WEBVTT 00:00.000 --> 00:17.500 Thank you so much and thank you completely to the IoT village and all the volunteers and the staff because I know we are coming down to the wire and they have got to be exhausted and just, you know, kind of melting in all of this. 00:17.500 --> 00:20.100 So thank you all to the team. 00:20.100 --> 00:28.420 Let's get started because I have to get off of this slide before it gets evil and comes out and does attack. 00:28.420 --> 00:32.860 Do you know how hard it is to find a refrigerator like this? 00:33.020 --> 00:36.040 Anyway, this is who I am. 00:36.040 --> 00:39.460 I am the CEO of B-Sides Chicago. 00:39.460 --> 00:42.580 I was the COO for Diana Initiative last year. 00:42.580 --> 00:45.060 I also am part of B-Sides Pittsburgh. 00:45.180 --> 00:45.500 Why? 00:45.500 --> 00:47.620 Because I live in Pittsburgh currently. 00:47.620 --> 00:50.240 My first DEF CON was number three. 00:50.240 --> 00:52.200 How many people are that old? 00:52.200 --> 00:54.840 There were 16 speakers then. 00:55.020 --> 00:58.600 I have got a lot of years in security emphasis in blue teams. 00:58.600 --> 01:00.080 I used to be purple. 01:00.600 --> 01:02.660 I do a lot of DEF SEC ops. 01:03.140 --> 01:10.640 I sort of was based in Pittsburgh the last year and a half but in 16 more days I will be in beautiful Kirkland, Washington. 01:10.640 --> 01:11.880 I can't wait. 01:11.880 --> 01:26.440 I am a natural creature of winter and you will typically find me as you will see right here sipping a Casanova while simultaneously defending my systems using open source magic spells and dancing flamingos. 01:26.440 --> 01:31.840 We don't have time for dancing flamingos but we damn well have time for tequila. 01:36.340 --> 01:37.360 Oh great. 01:37.360 --> 01:38.480 And now I'm coughing. 01:38.480 --> 01:40.040 That never happens. 01:40.040 --> 01:41.040 Wow. 01:41.340 --> 01:45.900 Honeypots, refrigerators and internet of threats. 01:45.900 --> 01:49.900 I like to call it that instead of internet of things. 01:50.880 --> 01:54.180 But yeah, these are some of my absolute favorite things. 01:54.180 --> 01:55.640 We're going to talk about this stuff. 01:55.640 --> 01:59.140 And oh yes, I'm a drummer too if you haven't quite figured that out. 01:59.940 --> 02:00.820 All right. 02:00.820 --> 02:05.200 The views here and opinions and everything I show you today are mine. 02:05.200 --> 02:07.020 They are no one else's. 02:07.020 --> 02:10.920 Definitely not any my employer, past or present. 02:11.440 --> 02:15.780 Please take anything I show you with a grain of salt. 02:15.780 --> 02:23.560 Don't try this at home as they say on, oh God, I just forgot the TV show. 02:23.560 --> 02:24.940 Oh well. 02:25.340 --> 02:27.120 It's one of those days. 02:27.140 --> 02:37.100 And those of you with an overwhelming fear of the unknown will be happy to know that if you read this disclaimer backwards, there is no hidden message that will be revealed. 02:37.100 --> 02:39.080 Although some people want me to put one in there. 02:39.080 --> 02:41.040 I think I may do that the next time. 02:41.660 --> 02:42.260 All right. 02:42.260 --> 02:43.660 Why are we here? 02:44.340 --> 02:46.380 Couple of important points. 02:46.380 --> 02:49.180 I always like to present this in any of my talks. 02:49.180 --> 02:51.180 And I need to update it for 2019. 02:51.180 --> 02:53.740 I just have to get the information on it. 02:53.740 --> 02:55.860 But let's just look at 2018. 02:56.200 --> 03:08.440 In 2018, companies spent over $114 billion on fancy software, fancy hardware, you know, all the blinky boxes, the blinky software, all that crap. 03:08.540 --> 03:11.820 Attacks and breaches continue to go up. 03:11.820 --> 03:20.980 The security stuff that we buy, whether it's EPP, whether it's firewalls, whether it's who knows whatever it is, it's vulnerable. 03:21.100 --> 03:29.920 Another very important point that I always like to make is lateral movement is so often overlooked. 03:29.920 --> 03:34.300 I'll talk about that coming up a little bit more. 03:34.300 --> 03:36.460 Then think about this. 03:36.460 --> 03:44.800 What about... I've actually had people tell me that, ooh, our security architecture is incredibly unique. 03:44.960 --> 03:45.880 Really? 03:45.880 --> 03:47.080 I don't think so. 03:47.080 --> 03:51.800 There's not that many ways to make it unique. 03:51.960 --> 03:54.320 Also, what is your typical day? 03:54.320 --> 04:07.880 Normally, I'm in a room presenting this, so I would say by a show of hands, how many of you spend 50% of your time checking boxes that have to do with compliance? 04:08.120 --> 04:16.760 I can't see if you're raising your hands, but pretend you are and put it in Discord, because I'd be really curious to look once I get off this screen. 04:18.520 --> 04:22.600 If you don't have this book, I recommend that you get it. 04:22.600 --> 04:26.380 It's called Offensive Countermeasures by John Strand. 04:26.400 --> 04:28.960 And this quote is directly out of this book. 04:28.960 --> 04:29.800 I love it. 04:29.800 --> 04:34.280 Instead of brilliance, we've standardized mediocrity. 04:34.340 --> 04:40.100 And what I take from that is the fact that, yeah, we just go out and spend a few bucks here and there. 04:40.100 --> 04:44.580 We buy some common off-the-shelf hardware, software, whatever. 04:44.580 --> 04:48.680 We plug it in, and we go, woo, we're protected. 04:48.980 --> 04:50.260 I don't think so. 04:50.260 --> 04:56.660 If that were the case, there wouldn't be the Equifaxes of the world, the Capital Ones, and so on. 04:58.060 --> 04:58.580 All right. 04:58.580 --> 05:03.400 I love this cartoon, because this kind of says it all. 05:03.400 --> 05:08.880 In this corner, we have firewalls, encryption, antivirus, software, et cetera, et cetera, et cetera. 