan, doesn't find much. It says it's got 75%.
2276770	2286250	We've got nine minutes, 58 seconds. A minute 30, it says it's got remaining. It's still running
2286250	2294090	here. It's only at 77%. And it's still going. And actually, I'm sorry, looking at the wrong
2294090	2301610	numbers over here. My timing is over here. It went from 453 to 739. And it only made it 3%.
2302230	2311650	Why? Because port spoof actually slows it down. It's like a tar pit. It drags it in. Remember
2311650	2322610	CCAD, that D is delay. If I can delay the attacker while they screw around trying to attack this host
2323270	2331770	in my own network, then the odds are I will have spotted them because my sim will alert me when
2331770	2340170	port spoof triggers. Simple. So now I know where they're coming from. I know what they're trying
2340170	2347550	to do. Yeah. You know, think about this. Also, I will mention this one. I have a screenshot of it.
2347550	2356150	I may add it in here. I'm sure you all have heard of, have I been pwned? And a lot of people go
2356150	2362310	there. They put in their email address. And they get a report back saying whether it's been
2362310	2369110	compromised or not. I was thinking about that one day. And I stood up a funky domain similar
2369110	2376030	to have I been pwned. It was only up for about a week. I took it down very quickly because I was
2376030	2383450	very surprised. It said have I been pwned, but instead of asking you to enter your email address,
2383450	2391250	it asked you to enter your password to check to see if that password has been compromised.
2391250	2401250	In one week, I had thousands of people typing in their passwords. I was floored, thinking,
2401250	2408870	good Lord, all I did was stand up a simple website that said here, enter your password.
2408870	2420430	And people started doing it. It's crazy what people do. This is why honeypots have so much
2420430	2431570	power in gathering information. So please, this is a dated quote. It's from 2014.
2431810	2438430	But I think you all would agree. 84% of organizations that were breached had evidence
2438430	2444990	of the breach in their log files. The problem is logging of all their actual applications
2445530	2455710	is terabytes and petabytes and so on. It's huge. But honeypots are not going to be false
2455710	2464050	positives. Honeypots, when they are triggered, they are real attacks. Why? Because you don't
2464050	2469990	just drop them all over the place. I did have one place that we put a bunch of honeypots and
2469990	2477090	we had all the department or the main department head actually told all the other managers where
2477090	2483850	we put the honeypots. And I was like, seriously, why did you do that? The whole point of having
2483850	2490910	internal honeypots is to catch insider threats, not for you to tell everybody. So we had to pull
2490910	2497050	them all back, wait about a month, and then redeploy them so nobody knew where they are.
2497050	2503330	The point here is planning about where you're going to put honeypots. So here are your key
2503330	2512590	takeaways from today. Remember CCAT. Confuse, confound, annoy, delay. Also, honeypots have
2512590	2522930	low false positives. Feed them to a separate sim. Don't feed them to the same sim that you have
2523630	2532070	collecting all your other data. They are great tools for detecting lateral movement. Why? Because
2532070	2538230	what are people looking for when they get inside your environment? I can only imagine if Equifax
2538230	2542950	had real honeypots inside their network, they might have actually caught them before they got
2542950	2548390	away with things. They're cost effective as hell if you're not going out and spending money on
2548390	2555930	commercial versions. And remember, honeypots are there to defend but mostly to detect your
2555930	2563790	environment. And what I really want to say is honestly the... well, I'll get to it in a sec.
2563790	2575650	Let's talk about this. If you want to only work with IoT honeypots, I recommend Home Pwn. It's a
2576610	2585390	a kit for testing and looking at IoT devices. But what I use it for is for gathering all of the
2585390	2591670	screenshots, the data and everything of white bulbs and thermostats and all these things so I
2591670	2599130	can mimic them and make my honeypots look exactly like those devices. That's one of the things I do
2599130	2605230	with it. Also, honeypots are great for forensics. Keep that in mind. Hell, I had Mirai. I just didn't
2605230	2611850	know I had it. But what I really think is important here is honeypots are real threat intel.
2612110	2621550	They are not fake threat intel. They are giving you information that is valid on who's attacking
2621550	2629670	you. It's about thinking differently. I can't watch hundreds of thousands of servers in my
2629670	2636890	environment every day unless I start to think about it slightly differently. And that's what
2636890	2646370	we do with honeypots. So I can't say it enough. Plan, plan, plan. That is the key thing. Honeypots
2646370	2655110	are easy to deploy, but planning the deployment is what's important. Thank you all very much.
2655110	2664010	I hope you enjoyed this talk. I will be posting my slides. I am working on an actual honeypot
2664010	2670710	customization workshop. I'm almost there. I've done a couple of walkthroughs. The problem has
2670710	2678310	been I need to work on the labs. But once I get this done, I'm going to give it for free virtually.
2679270	2686270	So, yeah, I'll be doing that. Watch my Twitter feed. You'll see information about that coming
2686270	2691350	up within a couple of months. I have to get through my move from where I am now out to
2691350	2698670	Washington. So thank you all very much. Hope you had a good time. Hope you liked my spice rack
2698670	2705050	joke. If not, oh, well. And here's to Casa Noble and Yeho Tequila.