Network Decoys.ppt

Network Decoys Perhaps if we confuse them enough, they’ll just go away… ;-) Goals Hide and lie about the structure and composition of our networks in order to confuse and delay attackers Do so in a way that legitimate users of our systems and servers are not hindered. Types of Decoys Tarpits Router-responders Kernel modifications and settings Fake services Full honeypots Decoy Tools LaBrea IPTables IPPersonality WinX registry settings Linux kernel parameters Portsentry VMWare User-Mode Linux LaBrea “Sticky” Honeypot Holds machines for days or weeks. Effective at holding dumb scanning worms /LaBrea.html LaBrea install rpm –Uvh /pub/wstearns/labrea/labrea-2.3-1.i386.rpm Read documentation in /usr/share/doc/labrea-2.3/LaBrea.README Edit /etc/labrea.conf, uncomment: #LABREAZ=“-z” Add any other needed options. LaBrea warnings Run only on the network segment that holds the IPs you’re tarpitting Use the exclude files in /etc to list any IP’s in use so LaBrea will never fight machines that aren’t always there. IPTables Is that system there or not? Filtering out icmp echo requests and replies to existing machines. Responding for nonexistant machines Sending Resets in response to malicious packets (use with care!) IPTables – filtering icmp echos iptables –I INPUT –p icmp –icmp-type echo-request –j DROP iptables –I INPUT –p icmp –icmp-type echo-reply –j DROP IPTables – limiting outbound traffic iptables –I OUTPUT –p icmp –icmp-type echo-reply –j DROP iptables –I OUTPUT –p icmp –icmp-type time-exceeded –j DROP iptables –I OUTPUT –p icmp –icmp-type fragmentation-needed –j ACCEPT iptables –I OUTPUT –p icmp –icmp-type destination-unreachable –j DROP IPTables – responding for nonexistant machines for OneHost in ; do iptables –I –p udp –d $OneHost –j REJECT \ --reject-with port-unreach iptables –I –p tcp –d $OneHost –j REJECT \ --reject-with tcp-reset iptables –I –p icmp –d $OneHost –j DROP iptables –I –d $OneHost –j REJECT \ --reject-with proto-unreach done IPTables – shutting do