05:08.880 --> 05:11.480 And in this corner, we have Dave. 05:11.480 --> 05:18.000 And the best part about this is up until recently, my boss, his name was Dave. 05:18.000 --> 05:25.000 And when I showed him this, I just couldn't stop laughing, because it was perfect. 05:25.000 --> 05:27.400 But it really is true, right? 05:27.500 --> 05:35.400 Because it's all about our users that continue to do things or get compromised or something happens. 05:35.400 --> 05:41.800 And we need a way to figure it out, especially in two aspects of it. 05:41.800 --> 05:44.000 One, we're all working remotely. 05:44.000 --> 05:51.280 And two, we have a lot of IoT stuff on our networks. 05:51.540 --> 05:54.140 So we have to do something about that. 05:55.620 --> 05:58.080 Also, I saw this just the other day. 05:58.080 --> 06:02.360 This $12 course can turn you into an ethical hacking pro. 06:04.040 --> 06:06.140 I guess I did it wrong. 06:06.140 --> 06:06.920 I don't know. 06:06.920 --> 06:08.780 I went to school for this. 06:08.860 --> 06:11.500 Although, I was a music major, so what do I know? 06:11.500 --> 06:16.060 Now, I just have to put that up for your entertainment, because I do think it's kind of funny. 06:16.060 --> 06:17.520 Don't fall for these scams. 06:17.520 --> 06:20.520 Most of these courses are crap. 06:21.200 --> 06:25.120 Honestly, set up a lab in your environment. 06:25.120 --> 06:27.140 I'll give you one little tip. 06:27.140 --> 06:35.940 Whenever I interview people, one of the first questions I ask engineers, security engineers, and so on, is tell me about your home lab. 06:35.940 --> 06:41.220 I have actually had security engineers tell me, I don't have time for that. 06:41.220 --> 06:42.100 Really? 06:42.160 --> 06:43.360 Next. 06:43.400 --> 06:44.560 So keep that in mind. 06:44.560 --> 06:47.100 You better have a really good home lab. 06:47.200 --> 06:58.480 This is something I want to point out, because these are screenshots from a recent security conference before COVID, before we went to virtual conferences. 06:58.480 --> 07:00.620 I was physically at a conference. 07:00.620 --> 07:02.880 It doesn't matter which one. 07:02.880 --> 07:05.400 But the point here is this. 07:06.100 --> 07:11.100 Here I had a GoPro that allowed me to connect to it. 07:11.540 --> 07:16.100 And I actually started taking screenshots from this person's GoPro. 07:16.100 --> 07:21.880 I was trying to figure out where they were in the room based on the shots I was able to see. 07:21.880 --> 07:26.300 I had another device that was attempting to pair with me. 07:26.300 --> 07:28.840 I actually was able to pair with it. 07:28.840 --> 07:39.420 I also was running an evil AP, and I was kind of capturing all the SIDS that were running around this particular security conference. 07:39.420 --> 07:44.460 The point is, I usually do this every year at DEF CON. 07:44.640 --> 07:50.300 So if you see me walking around, I'll usually have a purse, and in that purse will be my evil AP. 07:50.980 --> 07:55.460 And the beauty of carrying a purse is it hides very neatly in your purse. 07:55.500 --> 08:00.000 But I look at all of this stuff, and I kind of analyze it when I get back. 08:00.000 --> 08:17.280 And it's fascinating to me that as security professionals ourselves and hackers and so on, we make the same mistakes that a lot of amateurs and new people make because they don't clear out their Wi-Fi. 08:17.280 --> 08:20.280 They don't do things that they should be doing. 08:21.560 --> 08:23.300 There was also one other thing. 08:23.300 --> 08:25.100 This morning I was kind of bored. 08:25.100 --> 08:28.520 I put up a new spice rack in my kitchen, so I took a picture of it. 08:28.520 --> 08:30.480 I wanted to share that with everyone. 08:31.140 --> 08:33.620 Yes, you should all be laughing right now. 08:33.620 --> 08:37.220 If you're not, oh well, I tried. 08:37.580 --> 08:40.820 All right, why are we not here? 08:41.560 --> 08:46.480 Well, first of all, it's not a demo of 5,000 different kinds of honeypots. 08:46.480 --> 08:48.080 That would be kind of silly. 08:48.080 --> 08:49.200 I have 45 minutes. 08:49.200 --> 08:51.020 It's not going to work very well. 08:51.740 --> 08:55.400 I'm not going to show you all of my honeypots. 08:55.400 --> 08:59.760 If you follow me on Twitter, you know I have honeypots all over the world. 09:00.020 --> 09:02.160 I have them scattered everywhere. 09:02.160 --> 09:03.980 I have them in my apartment. 09:03.980 --> 09:07.920 I have them in a lot of different places. 09:08.000 --> 09:10.880 Showing you my honeypots would be counterproductive. 09:10.880 --> 09:20.040 It's not going to do anything, but I will show you some without showing you where they're located, and they'll make a point. 09:20.960 --> 09:24.300 Oops, I have to come back, sorry. 09:24.760 --> 09:39.380 The whole point of this is there must be a better way to do security, because if we keep spending all this money, there really has to be a better way, and I think honeypots are the way to do it. 09:39.380 --> 09:42.940 Let's quick talk about what is an incident or a breach. 09:43.200 --> 09:46.540 Some key points, most breaches are not zero-day. 09:46.540 --> 09:47.760 They're not fancy. 09:47.760 --> 09:51.440 You don't get breaches from vulnerability scanners. 09:51.440 --> 09:54.560 Most breaches come from configuration issues. 09:54.560 --> 10:03.560 Ooh, this interests me, because it opens up the door to how I can modify my honeypots. 10:04.260 --> 10:08.280 A close second is compromised credentials. 10:08.520 --> 10:19.420 I worked at a company many years ago where, well, most companies are smart enough that they will change the administrator account in their domain. 10:19.420 --> 10:28.400 They don't want it to be administrator, but why don't you put back an administrator account and make it a honey credential? 10:28.540 --> 10:29.660 Think about that. 10:29.660 --> 10:31.940 We'll talk about that a little bit more. 10:32.060 --> 10:35.400 Also, trailing in third are overprivileged users. 