Honeypots

Module 1: Introduction to Deception-based Security

• What is a Honeypot?
• What is its added value to the organization?
• What should we pay attention to when deploying deception security
• Overview of the type of deceptions (low-medium-high interactions) deployed today.

Module 2: Low-Interaction Honeypots

• Demonstration and hands-on labs on selected low-interaction honeypots: Artiellery, BearTrap, PortSpoof, SpiderTrap,  Weblabryinth, and WordPot [All under the ADHD distribution]
• The purpose: Stalling the hacker
• Up and Down sides of each implementation
• What can we take from low-interaction honeypots to our organizations?

Module 3: Medium-Interaction Honeypots

• Demonstration and hands-on labs on selected medium-interaction honeypots: Glastopf Web App and Windows KFSensor
• The purpose: Making the hacker feel safe to expose hacking tools
• Lesson 1&2: Glastopf Web-App – template-based vs. vulnrability emulator based web honeypot. We will unpack the mechanisms, PHP SandBox usage, and four types of vulnrability emulation: RFI, LFI, Index, and Unknown type of attacks.
• Lesson 3: Windows KFSensor – Emulation of a variety of Windows Services under a heavily monitored Windows Machine
• What can we take from medium-interaction honeypots to our organizations?

Module 4: High-Interaction Honeypots

• Demonstration and hands-on labs on selected high-interaction honeypots: HonSSH, MazeRunner [Cymmetria]
• The purpose: Making the hacker feel safe and analyzing the exposed hacking tools.
• Lesson 1 & 2: HonSSH – An advanced Terminal-based honeypot of SSH tunneling – will be studied in conjuction with OpenVZ decoys to build a full data center and capture the behaivor of hackers as they are trying to log into system servers and turn them into Bots.
• Lesson 3: MazeRunner [Cymmteria] – Emulation of a variety of Data Center services, applied with agentless breadcumbs (Cookies, Credentials, Shared Folder Connections, and etc.) to give a full deception scenerio to the hacker.

Module 5: Honeytokens

• Demonstration of the concept of Honeytokens – how is it used? What is the added value?
• The purpose: Revealing and locating stoled sensitive informaiton
• 0.5 lesson: Overview of the Honeybadger server to trace geo-location and Docz.py generator of inserting webbugs into *.Docx documents. Molehunt tool can also attach documents to suspect list from within the organizaiton.

Module 6: Final Project

• Students would demonstrate the gained knowledge by defending their own assets based solely on honeypots technologies.
• They will be divided into teams – each team will design its own infrastructure to protect its flag.
• Each team would have one Kali-Linux machine to capture the flag of the other team.
• Score Criteria: 80% – Accuracy of defense report based on the attacking strategy of the other team. 20% – The ability to capture the other team’s flag.

• Security analysts who are familiar with defense mechanisms and attacking patterns
• Linux, Windows, Python, and Networking knowledge