10:35.400 --> 10:42.680 That's not going to fit well into our honeypots as much as everything else. 10:44.080 --> 10:49.100 Let's look at a couple of quick examples of IoT issues. 10:49.420 --> 10:50.900 This was a funny one. 10:50.900 --> 10:56.280 A university was attacked by its own light bulbs, vending machines, and lampposts. 10:57.560 --> 10:59.140 Answer a question for me. 10:59.140 --> 11:01.780 I know you can't, but you could in Discord. 11:02.400 --> 11:12.040 What in God's name were the light bulbs, the vending machines, the lampposts doing on the same network as the rest of the university? 11:12.040 --> 11:14.760 It should not have been there. 11:15.140 --> 11:20.120 Also, there are industrial issues that we deal with all the time. 11:20.460 --> 11:23.640 An oil rig was shut down a couple of years ago. 11:23.640 --> 11:24.060 Why? 11:24.060 --> 11:31.340 Because there was an IoT sensor on the oil rig that actually detected whether the oil rig was tipping. 11:31.340 --> 11:33.420 It was an ocean oil rig. 11:33.960 --> 11:35.340 Somebody got in. 11:35.340 --> 11:38.120 They made the sensor read. 11:38.260 --> 11:42.620 I want to say it was like a 12 degree tilt and the sensor was set. 11:42.620 --> 11:47.200 If it went to 10 degrees or over, then it would shut down the oil rig. 11:47.200 --> 11:53.700 Nobody bothered to check that damn sensor to see if it was misreading or something was wrong with it. 11:53.800 --> 11:58.380 Also, there was a blast furnace that happened to have been owned by the government. 11:58.600 --> 12:02.620 It malfunctioned, so to speak. 12:02.620 --> 12:05.460 Well, what happened was somebody got into it. 12:05.460 --> 12:09.000 They raised the temperature, shut off the shut off valves. 12:09.000 --> 12:13.980 The way this kind of solved itself was very simple. 12:13.980 --> 12:14.880 It melted. 12:14.880 --> 12:15.900 It melted down. 12:15.900 --> 12:17.260 No one was hurt. 12:17.260 --> 12:23.560 Although, if you were a blast furnace, I guess you might have been hurt in that particular case. 12:23.560 --> 12:25.880 This one I will never understand. 12:26.200 --> 12:29.800 Why are toilets connected to networks? 12:30.080 --> 12:31.120 Seriously. 12:31.120 --> 12:32.160 I mean, are we what? 12:32.160 --> 12:33.780 We're monitoring water? 12:33.780 --> 12:35.220 I don't know. 12:35.220 --> 12:39.000 But this happens all over Europe and Asia and so on. 12:39.000 --> 12:43.040 It does bring new meaning to the word system dump. 12:43.040 --> 12:49.660 But anyway, yes, I would never put a toilet on the network. 12:49.800 --> 12:50.560 All right. 12:50.560 --> 12:54.600 Now we're going to talk about one of my favorite things, honeypots. 12:54.600 --> 12:56.240 I love them. 12:56.240 --> 13:01.320 I think they are much more valuable than people give credit. 13:01.780 --> 13:04.980 Honeypots or deception technology. 13:04.980 --> 13:07.460 People have changed the name lately. 13:07.460 --> 13:10.700 They love to call them deception technology. 13:10.700 --> 13:11.240 Why? 13:11.240 --> 13:12.320 I don't know. 13:12.320 --> 13:15.440 They wanted something that sounded more professional. 13:15.440 --> 13:17.820 I guess deception technology. 13:17.820 --> 13:37.640 And yet I have found many commercial honeypots are nothing more than open source versions that have been repackaged with a fancy front end and a distribution model that allows it to be deployed to your environment much easier. 13:37.640 --> 13:40.940 But it's still the open source solution. 13:41.060 --> 13:55.240 So why can't I do that myself with an open source honeypot, maybe Ansible, Puppet, Chef, whatever is your tool of choice, use that to deploy your honeypots and manage them. 13:55.340 --> 13:57.220 Maybe we can. 13:57.220 --> 14:02.360 But think of a honeypot as nothing more than a resource with no value. 14:02.360 --> 14:08.420 The value of that honeypot is someone using the resource. 14:08.460 --> 14:12.160 My honeypots are attacked all the time. 14:12.160 --> 14:16.760 I typically will not set my honeypots up to hack back. 14:16.960 --> 14:17.900 Who knows? 14:17.900 --> 14:19.340 Maybe someday I will. 14:19.340 --> 14:21.380 But I haven't done it yet. 14:22.500 --> 14:26.940 Also, these are incredibly important points. 14:27.060 --> 14:32.940 Probably the most important aspect of honeypots is deployment. 14:33.280 --> 14:35.580 Where are you going to put them? 14:35.580 --> 14:37.360 I made a comment a few minutes ago. 14:37.360 --> 14:39.220 I have honeypots all over the world. 14:39.220 --> 14:44.820 I don't just put them out just randomly for the hell of it. 14:44.820 --> 14:53.220 There might be a couple that I might just place in a country on a VPS somewhere just to see if it gets attacked. 14:53.220 --> 15:01.640 But most of them are very strategically placed, especially within my own environment, my own networks, etc. 15:01.640 --> 15:02.960 So think about it. 15:02.960 --> 15:05.440 We're going to talk about that detail coming up. 15:05.740 --> 15:06.780 Architecture. 15:07.520 --> 15:08.560 Customization. 15:08.920 --> 15:11.220 In other words, planning. 15:11.500 --> 15:16.620 You know, there are hundreds, thousands, I don't know, I've lost track. 15:16.620 --> 15:20.520 There are hundreds of types of honeypots out there. 15:21.040 --> 15:22.540 We're going to talk about that. 15:22.540 --> 15:25.000 In fact, let's talk about it right now. 15:25.000 --> 15:29.180 Here's a good list of some of my favorite honeypots. 15:29.460 --> 15:30.560 ADHD. 15:30.640 --> 15:31.740 Great tool. 15:31.740 --> 15:33.640 Comes from Active Countermeasures. 15:33.680 --> 15:35.080 It is free. 15:36.680 --> 15:38.040 Excuse me. 15:38.360 --> 15:40.660 And, you know, go download it. 15:40.660 --> 15:41.540 Start playing with it. 15:41.540 --> 15:47.140 It has numerous honeypots built into it, a couple of which are my favorite as well. 15:47.140 --> 15:49.300 Honey badger and honey badger red. 15:49.300 --> 15:52.780 I love honey badger and I'll talk about that coming up. 15:52.780 --> 15:57.700 There's another place to generate canary tokens. 15:57.820 --> 16:02.040 There is also Open Canary, which is a great honeypot. 16:02.040 --> 16:12.420 If you want to build your own custom honeypots out of hardware and software, take a look at the Mozilla project called Web Things. 16:12.420 --> 16:20.040 There's a whole framework there that you can actually build your own honeypots with raspberry pies and so on. 16:21.660 --> 16:24.180 Teapot is still a good one to get started with. 16:24.180 --> 16:25.180 Start playing. 16:25.180 --> 16:29.680 There's a new one that replaced the Modern Honey Network a couple of years ago. 16:29.680 --> 16:31.860 It's called Community Honey Network. 16:31.900 --> 16:33.560 Take a look at that one. 16:33.560 --> 16:35.700 Twisted Honeypot's another. 16:35.720 --> 16:38.560 But I think you're getting the idea. 16:38.560 --> 16:42.340 Also, what about the real thing? 16:42.660 --> 16:55.810 What if I have a server that I could install Windows Server on it, whatever year you want to pick, why couldn't that be an actual honeypot? 16:56.120 --> 17:00.860 Why does it have to have special software on it to be a honeypot? 17:00.860 --> 17:02.560 I'll tell you this right now. 17:02.560 --> 17:09.740 I have a mail server in my own personal network that is a fake mail server. 17:09.740 --> 17:15.700 If you look at my MX record, you will see that I have a couple of mail servers in there. 17:15.700 --> 17:23.760 But then there's this other mail server that sits on the exact same network, but it's not part of the MX record. 17:23.820 --> 17:24.920 It's a honeypot. 17:24.920 --> 17:34.280 And I catch people trying to spam it and get in and do things all the time because the bots find it. 17:34.400 --> 17:40.300 The whole point here is there are lots and lots of honeypots. 17:40.300 --> 17:50.100 This is a great website or a GitHub link where the person maintains a great list of all of the honeypots, so keep that in mind. 17:50.100 --> 17:56.020 Also, I will be making my slides available after this talk up on my GitHub repo. 17:56.020 --> 18:00.040 My GitHub repo is the same as my Twitter handle, Rainbow Cat. 18:00.040 --> 18:02.220 So this will be up later tonight. 18:03.580 --> 18:06.940 Also, remember I said lateral movement. 18:07.260 --> 18:09.460 Lateral movement is critical. 18:09.740 --> 18:15.440 And honeypots are one of your best tools to detect lateral movement. 18:15.440 --> 18:21.060 Just recently I bought a new IoT device. 18:21.100 --> 18:33.080 I plugged it into my network, and one of my honeypots, which is made to detect port scanning, and I have it here in my own place, kind of went off. 18:33.080 --> 18:33.500 Why? 18:33.500 --> 18:38.040 Because the device that I plugged in started port scanning my network. 18:39.640 --> 19:00.120 Without going into details, because I have a bug bounty in place for this, it turns out that the vendor had actually installed somehow some beta... or their testing software, not beta, their testing software got put on a piece of equipment that got shipped to production, 19:00.120 --> 19:03.220 that got shipped and purchased. 19:03.220 --> 19:08.060 I'm wondering whether that's a true story, but we can talk about that offline. 19:08.060 --> 19:11.940 The whole point is we have to find a way to detect lateral movement. 19:12.000 --> 19:13.500 Honeypots are the way to do it. 19:13.500 --> 19:14.900 We're going to see that. 19:15.100 --> 19:15.900 All right. 19:16.260 --> 19:18.620 Everyone should know what OODA is. 19:18.700 --> 19:21.460 If you don't know what OODA is, you're about to. 19:21.640 --> 19:28.740 OODA stands for Observe, Orient, Decide, and Act. 19:28.740 --> 19:31.060 And this came from the military. 19:31.060 --> 19:35.520 It came from the military on how you do warfare, how you do all of this. 19:35.520 --> 19:40.500 And it also was adopted by a lot of security professionals. 19:40.500 --> 19:48.920 Well, in the honeypot world, I think we need our own little mnemonic, if you will. 19:48.920 --> 19:50.720 And it's called CCAD. 19:50.980 --> 20:02.840 CCAD stands for Confuse, Confound, my favorite, Annoy, and, of course, Delay. 20:02.840 --> 20:03.580 Why? 20:03.580 --> 20:18.940 Because if I can delay an attacker because they're stuck in a honeypot, then I'm going to have more time to find them and keep them from getting into my actual valuable resources. 20:19.720 --> 20:20.880 So, yeah. 20:20.880 --> 20:21.880 I love this. 20:21.880 --> 20:23.480 We'll see it a little more later. 20:23.480 --> 20:25.600 Don't forget about monitoring. 20:25.600 --> 20:32.980 You can deploy all the honeypots you want, but people keep forgetting to monitor them. 20:32.980 --> 20:34.700 I use a great tool. 20:34.720 --> 20:36.020 I just put it up here. 20:36.020 --> 20:37.600 I don't represent them. 20:37.600 --> 20:38.620 It's open source. 20:38.620 --> 20:41.020 It's called Wazoo, or some people say Waza. 20:41.220 --> 20:44.160 But go take a look at it. 20:44.160 --> 20:48.460 It's an agent configuration and also a sim built in. 20:48.460 --> 20:50.660 You put the agents on your honeypot. 20:50.660 --> 21:02.400 It does a lot of analysis of all the honey data or all the attack data that's coming into your honeypots, sends it up to your sim, and it's tremendous. 21:02.400 --> 21:08.980 I just like to mention that because you should pick something to be able to monitor your honeypots. 21:09.260 --> 21:09.780 All right. 21:09.780 --> 21:11.580 Let's talk about deployment. 21:12.300 --> 21:14.180 This is the big part. 21:14.280 --> 21:15.580 I can't say it enough. 21:15.580 --> 21:16.880 Plan, plan, plan. 21:16.880 --> 21:26.520 This should be 90% of your time when it comes to deploying honeypots, especially when it comes to IoT. 21:26.520 --> 21:31.520 You can't just build a little IoT honeypot and go, oh, I'll just put it on my network. 21:31.520 --> 21:32.240 No. 21:32.240 --> 21:39.240 You have to design your network such that it looks like this is a valid honeypot. 21:39.840 --> 21:46.800 I'm going to show you coming up a honeypot... let me... I'll stop right there. 21:46.800 --> 21:49.680 I'll show you something and we'll talk about it then. 21:49.680 --> 21:52.640 Also, two types of honeypots I recommend. 21:52.640 --> 21:54.800 Low interaction, medium interaction. 21:54.800 --> 21:57.420 We don't need higher interaction honeypots. 21:58.080 --> 22:07.840 We want them to get delayed and get stuck, but we don't need them mucking around with things that are very complex and difficult. 22:07.840 --> 22:13.800 Most of my honeypots, if I am deploying them within an environment, run on Raspberry Pis. 22:13.800 --> 22:15.680 If I could turn my camera, I would show you. 22:15.680 --> 22:28.320 I have a table down here that has about 25 Raspberry Pis on it in various forms of destruction and rebuilding and everything. 22:28.620 --> 22:30.960 Raspberry Pis are great for it. 22:30.960 --> 22:38.840 Also, think about honeyports, honeypots, honeytokens, honeycredentials. 22:38.840 --> 22:47.100 It's easy to build a honeypot, but it's also going to be a little more difficult because we have to customize it. 22:47.180 --> 22:51.020 And this is where the hard part comes in. 22:51.020 --> 22:54.080 This is why I say ding, ding, ding, this is important. 22:54.260 --> 23:00.580 I'm going to show you a test coming up here in just a second, and we're going to see how many of you pass. 23:00.740 --> 23:06.620 Also, if you're going to put a honeypot out there, real versus self-signed certificates. 23:06.620 --> 23:16.100 Self-signed certificates is the most dead-awful giveaway that this is a honeypot versus a real resource. 23:16.100 --> 23:25.740 And these days with Let's Encrypt, there's no reason you can't put a real certificate on a honeypot. 23:25.740 --> 23:41.220 Also, how difficult would it be if you took an actual application, a production application that you have, but put it on a honeypot server. 23:41.940 --> 23:50.720 And you might take maybe some of the data out of it, maybe, you know, ask your application team to modify it a little bit. 23:50.720 --> 23:58.960 But the point is, you put the actual application on a honeypot server. 23:58.960 --> 24:05.460 So that way, when they're trying to attack it or trying to get into it, it looks like they're getting into something real. 24:05.460 --> 24:08.980 I'm going to show you an example of that coming up in just a second. 24:09.320 --> 24:13.680 I already mentioned, put a host intrusion detection on it. 24:13.680 --> 24:20.120 My favorite being Wazoo, which is a fork of OSEC from several years ago. 24:20.120 --> 24:24.940 There are some rules, and you do have to do some tuning work, but it's very, very important. 24:25.520 --> 24:28.440 Now, where do you put your honeypots? 24:28.520 --> 24:30.060 Well, I put them everywhere. 24:30.060 --> 24:35.460 In server farms, in cloud storage, IoT, the IoT one's coming up in a second. 24:35.460 --> 24:40.620 Put them out my DMZ, out for mail servers, all over the place. 24:40.620 --> 24:44.000 Remember, stop and think about it. 24:44.560 --> 24:52.720 You know, you want WordPress, you want Raspberry Pis, spin up some VMs or some VPSs out there. 24:52.720 --> 24:56.220 Also, what about a point of sale system? 24:56.680 --> 25:00.260 I'll tell you one about that coming up here in just a second. 25:00.260 --> 25:03.200 All right, normally this is interactive. 25:03.820 --> 25:12.220 It's not very interactive right now, but if you were looking at this, and I'm hoping you can see my mouse, you should be able to. 25:12.220 --> 25:15.820 So we see this is, I got into this device. 25:15.820 --> 25:19.780 It looks like it says Linux RT AC 5300. 25:19.820 --> 25:25.120 Normally, I'm asking everybody in the room, what do you think this is? 25:25.120 --> 25:33.720 And most people will yell out, oh, it looks like it's an Asus router, and in fact, it's an AC 5300. 25:35.440 --> 25:37.560 No, it's not. 25:37.700 --> 25:39.880 It's actually Kauri. 25:39.940 --> 25:49.100 Kauri is an SSH Telnet honeypot tool that can be configured to look like just about anything. 25:49.100 --> 25:55.660 In my case, what I did is I went to an actual AC 5300. 25:55.660 --> 26:01.940 I gathered all of the screenshots and the... not screenshots, all of the data files. 26:01.940 --> 26:02.920 I did DFs. 26:02.920 --> 26:04.440 I did LSs. 26:04.440 --> 26:10.760 I captured all of the data I could off an actual AC 5300. 26:10.760 --> 26:23.800 I then went to my Kauri configuration, and I started modifying all of the files here, because that's all you have to do. 26:23.800 --> 26:32.660 If you can modify the files, then suddenly this looks like an actual Asus 5300. 26:32.660 --> 26:43.800 Now, if we were in my live version of this where people could yell out things, you might yell out, but what about the HTTP interface of the router? 26:43.800 --> 26:46.560 Well, that is in here too. 26:46.560 --> 26:48.560 I just didn't get a screenshot of it. 26:48.560 --> 26:53.820 I should have, but I captured everything from the interface. 26:53.820 --> 26:54.780 I logged in. 26:54.780 --> 27:00.240 I got all of the HTML files after doing some screen dumps and so on. 27:00.240 --> 27:02.780 I then went to my Kauri device. 27:02.780 --> 27:08.100 I modified it a little bit because Kauri normally doesn't have a web server on it. 27:08.100 --> 27:15.520 Well, because you're installing Kauri on a base version of Linux, there's nothing to stop you from putting Apache on there. 27:15.520 --> 27:17.300 I put Apache on there. 27:17.300 --> 27:27.900 I put all of my configurations, so when you hit the web interface, it looked exactly like the Asus 5300. 27:28.260 --> 27:30.220 Now, here's the hard part. 27:30.220 --> 27:31.720 I had to go, well, wait a minute. 27:31.720 --> 27:41.840 I can't just drop it on a network somewhere, because why would someone have a wireless router sitting just randomly on a network ? 27:41.840 --> 27:42.320 No. 27:42.320 --> 28:02.920 What I had to do was create a DMZ in my environment, set it up so it looked like this was my Xfinity connection, so anyone coming to my Xfinity system would see an Asus 5300 exposed and think they found the keys to the kingdom. 28:02.940 --> 28:11.800 And they would sit there forever trying to break into it, leaving my real firewall, which of course may be pfSense, who knows? 28:11.800 --> 28:14.520 Or it might be open sense, because I like that better. 28:14.520 --> 28:20.420 The point is, don't forget about the configurations. 28:20.680 --> 28:22.820 That's in the customization. 28:22.980 --> 28:32.500 But that's how easy it is to take a simple firewall tool, in this case Kauri, and modify it to look like something else. 28:32.700 --> 28:34.780 Now, my other question. 28:34.900 --> 28:39.640 If you were looking at this, what would you say this is? 28:39.640 --> 28:43.620 And of course, actually, let me... oops, wrong one. 28:43.900 --> 28:50.100 Let me see if I can see where my Discord window went. 28:50.100 --> 28:52.700 Is anybody asking any questions? 28:53.520 --> 28:54.420 No. 28:54.420 --> 28:55.220 Okay. 28:55.980 --> 29:02.320 What I was going to say is, in Discord, tell me, what do you think this is? 29:02.320 --> 29:06.400 I'm looking at the Discord channel right now, the top questions text. 29:06.480 --> 29:08.520 So does this look like what? 29:08.880 --> 29:09.680 OpenVPN? 29:09.680 --> 29:16.340 And I know there's a delay, so I'm kind of waiting and waiting and see what anybody says. 29:16.960 --> 29:21.920 But it looks like an OpenVPN server. 29:21.920 --> 29:25.040 I assume you would all say that. 29:25.040 --> 29:29.060 And I'm pausing a little bit to see what Discord says. 29:29.060 --> 29:30.340 People are typing. 29:30.340 --> 29:32.080 Yes, yes. 29:32.220 --> 29:33.140 Okay. 29:33.140 --> 29:35.080 But it's not. 29:35.180 --> 29:40.160 It's actually a honeypot. 29:40.160 --> 29:41.340 What did I do? 29:41.340 --> 29:47.620 I installed the OpenVPN server on it, but here's the change. 29:47.620 --> 29:59.020 When you click this to download the software, it downloads HoneyBadger. 29:59.020 --> 30:02.960 HoneyBadger runs on the attacker's machine. 30:02.960 --> 30:10.700 It sends back a trace, and it says, guess where I am? 30:10.700 --> 30:18.930 The whole point here is, yes, I used OpenVPN, the actual application. 30:18.930 --> 30:30.570 But I modified it so it does things that I want it to do and not just what it was written to do. 30:30.570 --> 30:36.730 I have a real OpenVPN server, but this one is fake. 30:38.550 --> 30:39.150 Okay. 30:39.150 --> 30:40.610 Some more examples. 30:42.230 --> 30:42.910 Okay. 30:42.910 --> 30:45.510 I mentioned point of sale. 30:45.910 --> 30:52.710 I did this at a previous company many, many years ago where we have point of sale servers. 30:52.710 --> 30:58.570 They kept getting hacked, and they kept getting hacked with skimmers being put on them. 30:58.570 --> 31:03.490 So any time, you know, they were credit card, typical credit card skimmer software. 31:03.490 --> 31:06.410 Well, we couldn't find who was doing it. 31:06.410 --> 31:09.410 It was happening at multiple locations. 31:09.410 --> 31:10.770 So what did we do? 31:10.770 --> 31:13.230 We built Raspberry Pis. 31:13.230 --> 31:15.310 In this case, it was RPi3s. 31:15.310 --> 31:23.250 We took RPi3s, configured them to look exactly like Oracle's micro POS system. 31:23.250 --> 31:26.170 So the interface was there, and everything was there. 31:26.170 --> 31:44.530 We then drop shipped them to the various locations that we had, and within a week of being installed in our locations, one of them was attacked, and the skimmer software was attempted to be installed, and we finally found out where it was coming from. 31:44.530 --> 31:47.370 And it was contractors and blah, blah, blah. 31:47.370 --> 31:48.190 Doesn't matter. 31:48.190 --> 32:03.970 The point was the honeypots caught the bad actors, all because we stopped and thought about where to put these things, because that's what's important, where to put them. 32:04.190 --> 32:08.150 Also, think about compromised credentials. 32:08.370 --> 32:16.870 How many people have AWS keys that are stored out in GitHub? 32:16.890 --> 32:39.590 And they better be fake AWS keys, because the minute they're compromised, you're going to find out who is really trying to attack you, and not just some fake threat report that comes from some company that says, oh, you're being attacked by this country and these people and blah, 32:39.590 --> 32:40.090 blah, blah. 32:40.090 --> 32:43.730 Most of the times they're telling you about attacks you already know about. 32:43.730 --> 32:47.830 So think about credentials that you can use. 32:47.830 --> 32:56.670 And if you ever have a user that comes to you and says, my account was compromised because I clicked on a phishing account. 32:56.670 --> 32:58.230 Well, here's what you do. 32:58.230 --> 33:01.430 Change their account name right away. 33:01.990 --> 33:07.430 Create a honey credential of the one that was compromised. 33:07.690 --> 33:09.870 It works every time. 33:11.390 --> 33:14.730 This one I don't have time to talk about. 33:14.730 --> 33:25.230 I had another one where we had a server room, a data center. 33:25.230 --> 33:33.750 And we knew that we had people that seemed to be getting into systems physically. 33:33.750 --> 33:39.730 They were connecting up a crash cart and they were logging into servers. 33:39.730 --> 33:44.650 We couldn't catch them because the entire place wasn't covered by cameras. 33:44.730 --> 33:47.210 This was maybe about ten years ago. 33:47.210 --> 33:48.710 So we had an issue. 33:49.030 --> 33:51.510 But I guess it wasn't ten years ago. 33:51.510 --> 33:52.430 It was more like eight. 33:52.430 --> 33:55.950 What we did was we created QR codes. 33:56.110 --> 33:59.690 We stuck them on the bottom of these servers. 34:00.050 --> 34:10.050 And if you scanned it, because we told people about it, if you scanned it, it would give you emergency credentials to log in to fix a server. 34:10.050 --> 34:10.710 Well, no. 34:10.710 --> 34:14.810 What it really did was emailed us saying that somebody just scanned the QR code. 34:15.030 --> 34:17.870 And that's how we found who was doing it. 34:17.870 --> 34:19.290 Again, honeypots. 34:19.290 --> 34:21.870 I already told you about my mail server. 34:21.870 --> 34:24.030 This is an easy one to do. 34:24.030 --> 34:26.230 And it's not that hard. 34:27.650 --> 34:34.370 Also, set up a webcam, a fake one, of course. 34:34.370 --> 34:41.330 It's very easy to mimic what a webcam software looks like on a Raspberry Pi. 34:41.330 --> 34:52.150 You can expose it on your internet via some port routing between your firewall and everything. 34:52.150 --> 34:54.490 And even if it's just on your DMZ. 34:54.490 --> 34:57.690 The point here is I did this years ago. 34:57.690 --> 35:01.010 If you all remember Mirai, I had done this. 35:01.010 --> 35:04.190 I had fake webcams out on my network. 35:04.190 --> 35:07.610 I didn't always get a chance to analyze them. 35:07.610 --> 35:11.470 Because I didn't have them set up pointing to a sim . 35:11.570 --> 35:20.090 So, this is how I learned I need to get a sim set up and have everything being correlated and analyzed. 35:20.090 --> 35:28.430 Because I found out that I had the Mirai payload on one of my honeypots two months after Mirai hit. 35:28.430 --> 35:34.870 The problem was the payload had been dropped two months before Mirai hit. 35:34.870 --> 35:45.250 So, if I had only been looking at my honeypots more regularly, I might have found Mirai before it actually did what it did. 35:45.250 --> 35:46.490 Oh, well. 35:46.970 --> 35:49.630 Think of S3 buckets. 35:50.130 --> 35:55.270 When you stop and think about IoT devices, what do they talk to? 35:55.270 --> 35:57.090 They talk to the cloud. 35:57.110 --> 36:00.850 In many cases, they talk to all sorts of things in the cloud. 36:00.850 --> 36:05.410 And they can also talk to S3 buckets and drop data in it. 36:05.410 --> 36:07.730 Put a fake S3 bucket out there. 36:07.730 --> 36:09.270 Generate some weird data. 36:09.270 --> 36:10.430 Drop it in there. 36:10.430 --> 36:16.190 Put some fake credentials out that are available that would access that S3 bucket. 36:16.190 --> 36:20.050 And then when the credentials are compromised, you get an alert for that. 36:20.050 --> 36:29.470 But then when they're used to access the S3 bucket, which has bogus data in it, you also know who's actually actively trying to attack. 36:30.550 --> 36:32.410 Think about honey ports. 36:32.410 --> 36:33.910 This is going to be important. 36:33.910 --> 36:36.750 We're going to have to speed up because I have a little less time. 36:37.350 --> 36:40.870 Here's an example of a great honeypot tool. 36:40.870 --> 36:44.670 This is on the ADHD package that you can look at. 36:44.670 --> 36:46.190 It's called Port Spoof. 36:46.190 --> 36:52.290 So here you see I did an Nmap from port 200 to port 300 of a host called Gonzo. 36:52.290 --> 37:01.050 And it returned all of these funky, what are pretty normal services and so on that you see running on there. 37:01.070 --> 37:06.610 But what really happened is this is running a tool called Port Spoof. 37:06.610 --> 37:16.290 And Port Spoof actually only listens on one port, but it has some redirect via IP tables on that server. 37:16.290 --> 37:24.650 So anything that hits it, it says, oh, let me go and return all of this bogus data. 37:24.650 --> 37:26.890 But here's the best part of it. 37:26.890 --> 37:29.870 Because this one returned pretty quickly. 37:29.870 --> 37:31.810 But here's another example. 37:31.810 --> 37:41.610 Here we see that, okay, oops, the attacker decided to do an Nmap minus A of Gonzo. 37:41.610 --> 37:48.250 So we see we've got four minutes, 43 seconds elapsed. 37:48.330 --> 37:52.690 It's still running its stealth scan, doesn't find much. 37:52.690 --> 37:54.970 It says it's got 75%. 37:56.770 --> 38:01.090 We've got nine minutes, 58 seconds. 38:01.090 --> 38:05.130 A minute 30, it says it's got remaining. 38:05.130 --> 38:06.790 It's still running here. 38:06.790 --> 38:09.150 It's only at 77%. 38:09.150 --> 38:12.270 And it's still going. 38:12.530 --> 38:15.570 And actually, I'm sorry, looking at the wrong numbers over here. 38:15.570 --> 38:17.270 My timing is over here. 38:17.270 --> 38:20.390 It went from 453 to 739. 38:20.390 --> 38:21.610 And it only made it 3%. 38:22.230 --> 38:23.430 Why? 38:23.450 --> 38:27.930 Because port spoof actually slows it down. 38:27.930 --> 38:29.290 It's like a tar pit. 38:29.290 --> 38:31.070 It drags it in. 38:31.070 --> 38:36.370 Remember CCAD, that D is delay. 38:36.370 --> 38:53.830 If I can delay the attacker while they screw around trying to attack this host in my own network, then the odds are I will have spotted them because my sim will alert me when port spoof triggers. 38:54.410 --> 38:55.690 Simple. 38:55.770 --> 38:58.670 So now I know where they're coming from. 38:58.670 --> 39:01.210 I know what they're trying to do. 39:01.210 --> 39:01.990 Yeah. 39:01.990 --> 39:03.930 You know, think about this. 39:04.090 --> 39:06.010 Also, I will mention this one. 39:06.010 --> 39:07.550 I have a screenshot of it. 39:07.550 --> 39:09.770 I may add it in here. 39:09.770 --> 39:14.770 I'm sure you all have heard of, have I been pwned? 39:14.770 --> 39:16.910 And a lot of people go there. 39:16.910 --> 39:19.170 They put in their email address. 39:19.170 --> 39:23.710 And they get a report back saying whether it's been compromised or not. 39:23.710 --> 39:25.830 I was thinking about that one day. 39:25.830 --> 39:31.070 And I stood up a funky domain similar to have I been pwned. 39:31.070 --> 39:33.330 It was only up for about a week. 39:33.330 --> 39:37.610 I took it down very quickly because I was very surprised. 39:37.610 --> 39:51.250 It said have I been pwned, but instead of asking you to enter your email address, it asked you to enter your password to check to see if that password has been compromised. 39:51.250 --> 39:57.530 In one week, I had thousands of people typing in their passwords. 39:57.530 --> 40:08.870 I was floored, thinking, good Lord, all I did was stand up a simple website that said here, enter your password. 40:08.870 --> 40:11.290 And people started doing it. 40:11.290 --> 40:13.730 It's crazy what people do. 40:13.730 --> 40:24.630 This is why honeypots have so much power in gathering information. 40:26.090 --> 40:29.350 So please, this is a dated quote. 40:29.350 --> 40:31.570 It's from 2014. 40:31.810 --> 40:34.310 But I think you all would agree. 40:34.330 --> 40:40.290 84% of organizations that were breached had evidence of the breach in their log files. 40:40.290 --> 40:48.930 The problem is logging of all their actual applications is terabytes and petabytes and so on. 40:48.930 --> 40:51.270 It's huge. 40:51.930 --> 40:57.210 But honeypots are not going to be false positives. 40:57.550 --> 41:02.350 Honeypots, when they are triggered, they are real attacks. 41:02.350 --> 41:03.050 Why? 41:03.050 --> 41:06.530 Because you don't just drop them all over the place. 41:06.530 --> 41:18.570 I did have one place that we put a bunch of honeypots and we had all the department or the main department head actually told all the other managers where we put the honeypots. 41:18.870 --> 41:22.610 And I was like, seriously, why did you do that? 41:22.610 --> 41:29.930 The whole point of having internal honeypots is to catch insider threats, not for you to tell everybody. 41:29.930 --> 41:37.050 So we had to pull them all back, wait about a month, and then redeploy them so nobody knew where they are. 41:37.050 --> 41:42.450 The point here is planning about where you're going to put honeypots. 41:42.450 --> 41:45.570 So here are your key takeaways from today. 41:45.590 --> 41:47.210 Remember CCAT. 41:47.210 --> 41:50.350 Confuse, confound, annoy, delay. 41:50.390 --> 41:54.970 Also, honeypots have low false positives. 41:54.970 --> 41:58.270 Feed them to a separate sim. 41:58.270 --> 42:06.230 Don't feed them to the same sim that you have collecting all your other data. 42:06.310 --> 42:10.970 They are great tools for detecting lateral movement. 42:10.970 --> 42:11.590 Why? 42:11.590 --> 42:16.230 Because what are people looking for when they get inside your environment? 42:16.230 --> 42:24.090 I can only imagine if Equifax had real honeypots inside their network, they might have actually caught them before they got away with things. 42:24.090 --> 42:30.090 They're cost effective as hell if you're not going out and spending money on commercial versions. 42:30.190 --> 42:37.130 And remember, honeypots are there to defend but mostly to detect your environment. 42:37.130 --> 42:43.790 And what I really want to say is honestly the... well, I'll get to it in a sec. 42:43.790 --> 42:45.650 Let's talk about this. 42:45.750 --> 42:54.410 If you want to only work with IoT honeypots, I recommend Home Pwn. 42:54.550 --> 43:01.790 It's a a kit for testing and looking at IoT devices. 43:01.810 --> 43:17.850 But what I use it for is for gathering all of the screenshots, the data and everything of white bulbs and thermostats and all these things so I can mimic them and make my honeypots look exactly like those devices. 43:18.030 --> 43:19.890 That's one of the things I do with it. 43:19.890 --> 43:22.430 Also, honeypots are great for forensics. 43:22.430 --> 43:23.390 Keep that in mind. 43:23.390 --> 43:24.610 Hell, I had Mirai. 43:24.610 --> 43:26.330 I just didn't know I had it. 43:26.330 --> 43:31.850 But what I really think is important here is honeypots are real threat intel. 43:32.110 --> 43:35.130 They are not fake threat intel. 43:35.130 --> 43:42.170 They are giving you information that is valid on who's attacking you. 43:42.170 --> 43:44.950 It's about thinking differently. 43:44.950 --> 43:56.210 I can't watch hundreds of thousands of servers in my environment every day unless I start to think about it slightly differently. 43:56.210 --> 43:59.290 And that's what we do with honeypots. 43:59.290 --> 44:02.410 So I can't say it enough. 44:02.410 --> 44:03.650 Plan, plan, plan. 44:03.650 --> 44:05.710 That is the key thing. 44:05.710 --> 44:12.990 Honeypots are easy to deploy, but planning the deployment is what's important. 44:12.990 --> 44:15.110 Thank you all very much. 44:15.110 --> 44:17.450 I hope you enjoyed this talk. 44:17.450 --> 44:20.090 I will be posting my slides. 44:20.090 --> 44:26.730 I am working on an actual honeypot customization workshop. 44:26.730 --> 44:28.050 I'm almost there. 44:28.050 --> 44:29.990 I've done a couple of walkthroughs. 44:29.990 --> 44:33.310 The problem has been I need to work on the labs. 44:33.910 --> 44:38.310 But once I get this done, I'm going to give it for free virtually. 44:39.270 --> 44:41.690 So, yeah, I'll be doing that. 44:41.690 --> 44:43.030 Watch my Twitter feed. 44:43.030 --> 44:47.810 You'll see information about that coming up within a couple of months. 44:47.810 --> 44:52.350 I have to get through my move from where I am now out to Washington. 44:52.350 --> 44:54.490 So thank you all very much. 44:54.490 --> 44:56.090 Hope you had a good time. 44:56.090 --> 44:59.930 Hope you liked my spice rack joke. 44:59.930 --> 45:01.510 If not, oh, well. 45:01.510 --> 45:05.050 And here's to Casa Noble and Yeho Tequila.